Detections
Analytics

2.4.5 Ensure 'AIR' remediation is enabled

Information

Automated Investigation and Response (AIR) investigates alerts and correlates related signals into investigations. When AIR identifies malicious email messages, it groups them into clusters based on shared characteristics like common malicious file, URL, or sending attributes and produces remediation actions for each cluster.

This setting controls whether AIR-identified malicious message clusters are remediated automatically, without requiring SecOps approval. Administrators can enable automatic remediation for one or more cluster types:

 - Similar files: Clusters sharing a similar malicious file
 - Similar URLs: Clusters sharing a similar malicious URL
 - Multiple similar attributes: Clusters grouped by multiple shared attributes such as sender IP address, sender domain, or message subject

When enabled, the configured remediation action is applied immediately upon cluster identification.

The recommended state is to automatically remediate message clusters.

When automatic remediation is disabled, malicious message clusters identified by AIR remain in users' mailboxes as pending actions until a security analyst manually approves each remediation. During this approval window, users may interact with, open, or forward malicious messages, increasing the risk of a successful compromise. Enabling automatic remediation ensures identified threats are contained immediately upon detection, minimizing the exposure window and reducing the operational burden on security teams to manually review and approve routine threat clusters.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

To remediate using the UI:

 - Navigate to Microsoft Defender https://security.microsoft.com/
 - Expand System > Settings > Email & collaboration > MDO automation settings.
 - Under Message clusters check the following:

 - Similar files
 - Similar URLs
 - Multiple similar attributes

 - Click Save to apply the changes.

Impact:

Automatic remediation removes the manual SecOps approval step for qualifying message cluster actions. If AIR incorrectly classifies a legitimate message cluster as malicious, affected messages will be soft deleted without prior review. Soft deleted messages are moved to the Recoverable Items folder and can be restored through the Action center, Threat Explorer, or Advanced Hunting, subject to each mailbox's deleted item retention period (14 days by default).

Organizations should verify retention policies and legal obligations before enabling this setting, as retention configuration affects whether soft deleted messages remain recoverable.

Clusters exceeding 10,000 messages are always excluded from automatic remediation and will continue to require manual approval.

License Requirement: This setting requires Defender for Office 365 Plan 2 which is included in Microsoft 365 E5.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-3, 800-53|SI-8, 800-53|SI-16, CSCv7|7

Plugin: microsoft_azure

Control ID: 43b3a4c6076eb944b402c38dbd2189b12d0e1f27f71426fc49b758b2ed4d816d