Microsoft Defender for Office 365: AIR Initiated Remediation Logging

The AIR attribution update will empower customers with enhanced insights by deciphering between remediations produced by AIR versus truly manual remediations initiated independently by SecOps teams. Presently, all actions produced by AIR and approved by SecOps are logged as manual remediations throughout the portal. With this update, messages that are remediated as a result of approval of an AIR action will be logged as SecOps approved automated actions.