Microsoft Defender Native Automations

Many of your customers run Microsoft Defender with its native automations turned on. Those automations investigate, remediate, and even contain threats on their own, often before a ContraForce analyst or the Security Delivery Agent ever looks at the incident. This page explains what Defender’s automations do by themselves, how ContraForce makes their status visible per Workspace, and where the Security Delivery Agent defers to them so no agent compute is spent on incidents Defender already resolved.

​

Part 1: Defender’s Native Automations

Microsoft Defender ships three distinct automation mechanisms. They trigger on different signals, act at different layers, and sit at opposite ends of the severity spectrum. Understanding which is which is the key to understanding how ContraForce coordinates with each.

​

Automated Investigation and Response (AIR)

AIR is triggered by alert type, not by incident severity. Defender launches an automated investigation when it sees alerts such as suspicious email, attachment, or URL activity; compromised-account signals; Zero-hour Auto Purge actions; user submissions (user-reported phishing); user-click alerts; and suspicious mailbox behavior. An analyst can also start an investigation manually. Which alerts launch an investigation is driven by Defender’s Threat-management alert policies, specifically those with Automated investigation = Yes. Once running, an investigation produces findings and recommended actions. Whether Defender applies remediation automatically or holds it for analyst approval depends on the tenant’s automation level: full automation remediates automatically, while semi-automation queues actions in the Action Center for approval.

​

Zero-hour Auto Purge (ZAP), Defender for Office 365

ZAP retroactively neutralizes phishing, spam, and malware email, and Microsoft Teams messages, that were already delivered to cloud mailboxes. Because spam and malware signatures update continuously, a message that was clean at delivery can be re-judged as malicious afterward. ZAP acts on that message up to 48 hours after delivery, across all cloud mailboxes. It is on by default for high-confidence phishing and malware. The action ZAP takes depends on the verdict and on the tenant’s anti-spam, anti-malware, and anti-phishing policies: it may quarantine the message or move it to Junk Email. Like AIR, ZAP is driven by verdict and policy, not by incident severity.

​

Automatic Attack Disruption (Defender XDR)

Automatic Attack Disruption correlates signals across Defender XDR into a single high-confidence incident for active, sophisticated attacks: ransomware campaigns, business email compromise, and adversary-in-the-middle. It operates at the incident level and is inherently high severity. This is the opposite end of the spectrum from AIR’s benign auto-resolutions. When Attack Disruption fires, it contains the attack automatically, without approval, regardless of the tenant’s automation-level settings. Its response actions include: contain device, contain IP, isolate device, disable user (including Entra-only cloud-native accounts), revoke user sessions, and OAuth app containment. You can recognize an attack-disruption incident by several signals: the Attack Disruption incident tag in the queue and on the incident page, a (attack disruption) suffix appended to the incident title, the actions listed in the Action Center, and the DisruptionAndResponseEvents advanced-hunting table.

​

Comparison at a Glance

​

Part 2: How ContraForce Complements Defender’s Automations

ContraForce assumes Defender’s automations are running and coordinates around them in two ways: it makes their status visible to you per Workspace, and it makes the Security Delivery Agent automation-aware at dispatch time so the agent does not investigate an incident Defender already closed.

​

Visibility: The Defender XDR Module Configuration Tab

The Defender XDR module’s Configuration tab gives you a per-Workspace read on what Defender is actually doing, so you are not guessing whether a customer’s automations are on. The probe runs automatically when the Defender module is consented at onboarding, and on demand whenever you click the Run detection button on the card. There is no scheduled background refresh today, so for a long-lived Workspace the card reflects the last time the probe actually ran. The Last detected timestamp under the card tells you how stale the reading is.

​

An Automation-Aware Security Delivery Agent

The Security Delivery Agent is built to defer to Defender’s own automation at dispatch time. Two behaviors keep it from spending an investigation on work Defender already did. The net effect for you is that the agent does not investigate incidents Defender already resolved, and no agent compute is spent on them.

​

Guidance for Service Providers

​

What This Means for You

• Defender’s automations run on their own terms. AIR triggers on alert type and often auto-resolves benign incidents; ZAP purges bad mail up to 48 hours after delivery; Attack Disruption contains live attacks without approval. None of the three keys off ContraForce incident severity except in the sense that Attack Disruption is inherently high severity.
• ContraForce coordinates at the incident level. The Configuration tab shows you what each automation is doing per Workspace, and the Security Delivery Agent defers to Defender through a pre-dispatch skip and an adaptive settling window.
• You save agent effort without losing coverage. Low and informational severity incidents get a chance to auto-resolve before the agent spends compute on them, while medium, high, and attack-disruption incidents are engaged immediately.
• Action-level coordination is not there yet. ZAP dedup and containment guards at Gamebook-action time are not implemented, so the Action Center remains the source of truth before running an email or containment action.

​

Related Documentation

---