> ## Documentation Index
> Fetch the complete documentation index at: https://docs.contraforce.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Microsoft Defender Native Automations
> How Microsoft Defender's native automations (AIR, ZAP, and Automatic Attack Disruption) work, how ContraForce surfaces their status per Workspace, and how the Security Delivery Agent defers to them so it does not waste effort on work Defender already did.
Many of your customers run Microsoft Defender with its native automations turned on. Those automations investigate, remediate, and even contain threats on their own, often before a ContraForce analyst or the Security Delivery Agent ever looks at the incident. This page explains what Defender's automations do by themselves, how ContraForce makes their status visible per Workspace, and where the Security Delivery Agent defers to them so no agent compute is spent on incidents Defender already resolved.
Coordination today covers **incident dispatch**, not individual response actions. The agent stands down when Defender already handled an incident, but ContraForce does not yet re-check ZAP or containment state at the moment a Gamebook action runs. Part 2 marks exactly which behaviors are live and which are not.
This is a reference page for service providers managing customer Workspaces. For setting up the Defender integration itself, see [Microsoft Defender for Endpoint Module](/defender-for-endpoint-module) and the [Microsoft Defender Capability Matrix](/guides/technical/microsoft-defender-capability-matrix).
## Part 1: Defender's Native Automations
Microsoft Defender ships three distinct automation mechanisms. They trigger on different signals, act at different layers, and sit at opposite ends of the severity spectrum. Understanding which is which is the key to understanding how ContraForce coordinates with each.
**Automated Investigation and Response.** Investigates alerts of specific types and applies or queues remediation. Frequently auto-resolves benign incidents.
**Zero-hour Auto Purge.** Retroactively quarantines or junks malicious mail already sitting in the mailbox, up to 48 hours after delivery.
**Automatic Attack Disruption.** Contains active, high-confidence attacks at machine speed, without waiting for approval.
### Automated Investigation and Response (AIR)
[AIR](https://learn.microsoft.com/defender-xdr/m365d-autoir) is triggered by **alert type, not by incident severity**. Defender launches an automated investigation when it sees alerts such as suspicious email, attachment, or URL activity; compromised-account signals; [Zero-hour Auto Purge](https://learn.microsoft.com/defender-office-365/zero-hour-auto-purge) actions; user submissions (user-reported phishing); user-click alerts; and suspicious mailbox behavior. An analyst can also start an investigation manually. Which alerts launch an investigation is driven by Defender's Threat-management alert policies, specifically those with **Automated investigation = Yes**.
Once running, an investigation produces findings and recommended actions. Whether Defender applies remediation automatically or holds it for analyst approval depends on the tenant's [automation level](https://learn.microsoft.com/defender-endpoint/automation-levels): full automation remediates automatically, while semi-automation queues actions in the Action Center for approval.
**AIR frequently auto-resolves benign incidents.** When an investigation finds no threat, Defender resolves the incident on its own. Microsoft notes this is a common outcome in user-submission scenarios, where a user reports a message as phishing and the investigation clears it. This is exactly the pattern ContraForce's settling window is designed for (see Part 2).
**A Defender product change that does not affect the integration.** As of 2026-09-01, Microsoft is folding the standalone Defender for Endpoint AIR investigation experience into the default protection stack; it will no longer run as a separate investigation experience or be available for manual triggering in Defender for Endpoint. ContraForce reads incident and alert **state**, not AIR investigation objects, so this transition does not change how the integration behaves. AIR capabilities for Defender for Office 365 remain available.
### Zero-hour Auto Purge (ZAP), Defender for Office 365
[ZAP](https://learn.microsoft.com/defender-office-365/zero-hour-auto-purge) retroactively neutralizes phishing, spam, and malware email, and Microsoft Teams messages, that were already delivered to cloud mailboxes. Because spam and malware signatures update continuously, a message that was clean at delivery can be re-judged as malicious afterward. ZAP acts on that message **up to 48 hours after delivery**, across all cloud mailboxes. It is on by default for high-confidence phishing and malware.
The action ZAP takes depends on the verdict and on the tenant's anti-spam, anti-malware, and anti-phishing policies: it may quarantine the message or move it to Junk Email. Like AIR, ZAP is driven by verdict and policy, **not by incident severity**.
**ZAP has a long tail and a visibility gap.** Two facts shape how ContraForce coordinates with it:
* **The 48-hour window is far longer than any dispatch delay.** A message can be purged well after an incident lands in ContraForce, so ZAP cannot be accounted for with a short settling delay alone. Accounting for it fully requires a re-check at the moment a remediation is about to run, which ContraForce does not perform today (see Part 2).
* **ZAP is not recorded in Exchange mailbox audit logs.** It is a system action visible through [Threat Explorer](https://learn.microsoft.com/defender-office-365/zero-hour-auto-purge#how-to-see-if-zap-moved-your-message) by filtering the **Additional action** column for the value **ZAP**. Allowlists and Exchange mail-flow (transport) rules can also override ZAP, so coverage is not uniform across a tenant.
### Automatic Attack Disruption (Defender XDR)
[Automatic Attack Disruption](https://learn.microsoft.com/defender-xdr/automatic-attack-disruption) correlates signals across Defender XDR into a single high-confidence incident for active, sophisticated attacks: ransomware campaigns, business email compromise, and adversary-in-the-middle. It operates at the incident level and is inherently high severity. This is the opposite end of the spectrum from AIR's benign auto-resolutions.
When Attack Disruption fires, it **contains the attack automatically, without approval, regardless of the tenant's automation-level settings**. Its [response actions](https://learn.microsoft.com/defender-xdr/automatic-attack-disruption#automated-response-actions) include: contain device, contain IP, isolate device, disable user (including Entra-only cloud-native accounts), revoke user sessions, and OAuth app containment.
**Attack Disruption acts without approval and cannot be gated by automation level.** Because it contains live attacks at machine speed, there is no approval step to wait on and no automation setting that holds it back. Any coordinating system must assume the containment is already in effect. ContraForce never delays an attack-disruption incident: it is excluded from the settling window and the agent engages immediately.
Note that ContraForce does not currently block a Gamebook action against an entity Defender has already contained. Containment state is surfaced for awareness, not enforced at action time, so analysts should check the Action Center before running a containment action on an attack-disruption incident.
You can recognize an attack-disruption incident by several signals: the **Attack Disruption** incident tag in the queue and on the incident page, a **(attack disruption)** suffix appended to the incident title, the actions listed in the Action Center, and the [DisruptionAndResponseEvents](https://learn.microsoft.com/defender-xdr/advanced-hunting-disruptionandresponseevents-table) advanced-hunting table.
### Comparison at a Glance
| Mechanism | What triggers it | What it does | Severity / scope | How ContraForce accounts for it |
| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **AIR** | Specific alert types (suspicious email / URL / attachment, compromised account, ZAP, user submissions, user-click, suspicious mailbox behavior) or a manual analyst action | Runs an automated investigation, produces findings and recommended actions, applies or queues remediation, and auto-resolves incidents where no threat is found | Any severity; commonly low or benign (user-reported phishing) | Adaptive settling window on low-severity incidents, plus a pre-dispatch skip when AIR has already resolved or merged the incident |
| **ZAP** | Updated spam / malware / phishing signals matching already-delivered mail or Teams messages, up to 48 hours after delivery | Retroactively quarantines or junks the message per the anti-spam, anti-malware, and anti-phishing policies | Not tied to incident severity; acts at the message level | Visibility only today. The Native Automations card reports whether ZAP is active in the tenant; ContraForce does not yet check ZAP before proposing an email remediation |
| **Attack Disruption** | High-confidence correlation of XDR signals for an active, sophisticated attack (ransomware, BEC, adversary-in-the-middle) | Contains the attack without approval: contain device / IP, isolate device, disable user, revoke sessions, OAuth app containment | Inherently high severity; acts at the incident level | Never delayed. Attack-disruption incidents are excluded from the settling window, so the agent engages immediately |
## Part 2: How ContraForce Complements Defender's Automations
ContraForce assumes Defender's automations are running and coordinates around them in two ways: it makes their status visible to you per Workspace, and it makes the Security Delivery Agent automation-aware at dispatch time so the agent does not investigate an incident Defender already closed.
### Visibility: The Defender XDR Module Configuration Tab
The Defender XDR module's **Configuration** tab gives you a per-Workspace read on what Defender is actually doing, so you are not guessing whether a customer's automations are on.
A per-mechanism status for AIR, ZAP, and Attack Disruption:
* **Active**, with an observed count and recency
* **Not observed**, meaning licensed (or licensing unknown) but no events in the probe window
* **Not licensed**, asserted only when the license read succeeded and the SKU is absent
* Before any probe has run, the card is empty and prompts you to click **Run detection**
The status is derived by behavioral probing: Defender advanced hunting plus Microsoft Graph, using the consent already collected when the module was onboarded. The hunting and alert reads need no additional scope.
Two views of the customer's Defender footprint side by side:
* **License truth:** which Defender products the Workspace is licensed for
* **Signal truth:** which products are actually emitting alerts
Comparing the two surfaces "licensed but no signal" gaps, where a product is paid for but silent.
**License truth requires one extra permission.** The license half of the Detected Products card reads Microsoft Graph `subscribedSkus`, which needs `Organization.Read.All` admin consent on the Defender app registration. Without it the probe degrades gracefully: the automation states still populate from hunting data, but license truth is unavailable and the "licensed but no signal" gap list is suppressed rather than guessed. An empty gap list therefore means either no gaps or no license read, so confirm consent before reading it as a clean bill of health.
The probe runs automatically when the Defender module is consented at onboarding, and on demand whenever you click the **Run detection** button on the card. There is no scheduled background refresh today, so for a long-lived Workspace the card reflects the last time the probe actually ran. The **Last detected** timestamp under the card tells you how stale the reading is.
### An Automation-Aware Security Delivery Agent
The Security Delivery Agent is built to defer to Defender's own automation at dispatch time. Two behaviors keep it from spending an investigation on work Defender already did.
**"Not observed" does not disable the settling window.** Absence of evidence is not evidence of absence, so a mechanism the probe did not observe is still treated as possibly active. The gate stays conservative rather than assuming an automation is off.
Immediately before dispatching the agent, ContraForce re-checks the **live** Defender incident state. If the incident was resolved by AIR, or was merged or redirected into another incident, the agent is skipped entirely: no investigation runs, no agent compute is spent, and a **skipped: handled by Defender automation** entry is written to the Workspace activity log for auditability. You keep a clear record of why the agent stood down.
For **low and informational severity** Defender XDR incidents, ContraForce briefly holds the incident before running the agent, giving Defender's AIR a chance to auto-resolve it first (the common outcome for user-reported phishing). The length of the hold is derived per Workspace from how quickly that tenant's incidents actually auto-resolve, bounded to between 5 and 30 minutes. **Medium and high severity incidents, and attack-disruption incidents, are never delayed**: the agent engages immediately.
The window is set automatically from the probe. There is no manual override: the Native Automations card displays the current value as a read-only chip so you can see what the agent is waiting for.
The net effect for you is that the agent does not investigate incidents Defender already resolved, and no agent compute is spent on them.
**Not yet covered: ZAP dedup and containment guards at action time.** Both coordination points below are on the roadmap but are not implemented today. Neither the agent nor a Gamebook currently re-checks ZAP or Defender containment state before proposing a response action:
* **ZAP.** Because ZAP acts up to 48 hours after delivery, an email remediation can be proposed for a message Defender already purged. ContraForce detects whether ZAP is active in the tenant, but does not check individual messages at action time.
* **Attack-disruption containment.** ContraForce does not block an action against an entity Defender has already contained.
Until these ship, treat the Action Center as the source of truth before running an email or containment action on a Defender incident.
### Guidance for Service Providers
Use the **Detected Products** card to confirm which Defender automations a customer is actually licensed for before you count on them to handle a class of incidents. A "licensed but no signal" gap means an automation you expect to fire may not be.
Check that `Organization.Read.All` is consented first. Without it there is no license truth, and the gap list is suppressed rather than populated, so it will look clean whether or not gaps exist.
The probe does not refresh on a schedule. If a customer enables an automation, changes licensing, or onboards a new Defender product, the card keeps showing the previous reading until someone clicks **Run detection**. Check the **Last detected** timestamp before treating the card as current.
Each Defender automation is covered differently today:
* **AIR auto-resolution** is handled by the settling window plus the pre-dispatch skip.
* **ZAP** is detected for visibility only. There is no pre-action dedup at Gamebook time yet, so an email action can be proposed for a message ZAP already purged.
* **Attack Disruption** is never delayed and the agent engages immediately, but ContraForce does not block an action against an already-contained entity.
## What This Means for You
* **Defender's automations run on their own terms.** AIR triggers on alert type and often auto-resolves benign incidents; ZAP purges bad mail up to 48 hours after delivery; Attack Disruption contains live attacks without approval. None of the three keys off ContraForce incident severity except in the sense that Attack Disruption is inherently high severity.
* **ContraForce coordinates at the incident level.** The Configuration tab shows you what each automation is doing per Workspace, and the Security Delivery Agent defers to Defender through a pre-dispatch skip and an adaptive settling window.
* **You save agent effort without losing coverage.** Low and informational severity incidents get a chance to auto-resolve before the agent spends compute on them, while medium, high, and attack-disruption incidents are engaged immediately.
* **Action-level coordination is not there yet.** ZAP dedup and containment guards at Gamebook-action time are not implemented, so the Action Center remains the source of truth before running an email or containment action.
## Related Documentation
Consent the module and enable Defender data and response in ContraForce
Which ContraForce capabilities are available by Defender license tier
How the Security Delivery Agent runs on the incident queue
How Gamebook response actions work
***
Questions about how ContraForce coordinates with Microsoft Defender's native automations? Contact us at [support@contraforce.com](mailto:support@contraforce.com).