Defender automated investigation runs in Full or Semi automation

When I roll out Microsoft Defender for Endpoint and Defender for Office 365 in real environments, automated investigation is no longer a nice extra. It sits at the centre of incident response. One thing I keep seeing is that the choice between Full and Semi automation is more than a technical setting. It decides how fast threats get cleaned up, how much manual work lands on the SOC, and how much you can trust your overall security posture. In larger tenants with thousands of endpoints, automation is the only approach that scales with the steady stream of alerts.

Each device group gets either Full or Semi automation

Setting the automation level per device group is one of the most useful features in Defender for Endpoint, and one of the least used. In the Defender portal under System → Settings → Endpoints → Device groups, I define for each group (workstations, servers, test machines) whether remediation actions like file quarantine, process termination or registry changes run fully automatically or need analyst approval. For most client device groups, the default and recommended setting is Full automation. On critical production servers, domain controllers or legacy platforms, I nearly always choose Semi automation, which means the SOC has to review every cleanup action and approve or reject it before anything happens.

The following flow diagram shows how Defender's automated investigation decides on remediation based on the device group setting:

flowchart TD
    A1["Threat detected"] --> A2["Automated investigation started"]
    A2 --> A3["Determine device group"]
    A3 -->|"Full automation"| A4["Remediation action runs automatically"]
    A3 -->|"Semi automation"| A5["SOC reviews pending action"]
    A5 --> A6["SOC approves or rejects"]
    A4 --> A7["Result appears in Action Center"]
    A6 --> A7

Figure: The automation level of the device group determines whether Defender remediates immediately or waits for SOC review.

With this setup you get quick, automatic cleanup on standard clients and a deliberate review step on critical systems. Microsoft's documentation on automated investigation goes into the details. In practice, though, tuning automation by device group is among the security decisions with the biggest effect.

The Action Center shows every response action in one place

All planned, running and completed remediation actions show up in the Action Center of the Defender portal. That's where I check which actions ran and on which devices, what is still waiting for approval, and whether something needs manual attention. You can filter by device group, action type or status, which saves a lot of time in day-to-day SOC work. For device groups on Semi automation, my rule is to go through the Action Center at least once a day so urgent cleanups don't sit and wait.

Practical tip: Small SOC teams can often get by with a fixed weekly slot to go through all open and completed actions in the Action Center, particularly for servers on Semi automation. In larger organisations a daily routine works better, so no remediation stays pending for too long.

Completed actions stay visible for audit and tracking. People tend to overlook this, but it helps a lot when you have to explain who approved what and when.

Full automation is the right choice for most client devices

Plenty of admins are nervous about Full automation at first, worried that Defender might remove something important. In my experience the risk is fairly low. Remediation steps are always logged (and many of them can be undone in the Action Center), and Microsoft's automated investigation logic has matured to the point where false positives are rare. On standard clients the payoff is large. Threats disappear faster, the SOC sees far fewer tickets, and outbreaks can be contained before they spread. Full automation also gets you more out of Defender for Office 365, because compromised mails or attachments are deleted right away instead of waiting in a SOC queue.

If you'd like to know how Defender XDR groups and prioritises incidents, my post Getting started with Microsoft Defender XDR, covering unified incidents, automation and hunting walks through the basics.

Critical servers stay on Semi automation with regular SOC review

Even with all these benefits, I still recommend Semi automation for business-critical servers and sensitive systems. Legacy applications, financial data and production control are areas where a small mistake in automated remediation can cause serious damage. For that reason every SOC shift should look at pending server actions in the Action Center, and some teams go further and set up alerts for new "Pending" actions so nothing critical gets missed.

To list every automated investigation started in the past week, run this KQL query in the Microsoft Defender portal (Hunting → Advanced hunting; requires Defender for Endpoint P2):

DeviceEvents
| where ActionType == "AutomatedInvestigationLaunched"
| where Timestamp > ago(7d)
| project Timestamp, DeviceName, InitiatingProcessFileName, InvestigationId

The results show where automation stepped in and which endpoints were involved. Microsoft's overview of automated investigation and response in Defender XDR explains the full flow and the available action types.

I automate wherever I can and review on a fixed schedule

Defender's automated investigation won't solve everything, but it is one of the most effective tools we have against current threats. For the large majority of client devices, Full automation should be the default. It cuts SOC workload and speeds up response in a way manual processes can't match. Semi automation is still the safer option for critical servers, provided you have a clear approval process and a review routine built into the SOC workflow. If you make the Action Center review a weekly habit, or better a daily one, automation in Defender really pays off and fewer incidents slip through the cracks.