Microsoft Defender for Office 365: AIR Investigation Experience Improvements

🚨 The Signal: Microsoft Defender for Office 365 AIR investigations will no longer auto-refresh, requiring manual refresh. Investigation names will be simplified, removing sensitive data like email subjects and UPNs to enhance privacy and performance.

The Impact

Security operations teams are affected by changes to the AIR investigation interface, with a minor positive impact on data privacy.

• SOC analysts: Must manually refresh investigation pages, potentially slowing workflow.
• Security administrators: Investigation names will be less descriptive, requiring adaptation.
• Incident responders: Reduced exposure of sensitive data in investigation names improves privacy.
• Organizations using Defender for O365: Improved portal performance and reduced network activity.

Domain: Defender · Impact: low · Workload: Microsoft Defender