Issues with "Pending Actions" in Microsoft Defender XDR Despite Full Remediation Setting

Question

Issues with "Pending Actions" in Microsoft Defender XDR Despite Full Remediation Setting

Zeynep-2956 0

When an email is soft deleted (both manually and under automation), this action awaits approval in the action center. This doesn't happen for every soft delete. Some occur without needing approval. Upon checking the configurations, I see that full remediation is selected for all endpoints. Therefore, the emails should have been deleted automatically as a result of the automated investigation without awaiting approval. What is the reason for this, and how can I resolve it?

Raja Pothuraju 47,730 Reputation points Microsoft Employee Moderator

2025-01-20T19:58:01.22+00:00

Hello @Zeynep,

Thank you for posting your query on Microsoft Q&A.

I am currently looking into this and will provide you with the information shortly.
Catherine Kyalo 3,100 Reputation points Microsoft Employee

2025-02-20T07:58:46.2833333+00:00

Hi @Zeynep-2956,

Do you have MDO?

I think MDO maybe producing the Action pending items.

If the investigation found no remediation actions meaning the email for example had no malicious links – then no action is recommended/pending action will be created hence no approval is required. (Could you check that some of the one's that did not require approval were malicious? )

Here is a link with the matrix. Refer: Automated investigation and response in Microsoft Defender for Office 365 - Microsoft Defender for Office 365 | Microsoft Learn

Below is a table of some categories and remediation actions that may result Remediation actions from AIR - Microsoft Defender for Office 365 | Microsoft Learn

Note: No Remediation Actions happen Automatically

Reference: Automated investigation and response in Microsoft Defender for Office 365 - Microsoft Defender for Office 365 | Microsoft Learn

Additionally, this is expected behavior Review and manage remediation actions in AIR - Microsoft Defender for Office 365 | Microsoft Learn

Also, you may want to check policies in Defender for Office 365, specifying actions to be taken on different types of messages when they are identified as malicious post-delivery.

If you find the answer above helpful, please Accept the answer to help anyone in the community who might have a similar question to quickly find the solution.

Your answer

Raja Pothuraju 47,730 Reputation points Microsoft Employee Moderator

2025-01-20T19:58:01.22+00:00

Hello @Zeynep,

Thank you for posting your query on Microsoft Q&A.

I am currently looking into this and will provide you with the information shortly.
Catherine Kyalo 3,100 Reputation points Microsoft Employee

2025-02-20T07:58:46.2833333+00:00

Hi @Zeynep-2956,

Do you have MDO?

I think MDO maybe producing the Action pending items.

If the investigation found no remediation actions meaning the email for example had no malicious links – then no action is recommended/pending action will be created hence no approval is required. (Could you check that some of the one's that did not require approval were malicious? )

Here is a link with the matrix. Refer: Automated investigation and response in Microsoft Defender for Office 365 - Microsoft Defender for Office 365 | Microsoft Learn

Below is a table of some categories and remediation actions that may result Remediation actions from AIR - Microsoft Defender for Office 365 | Microsoft Learn

Note: No Remediation Actions happen Automatically

Reference: Automated investigation and response in Microsoft Defender for Office 365 - Microsoft Defender for Office 365 | Microsoft Learn

Additionally, this is expected behavior Review and manage remediation actions in AIR - Microsoft Defender for Office 365 | Microsoft Learn

Also, you may want to check policies in Defender for Office 365, specifying actions to be taken on different types of messages when they are identified as malicious post-delivery.

If you find the answer above helpful, please Accept the answer to help anyone in the community who might have a similar question to quickly find the solution.