Automated investigations in Defender for Endpoint being terminated by system

Nixon, Chuck 1 Reputation point
2022-03-29T15:49:10.81+00:00

I am trying to run a Windows 365 Defender Automated Investigation on a Windows 10 20H2 laptop and the investigation is "Terminated by System." I checked the log for the device and the log action field lists "Check machine coverage" and the description is "Check if <machine_name> is covered by automated investigation."

The log message would seem to indicate that the machine is not licensed for Automated Investigations. The user the machine is licensed to has a Microsoft 365 E5 Security license as well as a Microsoft 365 E3 license. I do note that in the user's license list there is an entry for Microsoft 365 E5 Security and only one of the seven services is enabled (Microsoft Defender for Endpoint.)

Why is Automated Investigation not working?

Chuck

Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,606 questions