capability

Office 365 Automated Investigation and Response

Defender for Office 365 automated investigation and response investigates email and collaboration threats and recommends or takes remediation actions.

capabilitiesCurrent

Relationships

Microsoft Defender for Office 365
Source productproductMicrosoft Defender for Office 365 Plan 2
Required licenselicenseEmailPostDeliveryEvents
Related tabletableMessagePostDeliveryEvents
Related tabletableEmailEvents
Related tabletableMicrosoft Graph Security API
API accessapi

Configuration Methods

MethodSupportReference or Gap
PortalSupported Reference
PowerShellSupported Reference
REST APIGapUse Graph Security actions/incidents where available; AIR settings are not ARM/Terraform resources.
GraphSupported Reference
ARMGapNo ARM resource is recorded for this capability.
BicepGapNo Bicep resource is recorded for this capability.
TerraformGapMDO AIR is a Defender XDR operational capability, not an azurerm/azapi resource.
GitHub ActionsSupported Reference
Azure DevOpsSupported Reference