automated investigation and response

The automated investigation and response tag covers Microsoft Defender XDR’s planned transition away from manually triggered AIR and its standalone experience. The current guidance sets September 1, 2026, as the deadline for this change. Organizations with playbooks, scripts, runbooks, or integrations that start AIR directly should inventory those dependencies and update them before the cutoff. The replacement workflow is to use on-demand full antivirus scans while allowing Defender’s always-on protection to trigger automated investigation and response as designed. Tagged coverage focuses on migration planning, operational readiness, workflow testing, and avoiding disruptions to existing security procedures.