Share via

Defender XDR AIR

cyber punk 0 Reputation points
2025-11-20T03:29:46.4433333+00:00

Hi there,

I am trying to set up Automatic Investigation and Remediation for reported phishing email through PAB. We have defender for Office 365 plan1 which comes with Business Premium.
My manager said XDR AIR included in Plan1 and microsoft document says otherwise.

https://learn.microsoft.com/en-us/defender-office-365/mdo-about

Can anyone clarify that.

Thanks in advance

Microsoft Security | Microsoft Defender | Microsoft Defender for Office 365
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Q&A Assist
    2025-11-20T03:29:58.1833333+00:00
    AI generated content. This question contains an answer created with AI from Q&A Assist. Learn more

    Defender for Office 365 Plan 1 does not include the Automated Investigation and Response (AIR) capabilities. AIR is a feature that is available in Defender for Office 365 Plan 2. Therefore, if your organization is using Defender for Office 365 Plan 1, you will not have access to the AIR functionalities, including the automatic investigation for reported phishing emails.

    For more detailed information, you can refer to the Microsoft documentation that outlines the differences between the plans and their respective features.

    References:

  2. Adam Zachary 2,255 Reputation points
    2025-11-20T21:11:32.3566667+00:00

    I ran into the same confusion with one of our customers not long ago. The naming changes around Defender XDR make it look like AIR might be included everywhere, but it isn’t.

    Automatic Investigation and Response is still a (Plan 2) only feature. Defender for Office 365 Plan 1 gives you the core anti-phishing and Safe Links/Safe Attachments protection, but it does not include automated investigations, automated remediation actions, or the full XDR response workflows.

    If you want AIR to automatically investigate reported phishing messages from the PAB, you would need Defender for Office 365 Plan 2 or any bundle that includes it, like E5 or Microsoft Defender for XDR. With Business Premium (which includes Plan 1), AIR simply won’t light up in the portal

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.