Defender switches off the investigate button: AIR can no longer be triggered by hand

Microsoft Defender for Endpoint's documentation has carried a two-paragraph "Important" box for weeks now. The first says that as of 1 September 2026 automated investigation and response — AIR — will no longer run as a separate investigation experience and will no longer be available for manual triggering. The second says what to do instead: "for on-demand investigations, run a full antivirus scan as needed". That day is tomorrow.

We sell managed EDR and MDR, so you know where we stand: it suits us if anything happening in your security console worries you. So we will start with the part that does not suit us: for most people reading this article, tomorrow's change asks nothing of them. And then we will get to what it does ask, which is smaller and more awkward than the headline suggests.

Sixty-one days of notice, and even so

The notice went out through the channel these things go out through: the tenant message center, identifier MC1411577, published on 2 July 2026 and updated in late August. From publication day to effective date there are sixty-one days. The rollout window the message itself declares is "early September 2026", and the scope is every environment: worldwide, GCC, GCC High and DoD.

Sixty-one days is plenty of notice. And even so, the bet we would make — and it is a bet, not a fact — is that in most thirty- or fifty-person companies nobody has read that message. Not out of negligence: the message center spits out dozens of notices a month, nearly all of them irrelevant to you, and the one that matters comes in the same typeface as the one announcing an icon change. We wrote about this when an August patch broke printing: the problem is rarely that they do not warn you; the problem is that they warn you about everything through the same channel.

What actually breaks has an endpoint name

There are two ways to launch an investigation by hand, and today both still work. One is human: open the device list, spot one with a high risk level, open its flyout and click Initiate Automated Investigation. The other is a call:

POST https://api.security.microsoft.com/api/machines/{id}/startInvestigation

That is the piece to go looking for today. The API asks for the Alert.ReadWrite.All permission for applications or Alert.ReadWrite for user credentials, the Active remediation actions role, a body with a mandatory Comment field, and returns 201 Created with the investigation created. It is capped at fifty calls per hour. If somebody on your team once built a flow along the lines of "high-severity alert out of hours → start investigation → ping Teams", that flow is exactly what stops working.

And here is the unpleasant part: an integration calling an endpoint that has stopped answering does not warn you with a red window. It returns an error somewhere nobody looks at, or worse, it stalls halfway without returning anything, and the runbook keeps showing up in the list as though it worked. We treat our own automations as production services for exactly this reason: inventoried, with an owner and an update window.

"Run a full scan" answers a different question

Let us start by granting Microsoft the part where they are right. The box says AIR's detection and response capabilities "are already included in Microsoft Defender's default antivirus protection stack and run automatically". We have no reason to doubt it and we are not going to imply that your estate is less protected today than it was yesterday. It is not.

What we do argue, and we flag it as our own reading, is that the declared replacement does not cover the use case the button covered. A full antivirus scan looks at files on one machine. An automated investigation, as the documentation itself describes it, does four more things:

• It spreads on its own. If the incriminated entity shows up on another machine, the investigation expands to that machine and starts a security playbook there. And there is a concrete threshold: if the expansion reaches ten or more devices from the same entity, that expansion requires approval and lands on the pending actions tab.
• It issues a verdict on each piece of evidence, and only three: malicious, suspicious or no threats found. A scan does not issue verdicts: it finds or it does not find.
• It turns the verdict into actions — quarantining a file, stopping a service, removing a scheduled task — recorded in the Action center, pending or done, and reversible.
• It hangs off the alert and the incident. It is not a loose task: it is the response to something specific that has happened, with its trail.

The question the button asks is "what is happening on this machine and how far has it got?". The question a full scan asks is "are there bad files on this disk?". Both are legitimate questions and they are not the same one. When you are staring at an odd machine at eleven at night — the case we described with the print server running as SYSTEM — what you need to know is not whether there is a bad file: it is whether what happened there has also happened somewhere else.

Who this asks nothing of

If you do not use Defender for Endpoint, this is not about you. If you do use it and have never clicked that button — which is the case for the vast majority — there is nothing for you to do: protection carries on running. If you are on Defender for Business, AIR capabilities come preconfigured and are not configurable, with full automation on by default and applied to every device: there is no level to adjust and remediation already happens on its own. And if nobody in your organisation has ever written a script against the Defender API, there is nothing to search for.

Put another way: this is not a breach, it is not a CVE and nobody needs to work on Saturday. It is a change of surface on a tool. We are writing it because the message says, in these words, that any playbook, script or integration that initiates AIR will stop working after 1 September 2026.

The seven-day clock you should look at today

While reading those two pages we came across something else, unrelated to the button and considerably more important, we think, for a mid-sized company. Defender for Endpoint has five automation levels. The interesting one is the second, Semi — require approval for all folders: at that level, every remediation action waits for a person to approve it in the Action center. And the documentation adds a sentence worth reading twice: pending actions time out after seven days, and if an action times out the behaviour is the same as if it had been rejected.

Now the detail that turns this into a concrete task. That semi-automatic level is the one left as the default for tenants created before 16 August 2020 that never defined device groups. Those created on or after that date, under the same conditions, were left on full automation. Which is to say: if your tenant is from 2018 or 2019 and nobody ever touched device groups, Defender may well have spent years detecting things, proposing the remediation and waiting for a click nobody gives. And after seven days that proposal falls away on its own, with the same effect as a "no".

Microsoft recommends full automation and puts a number on it: it says that, based on data collected and analysed over the past year, customers on full automation had 40% more high-confidence malware samples removed than customers on lower levels. That is a vendor figure and we treat it as such, but the mechanism behind it needs no faith: if nobody approves, nothing gets remediated.

There is a third detail on the same page pointing the same way: AIR needs Microsoft Defender Antivirus running in active or passive mode, and if the antivirus is disabled or uninstalled, AIR will not function correctly. It sounds obvious until you remember there are estates where somebody uninstalled Defender Antivirus when bringing in another product. It is the same pattern we described when an EDR was switched off with a safe-mode reboot: the part that fails is almost never the detection, it is the condition the detection depends on and nobody checks.

What the notice does not say

Two things, and we say them because we have seen both circulating as if they were facts. First: the message is about Defender for Endpoint and its experience inside the Defender XDR portal. It says nothing about automated investigation in Defender for Office 365, and since it says nothing, neither will we; if that affects you, the box to check is that one and not this page. Second: the box talks about the investigation experience and manual triggering. It does not say the Action center, pending actions or the ability to undo a remediation are going away.

A button is not a procedure

That leaves the opinion, which is the part we actually care about. If you felt something reading that the button is going away, it is worth asking what exactly that button was holding up. Because a button you have to press only works if somebody is looking at the screen at the moment it needs pressing. On a Tuesday at eleven in the morning, somebody is. On a Friday at eight in the evening, in a forty-person company whose IT lead also fixes printers, nobody is.

The difference between buying a tool and buying a service sits exactly there, not in the brand of the agent. You have the agent either way. What changes is whether there is somebody on call with a written procedure for the moment the alert fires, or whether your response plan was, without ever having said it out loud, "somebody will see the notice and click". That is precisely what we sell when we sell managed EDR/MDR and 24x7 support, and the argument is self-serving and something we believe: it is both things at once.

You are not losing capability tomorrow. You are losing a place to look. And if that worries you, Microsoft did not create the problem: it had been there a while, covered up by a button.

The part that does have a deadline

Out of the whole article, one single thing expires this afternoon: search for the string startInvestigation in your runbooks, your Logic Apps, your PowerShell scripts and any integration talking to the Defender API. If it appears zero times, you are done and you can close this tab. If it appears, you have until tonight to decide what goes in its place.

The rest has no deadline and matters more: what automation level your device groups are on, whether the Action center is stacking up items pending from days ago, and whether Defender Antivirus is still in active or passive mode on the machines where you expect all this to work. None of the three changes tomorrow. They have been however they are for a while.

Sources (consulted on 31 August 2026): the literal retirement notice, the sentence about capabilities already included in the antivirus stack, the recommendation to run a full scan for on-demand investigations, the two ways an investigation starts (by alert and manually via Initiate Automated Investigation from the device flyout), the scope expansion with its ten-or-more-devices threshold, the three verdicts, the remediation action examples and the requirement for Defender Antivirus in active or passive mode all come from "Use automated investigations to investigate and remediate threats" (Microsoft Learn). The five automation levels, the seven-day timeout on pending actions with the same effect as a rejection, the defaults depending on whether the tenant was created before or on/after 16 August 2020, the Defender for Business behaviour and the figure of 40% more high-confidence malware samples removed all come from "Automation levels in automated investigation and remediation" (Microsoft Learn), which reproduces the same retirement box. The method, the POST /api/machines/{id}/startInvestigation path, the fifty-calls-per-hour limit, the Alert.ReadWrite.All and Alert.ReadWrite permissions, the Active remediation actions role, the mandatory Comment field and the 201 Created response come from the Start Investigation API reference. The identifier MC1411577, the 2 July 2026 publication date with a later update in late August (the exact day varies between the public summaries we were able to consult), the "early September 2026" rollout window, the worldwide, GCC, GCC High and DoD scope, and the sentence stating that flows using AIR will stop working after 1 September come from the text of the Microsoft 365 message center post. These are ours, and we flag them as judgement rather than published fact: the sixty-one-day calculation between publication and effective date; the reading that the startInvestigation endpoint stops answering tomorrow, since the API reference carries no retirement notice and it is the message center post saying it, not the endpoint documentation; the reading that a full antivirus scan answers a different question from the one an investigation answered; the assumption — declared as a bet — that in most SMEs nobody has read the notice; the warning about integrations failing silently; the reading that a pre-August-2020 tenant with no device groups may have spent years accumulating actions that expire on their own; and the entire closing section on the difference between a button and a procedure.