EDR isolates the device on its own; the rule that brings it back is written beforehand
On 3 September Microsoft added a sentence to the Defender for Endpoint documentation and by the next day it was gone: it warned that automatic isolation fires as FULL isolation and that, with a web proxy, the device might not recover. The two facts it joined are both still published, but in separate sections. What gets isolated on its own and what does not, what "containing" does and what "isolating" does, and the way back point by point.
Microsoft 365
ES 
CAT 
EN