Microsoft 365 does not use one universal “email-removal policy.” In Microsoft Defender, phishing response spans several controls: anti-phishing policies shape protection and message handling, Automated Investigation and Response (AIR) investigates and recommends action, and authorized staff can remediate delivered messages manually. For AIR, Microsoft documents human approval as the default for recommended email actions; selected eligible AIR cluster types can be configured for automatic remediation.
The right setup depends on how much control your team needs: review every AIR recommendation, automate only selected eligible cases, or have an operator initiate manual remediation—with an approval gate if required. These controls vary by license, role model, and tenant experience, so confirm what is available in your environment before changing settings.
Check licensing, permissions, and scope first
Before configuring a workflow, confirm that your tenant has the required Defender for Office 365 capability and that the feature is enabled. Microsoft’s documented Action Center procedure for AIR requires Defender for Office 365 Plan 2 or higher. Microsoft’s AIR setup documentation lists supported subscriptions and requires Security Administrator or higher for configuration.
Permissions depend on the role model active in your organization. Under Unified RBAC, Microsoft maps Response (manage) to approving automated investigation actions and Email & collaboration advanced actions (manage) to email remediation. Ask an administrator to verify the tenant’s active permission model and role assignments; a portal control may not be available to every account.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Relevant Microsoft documentation: Configure AIR, Review and approve pending and completed actions in the Action Center, and Microsoft Defender XDR Unified RBAC permissions.
Connect phishing reports to investigation
A workflow can begin when a user reports a suspicious message with Outlook’s built-in Report button. The report can trigger the Email reported by user as malware or phish alert policy and launch the AIR investigation playbook. Administrators can also start investigations from supported Defender investigation surfaces.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
AIR evaluates the investigation and may recommend remediation. Under Microsoft’s documented default behavior, those recommended email actions await Security Operations approval rather than being deleted unconditionally. See Configure AIR and User reported settings.
Choose an approval and remediation model
These choices differ in who initiates or authorizes the action, how much is automated, and how pending work is reviewed. They are not one global email-removal switch.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Workflow | Approval behavior | Useful when | Key consideration |
|---|---|---|---|
| AIR default approval | Security Operations reviews and approves or rejects recommended email remediation. | You want a human decision before proposed email cleanup. | Requires the appropriate license and permissions, plus monitoring of the pending queue. [Microsoft Learn] |
| Selected AIR automatic remediation | Selected eligible AIR cluster types can be remediated without Security Operations approval. | You explicitly want faster cleanup for selected cases. | Automation is scoped; Microsoft says clusters larger than 10,000 messages stay pending for review. [Microsoft Learn] |
| Direct manual remediation | An authorized operator selects and starts a message action. | A responder has reviewed the case and has remediation permission. | Confirm the target message set and record what was done. [Microsoft Learn] |
| Two-step manual remediation | One operator queues the remediation; approval is required before it executes. | You need separation between proposing and authorizing cleanup. | Define who can add actions, who can approve them, and who monitors pending work. [Microsoft Learn] |
Review and approve AIR actions in the Action Center
- Open the pending-action queue. In the Defender portal, go to Actions & submissions > Action center. Review pending AIR actions and use available filters to prioritize them.
- Inspect the recommendation. Open an action’s details and review the linked investigation. Check the evidence, affected messages, and proposed impact before authorizing a change.
- Approve or reject. Choose the appropriate decision for the recommendation. The Investigation page also provides a Pending Actions view for related work.
- Verify the record. Use the Action Center’s History tab to inspect action history and decisions, including the responsible administrator where applicable.
Microsoft describes the documented default this way: “Instead, all remediation actions for email and email content await approval by your security operations team in the Action center.” This statement applies to the documented AIR default, not to every Defender control. See Review and approve pending and completed actions in the Action Center.
Enable automatic remediation only for selected AIR cases
To configure this option, open Settings > Email & collaboration > MDO automation settings in the Defender portal. Select the AIR cluster types that may be remediated without Security Operations approval. Cluster types you do not select remain pending for review.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Microsoft states that clusters larger than 10,000 messages do not auto-remediate and remain pending. Treat that as a documented eligibility limit for this automatic AIR feature, not a guarantee that every other suspicious message will be removed. Confirm current labels and eligibility in your tenant because portal controls and feature availability can change. See Configure automated investigation and response (AIR) settings.
Before enabling automation, decide which cases are sufficiently bounded for your team’s risk tolerance. Consider how broad a cluster can be, the impact of the selected action, and whether your team can review pending exceptions promptly. Keep approval enabled for cluster types where a human decision is important.
Recommended Free Tools
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use manual remediation for delivered messages
When an authorized operator needs to act on delivered malicious email, the manual remediation workflow offers actions such as moving messages to Inbox, Junk, or Deleted Items, as well as soft-deleting or hard-deleting them. These are distinct actions, not interchangeable labels: in particular, hard delete should not be treated as equivalent to soft delete. Microsoft notes that recovery of soft-deleted messages depends on the mailbox retention policy.
For a direct action, an appropriately authorized operator selects the target messages and initiates remediation. In the two-step flow, an operator adds target emails to a remediation container; approval is then required before the action executes. This creates a review gate between preparing a cleanup and carrying it out. Action Center pending items and History provide the documented review and audit path. See Remediate malicious email delivered in Office 365.
Keep anti-phishing policy separate from post-delivery cleanup
Anti-phishing policy settings define protections and recipient scope; they are not a replacement for AIR investigation or manual remediation after delivery. Likewise, the AIR automation setting governs selected eligible investigation clusters, while Action Center approval governs proposed actions and manual remediation can be initiated by an authorized operator. Treat these as related but separate controls.
When editing anti-phishing policies, check which recipients each policy covers and how policy precedence applies, including preset security policies. A policy change to delivery-time protection does not by itself establish how an already-delivered message will be investigated or removed. See Configure anti-phishing policies in Microsoft Defender for Office 365.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Validate access, queue behavior, and audit history
After configuration, validate the intended workflow using a suitable example investigation or action. Confirm that it enters the expected queue, that only intended roles can approve or remediate, and that the final decision appears in Action Center history. For manual remediation, verify the recorded action and affected message set. This operational check helps catch mismatches between the intended workflow and the controls actually enabled in the tenant.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
