Microsoft will enable fully automated threat remediation by default for Microsoft Defender for Endpoint customers who have opted into public previews starting next month, on February 16, 2021.

This change of the default automation level from Semi to Full comes after finding that organizations using full automation by default were more successful in remediating and containing threats.

“Data collected and analyzed over the past year shows that organizations who are using full automation have had 40% more high-confidence malware samples removed than customers using lower levels of automation,” Microsoft explains.

“Full automation also frees up our customers’ critical security resources so they can focus more on their strategic initiatives.”

Fully automated tenants remediate threats faster

When full automation is enabled on tenants, Microsoft’s endpoint security platform will auto-create a remediation action that removes or contains the malicious entity found after investigating suspicious activity.

This happens automatically, without the organization’s security operations team having to remotely connect to the device or having to wait for the remediation action to be approved.

However, when the default automation level is set to Semi, all remediation actions require manual approval which drastically lowers the reaction time, potentially allowing detected malware to infect other devices and causing further damage.

The change comes after Microsoft has increased malware detection accuracy, upgraded its automated investigation infrastructure, and added an option to undo remediation actions.

Additionally, since automated investigation and remediation capabilities were first added to Microsoft Defender for Endpoint, organizations with fully automated tenants have been able to successfully remediate and contain threats while tenants with semi-automation were left waiting for manual approval.

Doesn’t alter previously configured automation settings

“The new default automation level can be kept (this is recommended) or changed according to your organizational needs,” Microsoft added.

“This change does not impact or override device group definitions that were previously set to control automation level.”

To start using Microsoft Defender for Endpoint public preview capabilities, customers have to manually toggle on preview features in the Microsoft Defender Security Center.

Since October, Microsoft Defender for Endpoint also provides users with vulnerable device tracking capabilities to help them keep track of vulnerable Windows and macOS endpoints within their organization’s environment.

Redmond’s endpoint security platform has also expanded to include non-Windows platforms in June, hitting general availability for Linux enterprise customers and entering public preview for those using Android devices.