MC1222979 — New Built-in Alert Tuning Rules optimize your incident and alert queues

Starting January 25, 2026, Microsoft Defender XDR introduces built-in alert tuning rules focusing on low-severity Office 365 alerts, with automated triage and reopening if needed. Active from February 5, these rules help SOCs prioritize alerts, with an opt-out window until February 5 and multi-tenant management support.