MC1411577 — Microsoft Defender: Automated investigation and response (AIR) integrated into antivirus with manual triggering removed

Microsoft Defender for Endpoint will remove manual triggering and the standalone experience of automated investigation and response (AIR) by early September 2026. AIR functions are integrated into always-on antivirus protection. Organizations using AIR in playbooks or scripts must update them before September 1, 2026.

Open in Message Center Email this update View in the live feed