Daily Defender News
Aboutmerill.net
Microsoft Defender XDR
General

Phishing Triage Agent

4 September 2026Doc update+9 / −8 lines

In brief

The documentation now links directly to agent identity, role, feedback, and removal tasks, and presents a warning that removing the agent deletes stored feedback and stops triage of new incidents while retaining incident history.

What Defender admins need to know

Administrators can more easily manage the agent and understand the consequences of removing it.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

For more information, see Use the Microsoft Defender portal to configure user reported settings.

If you’re using a third-party email reporting tool, review Options for third-party reporting tools and view your vendor’s options to integrate reported messages with Microsoft Defender XDR.Defender.

Enable alert policy

| Manage agent settings (set up, pause, remove the agent, and manage agent identity) | Security Administrator in Microsoft Entra ID | | Reject feedback | Security Administrator in Microsoft Entra ID |

For more information about unified RBAC in the Defender portal, see Microsoft Defender Unified role-based access control (RBAC).

Set up the Phishing Triage Agent

  :::image type="content" source="/defender/media/agents-in-defender/phishing-triage/phishing-triage-agent-page.png" alt-text="Screenshot of the Performance tab on the Phishing Triage Agent page." lightbox="/defender/media/agents-in-defender/phishing-triage/phishing-triage-agent-page.png":::

Select the ellipsis (...) at the top right corner of the page to access management options for the agent, as described in the sections below.including changing the agent's identity and role, viewing and managing feedback, and removing the agent.

Select Pause or Run to temporarily stop or restart the agent’s activities.

Remove the agent

When you remove the agent, triage and classification of new incidents stop, and all feedback is deleted. However, the history of previously triaged incidents is retained for your reference.

To remove the agent:

Microsoft AI agents follow strict Responsible AI guidelines and undergo thorough reviews to ensure compliance with all AI standards and safeguards. Security Copilot’s Phishing Triage Agent is fully incorporated into these controls. During setup, you assign the agent an identity and configure it with the minimum permissions required for its operation, ensuring that it doesn’t have unnecessary permissions. All agent activities are logged in detail, with the complete flow available for review by analysts and admins at any time. Feedback provided to the agent to help it adapt to the organization’s environment is logged, reflected in the system, and accessible for review and modification by admins as needed.

How does the agent differ from a standard SOAR solution?

While both security orchestration, automation, and response (SOAR) solutions and the Phishing Triage Agent aim to automate aspects of security operations, their approaches are fundamentally different. SOAR tools rely on static, policy- and rule-based workflows that require predefined logic and manual tuning. In contrast, the agent uses recursive reasoning to autonomously complete tasks—learning, adapting, and improving over time.

The agent doesn’t need to be reprogrammed for every new situation. Within defined boundaries, it adjusts to the task at hand, making it far more flexible than traditional automation. Rather than being rigid and reactive, it continuously evolves with your environment and threat landscape, guided by analyst feedback and grounded in real data. Purpose-built for security teams, the Phishing Triage Agent helps accelerate responses and reduces manual workloads, freeing up analysts to focus on strategic initiatives.

To remove the agent:

Microsoft AI agents follow strict Responsible AI guidelines and undergo thorough reviews to ensure compliance with all AI standards and safeguards. Security Copilot’s Phishing Triage Agent is fully incorporated into these controls. During setup, you assign the agent an identity and configure it with the minimum permissions required for its operation, ensuring that it doesn’t have unnecessary permissions. All agent activities are logged in detail, with the complete flow available for review by analysts and admins at any time. Feedback provided to the agent to help it adapt to the organization’s environment is logged, reflected in the system, and accessible for review and modification by admins as needed.

How does the agent differ from a standard security orchestration, automation, and response (SOAR) solution?

While both SOAR solutions and the Phishing Triage Agent aim to automate aspects of security operations, their approaches are fundamentally different. SOAR tools rely on static, policy- and rule-based workflows that require predefined logic and manual tuning. In contrast, the agent uses recursive reasoning to autonomously complete tasks—learning, adapting, and improving over time.

The agent doesn’t need to be reprogrammed for every new situation. Within defined boundaries, it adjusts to the task at hand, making it far more flexible than traditional automation. Rather than being rigid and reactive, it continuously evolves with your environment and threat landscape, guided by analyst feedback and grounded in real data. Purpose-built for security teams, the Phishing Triage Agent helps accelerate responses and reduces manual workloads, freeing up analysts to focus on strategic initiatives.