Microsoft Defender XDR

Take action on advanced hunting results in Microsoft Defender XDR

4 September 2026New feature+27 / −24 lines

In brief

The documentation now covers disabling users and resetting user authentication directly from query results. It also specifies required SID columns and the AccountObjectId parameter for Microsoft Entra identities.

What Defender admins need to know

Security teams can remediate compromised identities from advanced hunting results, provided queries include the required identifiers.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Take action on advanced hunting query results

[!INCLUDE Prerelease information]

You can quickly contain threats or address compromised assets found in advanced hunting. You can take actions on ~~devices~~devices, identities, files, and ~~emails, and quarantine files.~~emails.

Required permissions

To learn more about how Microsoft Defender for Endpoint performs these response actions, see Response actions on devices.

Take actions on identities

You can take the following actions on identities in your query results:

Select Disable user to temporarily prevent a user from signing in.
Select Reset user authentication to prompt the user to either change their password on their next sign-in session (for on-premises identities) or require them to sign in again (for Microsoft Entra identities).

:::image type="content" source="media/advanced-hunting-take-action/take-actions-user-actions.png" alt-text="Screenshot of the Take actions wizard with the Users section highlighted, including Disable user and Reset user authentication." lightbox="media/advanced-hunting-take-action/take-actions-user-actions.png":::

Both the Disable user and Reset user authentication options require the user security identifier (SID), which is available in the AccountSid, InitiatingProcessAccountSid, RequestAccountSid, and OnPremSid columns.

For Microsoft Entra identities, the AccountObjectId parameter is required for all actions.

For more information on identity actions, see Remediation actions in Microsoft Defender for Identity and Remediation actions in Microsoft Defender for Cloud Apps.

Quarantine files

You can deploy the quarantine action on files so that the files are automatically quarantined when encountered. When you select ~~this~~the quarantine action, you can choose between the following columns to identify which files in your query results to quarantine:

SHA1: In most advanced hunting tables, this column refers to the SHA-1 of the file that's affected by the recorded action. For example, if a file was copied, this affected file is the copied file.
InitiatingProcessSHA1: In most advanced hunting tables, this column refers to the file responsible for initiating the recorded action. For example, if a child process was launched, this initiator file is part of the parent process.
:::image type="content" source="media/advanced-hunting-take-action/soft-delete-sender-copy.png" alt-text="Screenshot of the Take actions pane with the Soft delete option and the automatic sender copy deletion setting." lightbox="media/advanced-hunting-take-action/soft-delete-sender-copy.png":::
Automatic soft-deletion of the sender's copy is available for results using the EmailEvents and EmailPostDeliveryEvents tables but not the UrlClickEvents table. Also, the result should contain the EmailDirection and SenderFromAddress columns for ~~this action~~the Delete email option to show up in the Take actions wizard. Sender's copy clean-up applies to intra-organization emails and outbound emails, ensuring that only the sender's copy is soft-deleted for these email messages. Inbound messages are out of scope.
~~See the~~The following query lists email events classified as ~~reference:~~spam and returns key message and delivery details:
```
EmailEvents
```

Submit to Microsoft might be disabled if mandatory columns are missing. To resolve ~~this issue,~~missing mandatory columns, select Show empty columns before you select Take actions.

:::image type="content" source="media/advanced-hunting-take-action/advanced-hunting-take-actions-submit-to-microsoft.png" alt-text="Screenshot of Choose actions page of the Take actions wizard with Submit to Microsoft selected and the Selected entities to block details flyout." lightbox="media/advanced-hunting-take-action/advanced-hunting-take-actions-submit-to-microsoft.png":::

Initiate automated investigation - select this action to trigger Automated investigation on email, sender, recipient, or contact recipients.
Initiate automated investigation might be disabled if mandatory columns are missing. To resolve ~~this issue,~~missing mandatory columns, select Show empty columns before you select Take actions.
~~Use the following query as a reference to enable~~ ~~Submit to Microsoft~~ ~~and~~ ~~Initiate automated investigation~~.
```
EmailEvents
| where ThreatTypes contains "spam"
| project  Timestamp, NetworkMessageId,RecipientEmailAddress,SenderFromAddress,SenderMailFromAddress,Subject,SenderFromDomain,TimeGenerated,SenderIPv4,SenderIPv6
| join EmailUrlInfo on NetworkMessageId
```
:::image type="content" source="media/advanced-hunting-take-action/advanced-hunting-take-actions-choose-actions.png" alt-text="Screenshot of the Choose actions page of the Take actions wizard with Initiate automated investigation selected." lightbox="media/advanced-hunting-take-action/advanced-hunting-take-actions-choose-actions.png":::

You can provide a remediation name and a short description of the action to track it in the action center history. Use the Approval ID provided at the end of the wizard to filter for these actions in the action center:

:::image type="content" source="media/advanced-hunting-take-action/choose-email-actions-entities.png" alt-text="Screenshot of the Take actions wizard showing the Choose actions step for selected entities." lightbox="media/advanced-hunting-take-action/choose-email-actions-entities.png":::

~~These~~The email remediation actions described in this section also apply to custom detections.

Review actions taken

The ~~action center under~~ Action center history page (Action center \

> History ~~(Action center history~~) records each action individually. To check the status of each action, go to the ~~action center.~~action center.

@@ -1,6 +1,6 @@ --- title: Take action on advanced hunting results in Microsoft Defender XDR-description: Learn how to take response actions on devices and emails directly from advanced hunting query results in Microsoft Defender XDR, including quarantine, delete, and investigation options.+description: Learn how to take response actions on devices, identities, files, and emails directly from advanced hunting query results in Microsoft Defender XDR. ms.service: defender-xdr ms.subservice: adv-hunting ms.author: pauloliveria@@ -12,18 +12,17 @@ ms.collection:   - m365-security   - tier1 ms.custom:-  - msecd-doc-authoring-1014+  - msecd-doc-authoring-1018   - sfi-ga-nochange   - cx-ti   - cx-ah-  - msecd-doc-authoring-1012-  - sfi-image-nochange appliesto:     - Microsoft Defender XDR     - Microsoft Sentinel in the Microsoft Defender portal ms.topic: how-to-ms.date: 06/16/2026+ms.date: 07/27/2026 ai-usage: ai-assisted+#customer intent: As a security analyst, I want to take response actions on advanced hunting query results so that I can remediate affected devices, identities, files, and emails. ---  # Take action on advanced hunting query results@@ -32,7 +31,7 @@ ai-usage: ai-assisted  [!INCLUDE [Prerelease information](../includes/prerelease.md)] -You can quickly contain threats or address compromised assets found in [advanced hunting](advanced-hunting-overview.md). You can take actions on devices and emails, and quarantine files.+You can quickly contain threats or address compromised assets found in [advanced hunting](advanced-hunting-overview.md). You can take actions on devices, identities, files, and emails.  ## Required permissions @@ -60,9 +59,24 @@ You can take the following actions on devices identified by the `DeviceId` colum  To learn more about how Microsoft Defender for Endpoint performs these response actions, see [Response actions on devices](/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts). +## Take actions on identities++You can take the following actions on identities in your query results:++- Select **Disable user** to temporarily prevent a user from signing in.+- Select **Reset user authentication** to prompt the user to either change their password on their next sign-in session (for on-premises identities) or require them to sign in again (for Microsoft Entra identities).++:::image type="content" source="media/advanced-hunting-take-action/take-actions-user-actions.png" alt-text="Screenshot of the Take actions wizard with the Users section highlighted, including Disable user and Reset user authentication." lightbox="media/advanced-hunting-take-action/take-actions-user-actions.png":::++Both the **Disable user** and **Reset user authentication** options require the user security identifier (SID), which is available in the `AccountSid`, `InitiatingProcessAccountSid`, `RequestAccountSid`, and `OnPremSid` columns.++For Microsoft Entra identities, the `AccountObjectId` parameter is required for all actions.++For more information on identity actions, see [Remediation actions in Microsoft Defender for Identity](/defender-for-identity/remediation-actions) and [Remediation actions in Microsoft Defender for Cloud Apps](/defender-cloud-apps/governance-actions).+ ## Quarantine files -You can deploy the *quarantine* action on files so that the files are automatically quarantined when encountered. When you select this action, you can choose between the following columns to identify which files in your query results to quarantine:+You can deploy the *quarantine* action on files so that the files are automatically quarantined when encountered. When you select the **quarantine** action, you can choose between the following columns to identify which files in your query results to quarantine:  - `SHA1`: In most advanced hunting tables, this column refers to the SHA-1 of the file that's affected by the recorded action. For example, if a file was copied, this affected file is the copied file. - `InitiatingProcessSHA1`: In most advanced hunting tables, this column refers to the file responsible for initiating the recorded action. For example, if a child process was launched, this initiator file is part of the parent process.@@ -96,9 +110,9 @@ Apart from device-focused remediation steps, you can also take actions on emails     :::image type="content" source="media/advanced-hunting-take-action/soft-delete-sender-copy.png" alt-text="Screenshot of the Take actions pane with the Soft delete option and the automatic sender copy deletion setting." lightbox="media/advanced-hunting-take-action/soft-delete-sender-copy.png"::: -   Automatic soft-deletion of the sender's copy is available for results using the [`EmailEvents`](advanced-hunting-emailevents-table.md) and [`EmailPostDeliveryEvents`](advanced-hunting-emailpostdeliveryevents-table.md) tables but not the [`UrlClickEvents`](advanced-hunting-urlclickevents-table.md) table. Also, the result should contain the `EmailDirection` and `SenderFromAddress` columns for this action option to show up in the **Take actions** wizard. Sender's copy clean-up applies to intra-organization emails and outbound emails, ensuring that only the sender's copy is soft-deleted for these email messages. Inbound messages are out of scope.+   Automatic soft-deletion of the sender's copy is available for results using the [`EmailEvents`](advanced-hunting-emailevents-table.md) and [`EmailPostDeliveryEvents`](advanced-hunting-emailpostdeliveryevents-table.md) tables but not the [`UrlClickEvents`](advanced-hunting-urlclickevents-table.md) table. Also, the result should contain the `EmailDirection` and `SenderFromAddress` columns for the **Delete email** option to show up in the **Take actions** wizard. Sender's copy clean-up applies to intra-organization emails and outbound emails, ensuring that only the sender's copy is soft-deleted for these email messages. Inbound messages are out of scope. -   See the following query as reference:+   The following query lists email events classified as spam and returns key message and delivery details:     ```kusto    EmailEvents@@ -113,36 +127,25 @@ Apart from device-focused remediation steps, you can also take actions on emails     > [!IMPORTANT]     > To block a URL or URL domain, join the [`EmailUrlInfo`](advanced-hunting-emailurlinfo-table.md) table with `NetworkMessageId` to get the required details. To block an attachment (file), join the [`EmailAttachmentInfo`](advanced-hunting-emailattachmentinfo-table.md) table with `NetworkMessageId` to get the file's hash. -  **Submit to Microsoft** might be disabled if mandatory columns are missing. To resolve this issue, select **Show empty columns** before you select **Take actions**.+  **Submit to Microsoft** might be disabled if mandatory columns are missing. To resolve missing mandatory columns, select **Show empty columns** before you select **Take actions**.    :::image type="content" source="media/advanced-hunting-take-action/advanced-hunting-take-actions-submit-to-microsoft.png" alt-text="Screenshot of Choose actions page of the Take actions wizard with Submit to Microsoft selected and the Selected entities to block details flyout." lightbox="media/advanced-hunting-take-action/advanced-hunting-take-actions-submit-to-microsoft.png":::  - **Initiate automated investigation** - select this action to trigger [Automated investigation](/defender-office-365/air-about) on email, sender, recipient, or contact recipients. -  **Initiate automated investigation** might be disabled if mandatory columns are missing. To resolve this issue, select **Show empty columns** before you select **Take actions**.--  Use the following query as a reference to enable **Submit to Microsoft** and **Initiate automated investigation**.+  **Initiate automated investigation** might be disabled if mandatory columns are missing. To resolve missing mandatory columns, select **Show empty columns** before you select **Take actions**. -   ```kusto-   EmailEvents-  | where ThreatTypes contains "spam"-  | project  Timestamp, NetworkMessageId,RecipientEmailAddress,SenderFromAddress,SenderMailFromAddress,Subject,SenderFromDomain,TimeGenerated,SenderIPv4,SenderIPv6-  | join EmailUrlInfo on NetworkMessageId-   ```-     :::image type="content" source="media/advanced-hunting-take-action/advanced-hunting-take-actions-choose-actions.png" alt-text="Screenshot of the Choose actions page of the Take actions wizard with Initiate automated investigation selected." lightbox="media/advanced-hunting-take-action/advanced-hunting-take-actions-choose-actions.png":::  You can provide a remediation name and a short description of the action to track it in the action center history. Use the Approval ID provided at the end of the wizard to filter for these actions in the action center:  :::image type="content" source="media/advanced-hunting-take-action/choose-email-actions-entities.png" alt-text="Screenshot of the Take actions wizard showing the Choose actions step for selected entities." lightbox="media/advanced-hunting-take-action/choose-email-actions-entities.png"::: -These email actions also apply to [custom detections](custom-detections-overview.md).+The email remediation actions described in this section also apply to [custom detections](custom-detections-overview.md).  ## Review actions taken -The [action center](m365d-action-center.md) under **Action center** \--> **History** ([Action center history](https://security.microsoft.com/action-center/history)) records each action individually. To check the status of each action, go to the action center.+The [Action center history](https://security.microsoft.com/action-center/history) page (**Action center** > **History**) records each action individually. To check the status of each action, go to the [action center](m365d-action-center.md).  > [!NOTE] > Some tables in this article might not be available in Microsoft Defender for Endpoint. [Turn on Microsoft Defender](m365d-enable.md) to hunt for threats by using more data sources. To move your advanced hunting workflows from Microsoft Defender for Endpoint to Microsoft Defender, see [Migrate advanced hunting queries from Microsoft Defender for Endpoint](advanced-hunting-migrate-from-mde.md).