Microsoft Defender for Office 365
Email and collaborationAir About
In brief
The documentation now explains how to select a built-in rule on the Alert tuning page and disable it from the rule details pane, with a screenshot.
What Defender admins need to know
No action is required. Administrators can follow these steps when they need to disable a built-in alert tuning rule.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
The Microsoft Security Copilot Phishing Triage Agent doesn't classify alerts suppressed by alert tuning. Be sure to disable the Auto-Resolve - Email reported by user as malware or phish built-in alert tuning rule and any custom tuning rules that suppress this alert.
Disable a built-in alert tuning rule
To disable a built-in alert tuning rule, follow these steps:
On the Alert tuning page, select the built-in rule.
In the rule details pane, select Disable.
Required permissions and licensing for AIR
You need to be assigned permissions to use AIR. You have the following options:
@@ -123,6 +123,15 @@ Note
The [Microsoft Security Copilot Phishing Triage Agent](/en-us/defender-xdr/phishing-triage-agent) doesn't classify alerts suppressed by [alert tuning](/en-us/defender-xdr/investigate-alerts#tune-an-alert). Be sure to disable the **Auto-Resolve - Email reported by user as malware or phish** built-in alert tuning rule and any custom tuning rules that suppress this alert.
+### Disable a built-in alert tuning rule
+
+To disable a built-in alert tuning rule, follow these steps:
+
+1. On the **Alert tuning** page, select the built-in rule.
+2. In the rule details pane, select **Disable**.
+
+ [](/en-us/defender-xdr/media/built-in-alert-tuning-rules/disable-built-in-alert-tuning-rule.png#lightbox)
+
## Required permissions and licensing for AIR
You need to be assigned permissions to use AIR. You have the following options: