Starting September 1, 2026, Microsoft Defender will remove manual triggering and the standalone experience of automated investigation and response (AIR). AIR's protection is integrated into always-on antivirus, running automatically. Organizations using AIR in playbooks or scripts must update them before this date; full antivirus scans replace manual AIR investigations.
Day in brief
Microsoft Defender: Automated investigation and response (AIR) integrated into antivirus with manual triggering removed
1 July 2026 recorded 1 tracked Microsoft Defender documentation change and 1 relevant Message Center announcement. The most active areas were Defender XDR.
- Microsoft Defender: Automated investigation and response (AIR) integrated into antivirus with manual triggering removed
Defender XDR · Endpoint protectionStarting September 1, 2026, Microsoft Defender will remove manual triggering and the standalone experience of automated investigation and response (AIR). AIR's protection is integrated into always-on antivirus, running automatically. Organizations using AIR in playbooks or scripts must update them before this date; full antivirus scans replace manual AIR investigations.
This period briefing was assembled from the tracked Microsoft Learn and Message Center changes.
1 update