Can Microsoft XDR perform isolation by its own if remediation level is set to fully?

Hi,

I'm Sumit, here to answer your query at the Microsoft Community.

Apologies for any inconvenience you are experiencing. I am happy to help you today.

Absolutely! Microsoft Defender XDR has a cool feature that allows it to automatically isolate devices if the automated investigation and remediation setting is on "fully automated remediation."

When an alert triggers an automated investigation, and the system decides that isolating a device is necessary due to a threat, it can take care of that all by itself.

The investigation process helps identify what actions need to be taken, and if it’s set up this way, the system can perform actions like device isolation automatically without needing a thumbs-up from someone. Device isolation is really important since it helps stop threats from spreading throughout the network.

You can tweak the level of automation, including the option to automatically isolate devices, for specific device groups within Microsoft Defender for Endpoint, which works seamlessly with Microsoft Defender XDR.

Reference:

https://learn.microsoft.com/en-us/defender-xdr/...

I hope this information is helpful. If you have any further questions, please feel free to reach out to us. Good luck!

Thank You Sumit