How can I clear the "CONTAINED" status of a user after remediation?

Question

How can I clear the "CONTAINED" status of a user after remediation?

Tilman Schmidt 270

One of our users fell for a ClickFix attack and was automatically set to "CONTAINED" by Defender.

We remediated the incident by wiping the client notebook on which the attack happened, verifying that no other systems were affected, and resetting the user's password. But the "CONTAINED" status persists, blocking all network access by the user and triggering a false positive "Lateral movement" alert in Defender for each attempt.

In Defender's Action center, the last action is "Release user containment" with "Decision: Approved" and "Status: Completed". That was 17 hours ago. We tried "Enable user" multiple times as recommended by Copilot, but to no avail.

What can I do to convince Defender that the user is now safe?

Tilman Schmidt 270 Reputation points

2026-07-23T15:05:57.43+00:00

I have now opened a support request for the issue.
Tilman Schmidt 270 Reputation points

2026-07-23T15:06:34.0233333+00:00

I have now opened a service request for the issue.

1 answer

Your answer

Tilman Schmidt 270 Reputation points

2026-07-23T15:05:57.43+00:00

I have now opened a support request for the issue.
Tilman Schmidt 270 Reputation points

2026-07-23T15:06:34.0233333+00:00

I have now opened a service request for the issue.

Answer 1

Tilman Schmidt 270

The "CONTAINED" flag did vanish, apparently by its own, half a day later. When Microsoft support finally got around to answering my request four days later there was nothing left to see. So the issue is resolved but the cause remains a mystery.

Derek Morgan II 85 Reputation points

2026-08-17T13:37:41.8766667+00:00

Hi @Tilman Schmidt

Glad it cleared, but worth flagging for next time: Contain user (Defender for Endpoint) and Disable/Enable user (Defender for Identity) are two separate controls. Contain user blocks network logon, RDP, SMB, and RPC at the endpoint layer. It doesn't touch the AD/Entra account state, so Enable user (which only reverses Disable user) wouldn't have released it. You'd need Undo on the Contain user action itself. It also auto-releases after 5 days regardless.

Docs: Contain a user from the network, Defender for Identity remediation actions
Tilman Schmidt 270 Reputation points

2026-08-24T12:12:29.3966667+00:00

Thanks for the comment. Goes to show you shouldn't trust Microsoft Copilot. It was Copilot's recommendation that "Enable user" might clear the "Contain" condition. It surprised me, too, but I thought: "Well, if Microsoft's own AI says so, maybe there is something to it."