Issues with "Pending Actions" in Microsoft Defender XDR Despite Full Remediation Setting

Zeynep 0 Reputation points
2025-01-13T16:01:17.06+00:00

When an email is soft deleted (both manually and under automation), this action awaits approval in the action center. This doesn't happen for every soft delete. Some occur without needing approval. Upon checking the configurations, I see that full remediation is selected for all endpoints. Therefore, the emails should have been deleted automatically as a result of the automated investigation without awaiting approval. What is the reason for this, and how can I resolve it?

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,469 questions
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.