Services
Summary
Microsoft Defender for Office 365 will enhance alert experience by consolidating related signals into richer alerts, reducing alert fatigue while preserving detection and workflows. Rollout starts mid-September 2025, requires no configuration changes, and may affect automation and alert metrics tracking. No compliance issues identified.
Details
Introduction
We’re improving the alert experience in Microsoft Defender for Office 365 (MDO) to help security teams triage alerts more efficiently. These updates reduce alert fatigue by consolidating related signals into single, richer alerts—without compromising detection fidelity or coverage.
When this will happenGeneral Availability (Worldwide, GCC, GCC High, DoD): Rollout begins mid-September 2025 and will complete by late November 2025. Updates will be delivered incrementally during this period.
How this affects your organization- Fewer near-duplicate alerts: Closely related signals will be grouped, reducing clutter in the alert list.
- Richer alert detail: Alerts will include impacted entities (e.g., users, recipients), key identifiers (e.g., message/network IDs), and timelines. Evidence such as URLs, attachments, and IPs remains accessible.
- Preserved triage workflows: Existing pivots like Open message in Explorer, View timeline, and List impacted entities remain unchanged. Severity and categorization are unaffected.
- Incident correlation: Incidents may contain fewer child alerts but with denser evidence per alert.
- APIs and reporting: No schema changes. You may observe lower raw alert counts with higher per-alert density. Dashboards and automation referencing alert IDs will continue to function.
This feature is on by default and requires no configuration changes.
What you can do to prepare- Review automation logic: Ensure playbooks and scripts can handle alerts with multiple entities and richer context.
- Review alert metrics: If you track alert counts, consider also measuring how many users or messages are included in each alert, what actions are taken, and how long it takes to respond and resolve (mean time to acknowledge and mean time to resolve).
- Communicate with SecOps teams: Set expectations around reduced alert volume with maintained evidence depth.
No policy or configuration changes are required before rollout.
Compliance considerationsNo compliance considerations identified, review as appropriate for your organization.