MC1478005Microsoft Defender for Office 365: View approver details for remediation actions in Advanced Hunting
Summary
Microsoft Defender for Office 365 added an ApproverUpn column to the EmailPostDeliveryEvents table in Advanced Hunting, showing who approved remediation actions. This enables faster investigations without using Action Center. The feature is available worldwide, enabled by default, and requires no action from administrators.
More information
What and why
We've added a new ApproverUpn column to the EmailPostDeliveryEvents table in Microsoft Defender XDR Advanced Hunting. This enhancement allows security teams to identify who approved eligible remediation actions directly from Advanced Hunting results.
By making approver information available in hunting queries, analysts can investigate remediation activity more efficiently without needing to navigate to Action Center. This improvement supports faster security investigations and operational efficiency.
Rollout schedule
- General Availability (Worldwide, GCC, GCC High, DoD): Available now
Impact on your organization
Who is affected
- Security administrators and security analysts who use Microsoft Defender XDR Advanced Hunting
- Organizations that investigate email remediation activity using Advanced Hunting
Platforms and services
- Microsoft Defender XDR
- Advanced Hunting
- EmailPostDeliveryEvents table
What will happen
- A new ApproverUpn column is added to the EmailPostDeliveryEvents table.
- The column displays the User Principal Name (UPN) of the user who approved a remediation action.
- The enhancement applies to manual remediation actions and Automated Investigation and Response (AIR) remediation actions that require approval.
- Advanced Hunting query results include approver information for eligible remediation actions.
- Administrators and analysts can identify the approver for eligible remediation actions directly in Advanced Hunting results without navigating to Action Center.
- The feature is enabled by default and is automatically available in your tenant.
There are no changes to:
- Manual remediation approval workflows
- Permissions required to approve remediation actions
- Remediation processing behavior or action status
- Information available in Action Center
- Existing columns in the EmailPostDeliveryEvents table
Action required and recommendations
No action is required.
After rollout, administrators can begin using the new ApproverUpn column in Advanced Hunting queries and workflows.
We recommend that you:
- Review existing Advanced Hunting queries to determine whether the new ApproverUpn field should be incorporated into investigation, reporting, or automation workflows.
- Inform security operations teams about the availability of the new column.
- Validate any investigation workflows, reports, or automation that could benefit from the new ApproverUpn field.
Learn more
Compliance considerations
No compliance considerations identified, review as appropriate for your organization.