Microsoft Defender XDR for Office 365: Streamlined false positive submissions for quarantined files

Updated April 4, 2024: We have made the decision not to proceed with this rollout at this time. You can safely disregard this message. 

In Microsoft Defender XDR for Office 365, we are providing an easy and robust way for admins and security operators to submit and temporarily mitigate false positive files that have been quarantined from OneDrive, Teams, and SharePoint.

This message is associated with Microsoft 365 Roadmap ID 380186.

When this will happen:

We have made the decision not to proceed with this rollout at this time.

How this will affect your organization:

These screenshots from Quarantine Defender XDR 365 for Office show how to submit false positive files to Microsoft and how to see your submissions in the queue.

Figure 1: Action button to submit false positives files:

Figure 2: Review submission detail:

Figure 3: Review submission confirmation:

Figure 4: Submitted files can be found in the submission queue:

What you need to do to prepare:

No action is needed to prepare for this change. You may want to notify your users about this change and update any relevant documentation as appropriate.