Microsoft Defender for Office 365 will allow SOC teams and admins to dispute submission results directly in the portal, improving detection accuracy by providing feedback on false positives and negatives. This feature, available from mid-July 2025, is on by default and requires no configuration. Admins can access it via the Microsoft Defender portal.
We’re adding a new capability to Microsoft Defender that allows SOC teams and admins to dispute submission results directly within the portal.
This enhancement enables organizations to provide feedback on false positives and false negatives without opening support tickets, streamlining the feedback loop and improving detection accuracy over time.
This message is associated with Microsoft 365 Roadmap ID 488096.
When this will happen:
General Availability (Worldwide): Rollout will begin in mid-July 2025 and is expected to complete by end-July 2025.
How this will affect your organization:
If your organization uses Microsoft Defender for Office 365 admin submission features, you’ll now see an option to dispute submission results directly in the Microsoft Defender portal. This allows admins to flag incorrect verdicts (false positives or false negatives) and provide context or evidence, helping Microsoft improve detection accuracy.
This feature is on by default and does not require any configuration.
What you need to do to prepare:
Admins can access the new dispute functionality by navigating to:
Microsoft Defender portal: https://security.microsoft.com
Go to Actions & Submissions > Submissions or directly to https://security.microsoft.com/reportsubmission
To dispute a submission:
A new submission ID will be generated, and a confirmation message will appear in the flyout. You can view dispute details by clicking the submission panel.
Note: Bulk submissions disputes are allowed. However, if a submission contains mixed results, the dispute option will be unavailable.
For more information, refer to: