MC1147387 - Microsoft Defender for Office 365: Alert experience enhancements for faster triage

Introduction

We’re improving the alert experience in Microsoft Defender for Office 365 (MDO) to help security teams triage alerts more efficiently. These updates reduce alert fatigue by consolidating related signals into single, richer alerts—without compromising detection fidelity or coverage.

General Availability (Worldwide, GCC, GCC High, DoD): Rollout begins mid-September 2025 and will complete by late November 2025. Updates will be delivered incrementally during this period.

• Fewer near-duplicate alerts: Closely related signals will be grouped, reducing clutter in the alert list.
• Richer alert detail: Alerts will include impacted entities (e.g., users, recipients), key identifiers (e.g., message/network IDs), and timelines. Evidence such as URLs, attachments, and IPs remains accessible.
• Preserved triage workflows: Existing pivots like Open message in Explorer, View timeline, and List impacted entities remain unchanged. Severity and categorization are unaffected.
• Incident correlation: Incidents may contain fewer child alerts but with denser evidence per alert.
• APIs and reporting: No schema changes. You may observe lower raw alert counts with higher per-alert density. Dashboards and automation referencing alert IDs will continue to function.

This feature is on by default and requires no configuration changes.

• Review automation logic: Ensure playbooks and scripts can handle alerts with multiple entities and richer context.
• Review alert metrics: If you track alert counts, consider also measuring how many users or messages are included in each alert, what actions are taken, and how long it takes to respond and resolve (mean time to acknowledge and mean time to resolve).
• Communicate with SecOps teams: Set expectations around reduced alert volume with maintained evidence depth.

No policy or configuration changes are required before rollout.

No compliance considerations identified, review as appropriate for your organization.