Microsoft Defender for Office 365
Incidents and responseAlert Policies Defender Portal
In brief
The article now explains how to select a built-in rule on the Alert tuning page and choose Disable, with a supporting screenshot.
What Defender admins need to know
Administrators can use these documented steps when they need to disable a built-in alert tuning rule.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
The Microsoft Security Copilot Phishing Triage Agent doesn't classify alerts suppressed by alert tuning. Be sure to disable the Auto-Resolve - Email reported by user as malware or phish built-in alert tuning rule and any custom tuning rules that suppress this alert.
Disable a built-in alert tuning rule
To disable a built-in alert tuning rule, follow these steps:
On the Alert tuning page, select the built-in rule.
In the rule details pane, select Disable.
Open alert policies
In the Microsoft Defender portal at https://security.microsoft.com, go to Email & collaboration > Policies & rules > Alert policy. Or, to go directly to the Alert policy page, use https://security.microsoft.com/alertpoliciesv2.
@@ -97,6 +97,15 @@ Note
The [Microsoft Security Copilot Phishing Triage Agent](/en-us/defender-xdr/phishing-triage-agent) doesn't classify alerts suppressed by [alert tuning](/en-us/defender-xdr/investigate-alerts#tune-an-alert). Be sure to disable the **Auto-Resolve - Email reported by user as malware or phish** built-in alert tuning rule and any custom tuning rules that suppress this alert.
+### Disable a built-in alert tuning rule
+
+To disable a built-in alert tuning rule, follow these steps:
+
+1. On the **Alert tuning** page, select the built-in rule.
+2. In the rule details pane, select **Disable**.
+
+ [](/en-us/defender-xdr/media/built-in-alert-tuning-rules/disable-built-in-alert-tuning-rule.png#lightbox)
+
## Open alert policies
In the Microsoft Defender portal at https://security.microsoft.com, go to **Email & collaboration** > **Policies & rules** > **Alert policy**. Or, to go directly to the **Alert policy** page, use https://security.microsoft.com/alertpoliciesv2.