Microsoft Defender for Endpoint will remove manual triggering and the standalone experience of automated investigation and response (AIR) by early September 2026. AIR functions are integrated into always-on antivirus protection. Organizations using AIR in playbooks or scripts must update them before September 1, 2026.
Day in brief
Defender AIR becomes always-on antivirus as manual triggers end September 1
Microsoft Defender for Endpoint will remove manual triggering and the standalone Automated Investigation and Response (AIR) experience by early September 2026. AIR functions will instead be integrated into always-on antivirus protection.
- AIR is integrated into always-on antivirus
Defender XDR · Endpoint protectionMicrosoft Defender for Endpoint is moving AIR functions into always-on antivirus protection and removing the standalone AIR experience by early September 2026. Manual triggering will also be removed.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
1 update