MC1237728 Medium
(Updated) Advanced Hunting: new actions to block attachments and top-level URL domains
Summary AI-generated
New actions in Defender for Office 365 Advanced Hunting let SecOps block malicious attachments and URL domains directly; rollout starts March 2026, enabled by default for eligible plans.
Suggested actions AI-generated
- Review security response procedures
- Inform SecOps teams of new remediation features
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1476237 Microsoft Defender for Office 365: Remediation actions from the Teams message entity flyout
- MC1461704 Microsoft Defender XDR: Unified response actions across identity accounts
- MC1088729 (Updated) Microsoft Defender for Office 365: Two new data tables in Advanced hunting (preview)
- MC1422060 (Updated) Microsoft Defender for Office 365: Prompt injection protection for email
- MC1440701 MDO Encrypted email attachment protection
- MC1163754 Enhancements to the Deep Analysis tab of Email Entity page by Microsoft Defender for Office 365
Original post from Microsoft
Updated March 6, 2026: We have updated the timeline. Thank you for your patience.
[Introduction]
We're introducing two new remediation actions as part of the Email table in Advanced Hunting that help security operations (SecOps) teams respond more quickly during investigations:
- Attachment block action
- Top-level URL domain block action
These actions let SecOps teams move directly from detection to mitigation within the same workflow, reducing response time and operational friction when addressing malicious campaigns.
These actions will be available through Take action if the query returns all the required columns.
[When this will happen:]
General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out early March 2026 and expect to complete by early April 2026 (previously end of March).
[How this affects your organization:]
Who is affected:
- Security operations teams and administrators using Advanced Hunting in Microsoft Defender for Office 365
- This feature is available to customers with Microsoft Defender for Office 365 Plan 2 or Microsoft 365 E5 licenses.
What will happen:
- Security teams can block malicious email attachments directly from Advanced Hunting results.
- Security teams can block top-level URL domains associated with phishing or malicious campaigns.
- Remediation actions are available in the Advanced Hunting “Take action” wizard.
- The feature is enabled by default; no configuration changes are required.
- There is no impact to user workflows unless a security action is taken.
Note:
- Attachment entries in the Tenant Allow/Block List are supported only if the query results include the Attachment column by joining with the EmailAttachmentInfo table on NetworkMessageId.
- Submit to Microsoft may be unavailable if required columns are missing. To resolve this issue, select Show empty columns before you select Take actions.
What you can do to prepare:
- No action is required.
- Review security investigation and response procedures to include the new remediation options.
- Inform SecOps teams of the updated Advanced Hunting capabilities.
Learn more: Take action on advanced hunting query results in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn (documentation will be updated before rollout)
Compliance considerations:
No compliance considerations identified, review as appropriate for your organization.
Additional details from Microsoft
- Summary
- Microsoft Defender for Office 365 introduces two new Advanced Hunting remediation actions—blocking attachments and top-level URL domains—to speed SecOps response. Available early March 2026 for Plan 2 and Microsoft 365 E5 users, these features enable direct mitigation from hunting results with no user workflow impact.