Microsoft Defender for Office 365: View approver details for remediation actions in Advanced Hunting

Microsoft Defender for Office 365 added an ApproverUpn column to the EmailPostDeliveryEvents table in Advanced Hunting, showing who approved remediation actions. This enables faster investigations without using Action Center. The feature is available worldwide, enabled by default, and requires no action from administrators. We’ve added a new ApproverUpn column to the EmailPostDeliveryEvents table in Microsoft Defender XDR Advanced Hunting. This enhancement allows security teams to identify who approved eligible remediation actions directly from Advanced Hunting results. By making approver information available in hunting queries, analysts can investigate remediation activity more efficiently without needing to navigate to Action Center. This improvement supports faster security investigations and operational efficiency. Rollout schedule General Availability (Worldwide, GCC, GCC High, DoD): Available now Impact on your organization Who is affected Security administrators and security analysts who use Microsoft Defender XDR Advanced Hunting Organizations that investigate email remediation activity using Advanced Hunting Platforms and services Microsoft Defender XDR Advanced Hunting EmailPostDeliveryEvents table What will happen A new ApproverUpn column is added to the EmailPostDeliveryEvents table. The column displays the User Principal Name (UPN) of the user who approved a remediation action. The enhancement applies to manual remediation actions and Automated Investigation and Response (AIR) remediation actions that require approval. Advanced Hunting query results include approver information for eligible remediation actions. Administrators and analysts can identify the approver for eligible remediation actions directly in Advanced Hunting results without navigating to Action Center. The feature is enabled by default and is automatically available in your tenant. There are no changes to: Manual remediation approval workflows Permissions required to approve remediation actions Remediation processing behavior or action status Information available in Action Center Existing columns in the EmailPostDeliveryEvents table Action required and recommendations No action is required. After rollout, administrators can begin using the new ApproverUpn column in Advanced Hunting queries and workflows. We recommend that you: Review existing Advanced Hunting queries to determine whether the new ApproverUpn field should be incorporated into investigation, reporting, or automation workflows. Inform security operations teams about the availability of the new column. Validate any investigation workflows, reports, or automation that could benefit […]

The post Microsoft Defender for Office 365: View approver details for remediation actions in Advanced Hunting appeared first on M365 Admin.