Exam SC-200 topic 6 question 16 discussion

hard deleting the email message

Defender for Endpoint Plan 1 and Microsoft Defender for Business include only the following manual response actions: Run antivirus scan Isolate device Stop and quarantine a file Add an indicator to block or allow a file

Corrent. AIR can soft or hard delete email. MDE don't do isolation as automate response - so this is correct. You can't contain device connected to MDE. You can check it here: https://learn.microsoft.com/en-us/defender-office-365/remediate-malicious-email-delivered-office-365 https://learn.microsoft.com/en-us/defender-endpoint/manage-auto-investigation#remediation-actions https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts

https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts

https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts Important Defender for Endpoint Plan 1 includes only the following manual response actions: Run antivirus scan Isolate device Stop and quarantine a file Add an indicator to block or allow a file. Microsoft Defender for Business does not include the "Stop and quarantine a file" action at this time.

https://learn.microsoft.com/en-us/defender-xdr/m365d-remediation-actions