From 57f4b371853b1d11a8f27276222d38658b98fb8a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 12 Aug 2020 10:24:34 -0700 Subject: [PATCH] Update automated-investigations.md --- .../microsoft-defender-atp/automated-investigations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md b/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md index fe9a1b10b8..fa38e015e0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md +++ b/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md @@ -63,7 +63,7 @@ If an incriminated entity is seen in another device, the automated investigation ## How threats are remediated -Depending on how you set up the device groups and their level of automation, the automated investigation will either require user approval (default) or automatically remediate threats. +Depending on how you set up the device groups and their level of automation, each automated investigation either requires user approval (default) or automatically remediates threats. > [!NOTE] > Microsoft Defender ATP tenants created on or after August 16, 2020 have **Full - remediate threats automatically** selected by default. You can keep the default setting, or change it according to your organizational needs. To change your settings, [adjust your device group settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-automated-investigations-remediation#set-up-device-groups).