Skip to main content

Investigate customer security incidents

Collect available Microsoft Defender incidents for authorized customers, investigate evidence your role and Microsoft consent allow, and isolate a supported device only after customer approval and Defender setup, with release approved separately.

Start as an MSPExplore access boundaries
Example data

Contoso Dental

Defender incident 32041

MediumInvestigating

Source: Microsoft 365 Defender

  • Impossible travel sign-inToday 09:42

    Contoso-DT-042

  • Suspicious inbox ruleToday 09:47

    Exchange Online

A customer-scoped Defender incident with its alerts, source and response state.

Security alerts arrive with no context.

Alerts pile up without customer context, and evidence sits elsewhere.

What you get

1

Defender incidents

Collect available Microsoft Defender incidents and alerts for authorized customers.

2

Scoped evidence

Investigate incidents with evidence permitted by current role and Microsoft consent; record local triage separately from Defender state.

3

Separately approved isolation/release

After customer approval and Defender setup, isolate a supported Defender device and separately approve its release.

How it works

  1. 1

    Review the incident

    Collect available Microsoft Defender incidents and alerts for authorized customers.

  2. 2

    Investigate

    Investigate with evidence permitted by current role and Microsoft consent; record local triage separately from Defender state.

  3. 3

    Coordinate response

    After customer approval and Defender setup, isolate a supported Defender device and approve its release separately.

What needs setup

Device isolation and release require customer approval, the relevant Microsoft permission grants, registered callbacks and Defender setup.

After that setup, a supported Defender device can be isolated, and its release is approved separately.

Limits

Isolation and release are the supported native containment actions described here.

Classified attachment metadata stays with the customer's owners and admins; MSP analysts do not inherit it.

TenantVigil only reads your Microsoft 365 tenant. It never changes a setting: you apply each fix yourself.

Related documentation

Start as an MSPExplore access boundaries

Connect a customer with administrator consent, then review the findings and service work in your console.