Microsoft 365 Alert – Service Degradation – Microsoft Defender XDR – Admins’ manual remediations aren’t being shown on the action history page in the Microsoft Defender XDR portal – RESOLVED

13/02/2026 08:43:00 AM

NHSmail Reference: INC46749459

Microsoft Reference: DZ1231408

Issue Status: RESOLVED

Issue Description: Admins’ manual remediations aren’t being shown on the action history page in the Microsoft Defender XDR portal

More info:When admins perform a manual remediation, an Approval ID is generated; however, the investigation ID and Approval ID aren’t shown on the action history page.

The two-step approval process is missing from the action center/pending page in the Microsoft Defender XDR portal. This issue only affects manual actions completed via Threat explorer, Advanced Hunting, Take action wizard, Custom detection and Graph API. There is no problem with action processing; the issue is with the entries displaying in the Action center.

As a way to circumvent impact while we work to resolve the issue, affected admins can view the status of manual remediations through Microsoft Defender Threat Explorer by applying the following filter in the Query Builder: Additional action == Manual remediation. Alternatively, the status can be seen using Advanced Hunting by utilizing EmailPostDeliveryEvents and filtering by ActionType.

Final Update: 16/02/2026 08:35:00 AM – Microsoft has successfully reverted the recent change and confirmed through service monitoring that impact has been fully remediated.

Scope of impact: This issue may potentially impact any user attempting to join affected meetings through the “Join” button in the meeting chat. This information may be updated as our investigation continues.

Next Steps: Microsoft are reviewing their standard service update procedures to avoid similar impact in the future.