Microsoft 365 Alert – Service Degradation – Microsoft Defender XDR – Admins’ manual remediations aren’t being shown on the action history page in the Microsoft Defender XDR portal – ONGOING

13/02/2026 08:43:00 AM

NHSmail Reference: INC46749459

Microsoft Reference: DZ1231408

Issue Status: ONGOING

Issue Description: Admins’ manual remediations aren’t being shown on the action history page in the Microsoft Defender XDR portal

More info:When admins perform a manual remediation, an Approval ID is generated; however, the investigation ID and Approval ID aren’t shown on the action history page.

The two-step approval process is missing from the action center/pending page in the Microsoft Defender XDR portal. This issue only affects manual actions completed via Threat explorer, Advanced Hunting, Take action wizard, Custom detection and Graph API. There is no problem with action processing; the issue is with the entries displaying in the Action center.

As a way to circumvent impact while we work to resolve the issue, affected admins can view the status of manual remediations through Microsoft Defender Threat Explorer by applying the following filter in the Query Builder: Additional action == Manual remediation. Alternatively, the status can be seen using Advanced Hunting by utilizing EmailPostDeliveryEvents and filtering by ActionType.

Current Update: 13/02/2026 11:03:00 AM – Microsoft has determined that a code regression was introduced in a recent configuration change. They are reverting the problematic change to mitigate impact.

Scope of impact: This issue may potentially impact any user attempting to join affected meetings through the “Join” button in the meeting chat. This information may be updated as our investigation continues.

Next update by: Friday, February 13, 2026, at 1:30 PM UTC