Setting Automation Level to Full for Automatic Device Isolation in AIR
An administrator wants to configure automated investigation and response (AIR) in Microsoft 365 Defender so that when a high-severity malware alert is generated for a device from Microsoft Defender for Endpoint, the device is automatically isolated from the network without requiring a security analyst to approve the action. Which configuration step is required?
Quick Answer
The answer is to set the automation level for device isolation to 'Full - remediate threats automatically' in Microsoft Defender for Endpoint's automated investigation and response (AIR) configuration. This setting is correct because it enables the system to automatically isolate a device from the network when a high-severity malware alert is generated, bypassing the need for a security analyst to manually approve the action. The automation level dictates how aggressively AIR executes remediation steps, and the 'Full' tier is specifically designed to handle high-severity threats by immediately applying actions like device isolation based on the alert's severity and the device's risk level. On the MS-102 exam, this question tests your understanding of the granular automation levels within AIR policies, often tripping candidates who confuse 'Full' with 'Semi' or overlook that device isolation is a separate toggle from other remediation actions. A helpful memory tip is to associate "Full" with "Full autonomy"—when you need to automatically isolate a device without approval, you must crank the automation level all the way to Full.
⚠ Common exam trap
Watch out — candidates often confuse the 'Full' automation level with requiring approval for all actions, or they mistakenly think a separate toggle like 'Automated device isolation' exists, when in fact the automation level controls all remediation actions including isolation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the automation level for device isolation to 'Full - remediate threats automatically'
Setting the automation level for device isolation to 'Full - remediate threats automatically' in Microsoft Defender for Endpoint's automated investigation and response (AIR) configuration allows the system to automatically isolate a device when a high-severity malware alert is triggered, without requiring analyst approval. This automation level is specifically designed to execute remediation actions like device isolation immediately based on the alert's severity and the device's risk level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the automation level for device isolation to 'Semi - require approval for any remediation'
Why it's wrong here
This level requires a manual approval step before isolation, not automatic.
- ✓
Set the automation level for device isolation to 'Full - remediate threats automatically'
Why this is correct
Full automation means the system automatically takes action (including device isolation) without waiting for approval.
- ✗
Create a custom detection rule that automatically isolates the device
Why it's wrong here
Custom detection rules can trigger alerts but not directly perform automated isolation; AIR automation levels control the response.
- ✗
Enable 'Automated device isolation' in the Microsoft 365 Defender settings
Why it's wrong here
There is no separate toggle for automated device isolation; it is controlled by the automation level for specific playbooks.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
One of 241 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security administrator wants to configure Automated Investigation and Response (AIR) in Microsoft 365 Defender to automatically isolate a device when a high-severity alert for malware is detected. Which step is required?
medium- A.A: Create an automation rule in Microsoft Sentinel.
- B.B: Create a custom detection rule in advanced hunting.
- ✓ C.C: Configure the device to be part of a device group and enable automation level.
- D.D: Enable auto-removal of malware from devices.
Why C: To enable Automated Investigation and Response (AIR) in Microsoft Defender for Endpoint, the device must be added to a device group, and the automation level for that group must be set to 'Full – remediate threats automatically' or a similar level. This configuration allows Defender to automatically isolate a device when a high-severity malware alert is triggered, as part of the built-in AIR playbooks.
Variation 2. A security administrator needs to configure an automated investigation and response (AIR) playbook in Microsoft 365 Defender that will automatically isolate a device whenever a high-severity alert from Microsoft Defender for Endpoint is generated. The playbook must run without requiring manual approval. Which configuration must the administrator set to achieve automatic device isolation?
hard- ✓ A.Set the automation level for device isolation to 'Full - automatically remediate threats' in the Advanced Features settings.
- B.Create a custom detection rule that triggers on high-severity alerts and uses an automated action.
- C.Configure the device isolation action to require approval in the automation level settings.
- D.Enable automatic remediation only for medium severity and above.
Why A: The automation level for device isolation in Microsoft 365 Defender is configured under Settings > Endpoints > Automation (not Advanced Features). Setting it to 'Full - automatically remediate threats' ensures that when a high-severity alert triggers the AIR playbook, device isolation is performed without requiring manual approval.
Variation 3. A security administrator needs to create an automated investigation and response (AIR) playbook that automatically isolates a device whenever a high-severity alert from Microsoft Defender for Endpoint is generated. The playbook should run without requiring manual approval. Which capability in Microsoft 365 Defender should the administrator configure?
hard- ✓ A.Automated investigation and response (AIR) action policy
- B.Custom detection rule
- C.Threat analytics
- D.Attack simulation training
Why A: Automated Investigation and Response (AIR) action policies in Microsoft 365 Defender allow administrators to define automated remediation actions—such as device isolation—that execute automatically when specific alert conditions are met, without requiring manual approval. The policy can be configured to trigger on high-severity alerts from Microsoft Defender for Endpoint, enabling fully automated containment of compromised devices.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.