check before: 2025-07-01
Product:
Defender, Defender for Office 365, Defender XDR
Platform:
Online, Web, World tenant
Status:
Launched
Change type:
Admin impact, New feature, Updated message
Links:
Details:
Summary:
Microsoft Defender for Office 365 now lets admins dispute submission results directly in the portal to flag false positives or negatives, improving detection accuracy without support tickets. This feature, enabled by default, will roll out worldwide from late August to late September 2025.
Details:
Updated August 14, 2025: We have updated the content. Thank you for your patience.
We're adding a new capability to Microsoft Defender that allows SOC teams and admins to dispute submission results directly within the portal.
This enhancement enables organizations to provide feedback on false positives and false negatives without opening support tickets, streamlining the feedback loop and improving detection accuracy over time.
This message is associated with Microsoft 365 Roadmap ID 488096.
[When this will happen:]
General Availability (Worldwide): Rollout will begin in late August 2025 (previously early August) and is expected to complete by late September 2025 (previously late August).
Change Category:
XXXXXXX ... free basic plan only
Scope:
XXXXXXX ... free basic plan only
Release Phase:
General Availability
Created:
2025-07-04
updated:
2025-08-15
Task Type
XXXXXXX ... free basic plan only
Docu to Check
XXXXXXX ... free basic plan only
MS How does it affect me
XXXXXXX ... free basic plan only
MS Preperations
XXXXXXX ... free basic plan only
MS Urgency
XXXXXXX ... free basic plan only
MS workload name
XXXXXXX ... free basic plan only
linked item details
XXXXXXX ... free basic plan only
summary for non-techies**
XXXXXXX ... free basic plan only
Direct effects for Operations**
False Positives and Negatives
Without proper preparation, the new dispute feature may lead to an increase in false positives and negatives being reported, as admins may not be familiar with the new process, resulting in inaccurate feedback and potential security risks.
- roles: Security Operations Center (SOC) Team, IT Administrators
- references: https://learn.microsoft.com/en-us/defender-office-365/submissions-admin, https://www.microsoft.com/microsoft-365/roadmap?rtc=1%26filters%3D&searchterms=488096
User Experience
The introduction of the dispute feature without adequate training may confuse admins, leading to frustration and decreased efficiency in handling security submissions, ultimately impacting the overall user experience.
- roles: IT Administrators, End Users
- references: https://learn.microsoft.com/en-us/defender-office-365/submissions-admin, https://www.microsoft.com/microsoft-365/roadmap?rtc=1%26filters%3D&searchterms=488096
Configutation Options**
XXXXXXX ... paid membership only
IT Security**
XXXXXXX ... paid membership only
explanation for non-techies**
XXXXXXX ... free basic plan only
** AI generated content. This information must be reviewed before use.
a free basic plan is required to see more details. Sign up here
A cloudsocut.one plan is required to see all the changed details. If you are already a customer, choose login.
If you are new to cloudscout.one please choose a plan.
change history
| Date | Property | old | new |
| 2025-08-15 | MC Messages | Updated July 22, 2025: We have updated the timeline. Thank you for your patience.
We're adding a new capability to Microsoft Defender that allows SOC teams and admins to dispute submission results directly within the portal. This enhancement enables organizations to provide feedback on false positives and false negatives without opening support tickets, streamlining the feedback loop and improving detection accuracy over time. This message is associated with Microsoft 365 Roadmap ID 488096. [When this will happen:] General Availability (Worldwide): Rollout will begin in early August 2025 (previously mid-July) and is expected to complete by late August 2025 (previously late July). | Updated August 14, 2025: We have updated the content. Thank you for your patience.
We're adding a new capability to Microsoft Defender that allows SOC teams and admins to dispute submission results directly within the portal. This enhancement enables organizations to provide feedback on false positives and false negatives without opening support tickets, streamlining the feedback loop and improving detection accuracy over time. This message is associated with Microsoft 365 Roadmap ID 488096. [When this will happen:] General Availability (Worldwide): Rollout will begin in late August 2025 (previously early August) and is expected to complete by late September 2025 (previously late August). |
| 2025-08-15 | MC Last Updated | 07/22/2025 23:02:52 | 2025-08-14T17:48:34Z |
| 2025-08-15 | MC Summary | Microsoft Defender for Office 365 will allow SOC teams and admins to dispute submission results directly in the portal, improving detection accuracy by providing feedback on false positives and negatives. This feature, available from early August 2025, is on by default and requires no configuration. Admins can access it via the Microsoft Defender portal. | Microsoft Defender for Office 365 now lets admins dispute submission results directly in the portal to flag false positives or negatives, improving detection accuracy without support tickets. This feature, enabled by default, will roll out worldwide from late August to late September 2025. |
| 2025-07-23 | MC MessageTagNames | New feature, Admin impact | Updated message, New feature, Admin impact |
| 2025-07-23 | MC Summary | Microsoft Defender for Office 365 will allow SOC teams and admins to dispute submission results directly in the portal, improving detection accuracy by providing feedback on false positives and negatives. This feature, available from mid-July 2025, is on by default and requires no configuration. Admins can access it via the Microsoft Defender portal. | Microsoft Defender for Office 365 will allow SOC teams and admins to dispute submission results directly in the portal, improving detection accuracy by providing feedback on false positives and negatives. This feature, available from early August 2025, is on by default and requires no configuration. Admins can access it via the Microsoft Defender portal. |
| 2025-07-23 | MC Last Updated | 07/04/2025 01:37:32 | 2025-07-22T23:02:52Z |
| 2025-07-23 | MC Messages | We're adding a new capability to Microsoft Defender that allows SOC teams and admins to dispute submission results directly within the portal.
This enhancement enables organizations to provide feedback on false positives and false negatives without opening support tickets, streamlining the feedback loop and improving detection accuracy over time. This message is associated with Microsoft 365 Roadmap ID 488096. [When this will happen:] General Availability (Worldwide): Rollout will begin in mid-July 2025 and is expected to complete by end-July 2025. | Updated July 22, 2025: We have updated the timeline. Thank you for your patience.
We're adding a new capability to Microsoft Defender that allows SOC teams and admins to dispute submission results directly within the portal. This enhancement enables organizations to provide feedback on false positives and false negatives without opening support tickets, streamlining the feedback loop and improving detection accuracy over time. This message is associated with Microsoft 365 Roadmap ID 488096. [When this will happen:] General Availability (Worldwide): Rollout will begin in early August 2025 (previously mid-July) and is expected to complete by late August 2025 (previously late July). |
| 2025-07-23 | MC Title | Microsoft Defender for Office 365: Ability to Disagree with admin submissions analysis | (Updated) Microsoft Defender for Office 365: Ability to Disagree with admin submissions analysis |
| 2025-07-23 | MC End Time | 09/29/2025 09:00:00 | 2025-10-06T09:00:00Z |
Last updated 4 weeks ago ago
