Microsoft Defender Initial Investigation
A read-only first workflow for triaging Microsoft Defender alerts and affected entities.
Open Runbook entryRunbook category
Microsoft 365
Microsoft 365 administration, identity, endpoint management, messaging and security investigation references.
8
entries
Maintained references
Commands and structured workflows for supporting Microsoft 365 services and identities.
The collection covers Exchange Online, mail flow, mailbox permissions, Entra ID, Intune, Microsoft Defender, Microsoft Graph and service-health investigation.
All examples use placeholder users, domains, devices and tenant information.
Technical reference
Entries in Microsoft 365
Commands, checks, troubleshooting procedures and operational references for this subject.
Microsoft 365 Service Health Checks
Review tenant service health, advisories and workload-specific diagnostics.
Open Runbook entryMailbox Permissions and Delegation
Review Full Access, Send As, Send on Behalf and shared mailbox delegation.
Open Runbook entryMail Flow and Message Trace
Workflow for investigating delayed, rejected or missing Exchange Online messages.
Open Runbook entryIntune Device Troubleshooting
Workflow for enrollment, compliance, sync, ownership and managed-device investigation.
Open Runbook entryExchange Online Recipient Investigation
Read-only checks for mailbox type, aliases, forwarding, permissions and delivery settings.
Open Runbook entryExchange Online PowerShell Connections
Install, connect, verify and disconnect Exchange Online PowerShell safely.
Open Runbook entryEntra ID User and Group Checks
Read-only Microsoft Graph checks for users, groups, licenses and membership.
Open Runbook entry