Microsoft Defender XDR had a Deception capability in public preview: fake accounts, devices and files, called decoys and lures, were planted on endpoints, and an alert fired the moment an attacker touched one. The goal was to catch lateral movement early.
Microsoft announced its retirement in Microsoft 365 Message Center post MC1137611. The Deception documentation pages now redirect to automatic attack disruption.
What happened and when
| Date | What changed |
|---|---|
| 18 August 2025 | New tenants can no longer turn on Deception. |
| 31 October 2025 | The capability was removed: existing decoys and lures were deleted, and its options left the portal. |
What it means if you used Deception
- Nothing to turn off. Microsoft deleted the decoys and lures itself; no admin action is required.
- Deception alerts won’t arrive anymore. Runbooks, playbooks or alert rules that wait for the Deception tag or the word deceptive in an alert title won’t fire. Update them.
- Update your internal documentation and tell the people who need to know, such as your SOC team or service provider.
What replaces it: automatic attack disruption
Deception waited for an attacker to touch a lure. Automatic attack disruption works differently: it correlates signals from endpoints, identities, email and SaaS apps into one high-confidence incident, identifies the assets the attacker controls, and contains them automatically while the attack is still in progress. Its actions include:
- Contain device: blocks communication from a suspicious device on every device onboarded to Defender for Endpoint.
- Disable user in Active Directory and Microsoft Entra ID, and revoke their active sessions.
- Contain user: blocks a suspicious user’s communication on all onboarded devices, to limit lateral movement and remote encryption.
- Compromised OAuth app: protective actions through Defender for Cloud Apps.
Your security team stays in control: every automatic action can be undone, and you can exclude critical users, devices and IP addresses. An incident where an action was taken carries the Attack Disruption tag and a yellow bar at the top of the incident page.
What to check now
- Licensing Automatic attack disruption is available with, among others, Microsoft 365 E5, Defender for Endpoint Plan 2 and Microsoft Defender for Business, which is included in Business Premium.
- Deployment Each Defender product carries out its own actions. Without Defender for Endpoint there is no device containment, and without a Defender for Identity sensor on the domain controller there is no Active Directory account disable.
- Automation level In Settings > Endpoints > Device groups, check the Remediation level column. Microsoft recommends Full - remediate threats automatically.
- Mailbox auditing In Exchange Online, make sure at least MailItemsAccessed, UpdateInboxRules, MoveToDeletedItems, SoftDelete and HardDelete are audited.
- Exclusions and runbooks Exclude only assets that must never be contained automatically, and document why. Add to your response runbooks what to do when an incident arrives with the Attack Disruption tag, and how to release an asset after the investigation.
Want to know which Microsoft 365 security settings are missing in your tenant? Griffin31 checks your tenant continuously and shows you what to fix first.