Attack disruption in Microsoft 365 Defender AMA

It seems really unclear as to when and where attack disruption is enabled. is there a way to difinitively confirm that it is enabled for the organisation, specific users, specific systems? lots of automated remediation (AIR) seems to get stuck in an investigation state of "queued" if there is a part of the incident involving mailboxes. As far a I can tell everything is set correctly according to the guidance. is this intended and will attack disruption be hampered by this? How will the disrupted attacks be reported or appear in the alerts or incidents view of the defender portal?