Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community

Investigation state Queued

Brass Contributor

I see a number of messages in our Defender XDR Incidents with a status of Queued. What does this status mean? 

This appears to only be related to Defender for Office 365 incidents, usually email reported as junk/phish/notjunk etc type of incidents.

Regardless of whether I investigate or change the status of the incident, in remains in the Incidents list as queued. I cannot find clear documentation on what this state means or what action is required to resolve/close the incident.

Can anyone shed any light on the what the queued state means and how to resolve a queued incident.

1 Reply
Thank you Danny for your question. This is actually a display issue, and the team has already investigated it and will work on a solution to address this misleading status.