Merge pull request #1085 from MicrosoftDocs/v-smandalika-9221097

DefenderDocs - v-smandalika - 9221097 - Edited the introductory paragraph

Author: denisebmsft

defender-xdr/m365d-remediation-actions.md

@@ -16,7 +16,7 @@ ms.collection:
 ms.topic: conceptual
 ms.custom: autoir
 ms.reviewer: evaldm, isco
-ms.date: 02/17/2024
+ms.date: 08/06/2024
 ---
 
 # Remediation actions in Microsoft Defender XDR
@@ -27,7 +27,7 @@ ms.date: 02/17/2024
 
 - Microsoft Defender XDR
 
-During and after an automated investigation in Microsoft Defender XDR, remediation actions are identified for malicious or suspicious items. Some kinds of remediation actions are taken on devices, also referred to as endpoints. Other remediation actions are taken on identities, accounts, and email content. Automated investigations complete after remediation actions are taken, approved, or rejected.
+During and after an automated investigation in Microsoft Defender XDR, remediation actions are identified for malicious or suspicious items. Some kinds of remediation actions are taken on devices, also referred to as endpoints. Other remediation actions are taken on identities, accounts, and email content. In addition, some types of remediation actions can occur automatically, whereas other types of remediation actions are taken manually by your organization's security team. When an automated investigation results in one or more remediation actions, the investigation completes only when the remediation actions are taken, approved, or rejected.
 
 > [!IMPORTANT]
 > Whether remediation actions are taken automatically or only upon approval depends on certain settings, such as automation levels. To learn more, see the following articles: