Direct answer
The incident commander should weigh suspected risk against operational impact, confirm the device and available response method, and verify isolation status and communications before deciding when to release it.
Establish the reason and impact
Record the alert, device identity, owner and affected business function. Determine whether the machine runs safety-critical or essential operations and identify contacts and alternatives. A planned isolation should not be confused with proof of compromise.
Use the approved response method
Where Microsoft Defender for Endpoint is deployed, Microsoft documents device isolation and other response actions, subject to licensing, operating system and configuration. Confirm access and applicability to the target. Record the request, response status and incident reference.
Reference: Microsoft: Device response actions.
Verify and release deliberately
Check the action result and maintain an approved communication path with responders. Collect evidence according to the incident plan and remediate the affected systems. Release isolation only under the team's defined criteria, then verify required network functions and monitor for recurrence.
Example: a production support workstation
If an alert affects a workstation used for emergency support, first identify the functions that would be interrupted and an alternate support route. The incident commander can decide containment urgency with operations, record the isolation scope and verify response status. Keep a communication channel and define who may approve release after investigation.
Assessment limits
Isolation options and connectivity exceptions vary by product and device. A device that is offline or not onboarded may not receive a remote action, and isolation alone does not remove malware.
Frequently asked questions
Does an isolation request prove the device is isolated?
No. Check the response action status and verify the approved outcome.
Does isolation fix a compromise?
No. It is a containment measure; investigation, remediation and recovery remain necessary.
Can isolation interrupt critical services?
Yes. Assess dependencies and coordinate with the responsible incident and operations teams.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.