Microsoft Defender Incident Activities / Activity Log - "Add comments to an incident" does not work

Hello,

// I am aware that the Intune tag is not correct; however, I could not find a Defender XDR or any other more appropriate tag.

I am currently experiencing a strange issue in Microsoft Defender XDR related to Incident Activities and Comments.

Problem description

• Comments added to an incident were initially visible
• After approximately 1–2 hours, those comments disappeared

The Activities tab on the incident level becomes completely empty

It is no longer possible to add new comments

• Clicking “Add comment” does nothing
• Hard reload / browser change does not resolve the issue
• Comments on other incident than that specific one do work, it is a Defender AV Malware detection Incident

Scope

• Issue is reproducible across multiple incidents
• Issue is reproducible with multiple users
• All affected users have the Security Operator role assigned via Entra ID
• Defender RBAC / Unified RBAC is not in use
• No recent role or permission change

Question

• Is this a known issue in Microsoft Defender XDR?

Are there any ongoing backend or regional issues affecting incident activity logs or comments?

• Is there any recommended workaround while this issue persists?

Any confirmation or guidance would be appreciated.

Another interesting question would be: Is it possible to find incident comments from the Activities using Advanced Hunting (KQL), for example by searching for keywords such as #Comment or similar indicators?