During an incident, a Defender for Endpoint automated investigation quarantined a file named 'BillingExport.exe' on 40 devices. Your finance team confirms the file is a legitimate internally developed reporting tool that was mistakenly flagged. You need to restore the file on all affected devices in a single action and prevent it from being quarantined again by the same detection logic, while retaining the ability to reverse the restoration if new evidence emerges. Which action in the Microsoft Defender portal best meets these requirements?