Question

You manage Microsoft Defender for Endpoint for a large enterprise. The SOC wants unsanctioned and unmanaged devices discovered on the corporate network to be automatically onboarded and brought under Defender for Endpoint protection without manual intervention. Which advanced feature in the Microsoft Defender portal settings must you enable to achieve this?

Accepted Answer

Enable 'Device discovery' and configure it to Standard discovery mode

Answer

Enable 'Automated Investigation' under Endpoints advanced features

Answer

Enable 'Web content filtering' policies for the device groups

Answer

Enable 'Tamper protection' in the endpoint security policy