Question

Your organization uses Microsoft Defender for Endpoint. The SOC team wants critical production servers in a device group named 'Prod-Servers' to have Defender automatically investigate alerts and remediate malicious artifacts without requiring an analyst to approve each action. However, for a device group named 'Executive-Laptops', the team wants Defender to investigate automatically but hold all remediation actions until an analyst manually approves them. What should you configure to meet both requirements?

Accepted Answer

Set the automation level to 'Full - remediate threats automatically' for Prod-Servers and 'Semi - require approval for any remediation' for Executive-Laptops

Answer

Set the automation level to 'Full - remediate threats automatically' for both device groups and rely on custom detection rules to hold Executive-Laptops remediations

Answer

Set the automation level to 'Semi - require approval for core folders remediation' for Prod-Servers and 'No automated response' for Executive-Laptops

Answer

Enable 'Block at first sight' for Prod-Servers and configure an ASR rule in audit mode for Executive-Laptops