Question

Your organization uses Microsoft Defender for Endpoint. You have created three device groups, each with a machine membership rule and a different automation level. A newly onboarded server matches the membership criteria of two of these device groups: 'Servers-Full-Remediation' (rank 3) and 'Production-Semi-Auto' (rank 1). Both were created before the built-in 'Ungrouped devices' group. Which automation level will apply to this server, and why?

Accepted Answer

The automation level of 'Production-Semi-Auto', because a device is assigned to the highest-ranked matching group (the lowest rank number takes precedence).

Answer

The automation level of 'Servers-Full-Remediation', because the group with the higher rank number is evaluated last and overrides earlier matches.

Answer

The automation levels of both groups are merged, applying the most permissive (Full) remediation to avoid blocking legitimate server activity.

Answer

The automation level of the built-in 'Ungrouped devices' group, because a device matching multiple custom groups is treated as a conflict and falls back to the default.