Question

Your SOC uses Microsoft Defender for Endpoint. The security team wants newly onboarded servers in the 'Manufacturing-OT' subnet to automatically be placed into a device group that has a lower automation level, without an analyst manually assigning each device. The servers already report a consistent registry-based tag applied during imaging. What is the most effective way to ensure these devices land in the correct device group automatically?

Accepted Answer

Create a device group with a matching rule that filters on the device tag, and rank it above the default group in the device group list.

Answer

Manually add each server to the device group from the Device inventory page after onboarding completes.

Answer

Apply an Azure resource tag to the virtual machines so Defender for Endpoint inherits it for grouping.

Answer

Create an ASR rule scoped to the subnet so Defender automatically classifies the devices into the group.