Defender for Endpoint onboarding, device groups and roles
Everything you do in Defender for Endpoint depends on devices being onboarded and sorted into the right groups. The exam asks which method, which group and which permission.
Onboarding methods
| Device type | Typical method |
|---|---|
| Windows 10/11 managed by Intune | EDR policy in Intune, or Defender security settings management |
| Windows with Configuration Manager | Configuration Manager onboarding policy |
| Windows Server 2019 and later | Local script, Group Policy, or Defender for Servers (Defender for Cloud) |
| Windows Server 2012 R2 / 2016 | Modern unified agent, installed then onboarded |
| macOS and Linux | Script, Intune, or other deployment tools |
| iOS and Android | Microsoft Defender app deployed via Intune |
For Azure VMs, enabling Defender for Servers in Defender for Cloud onboards them automatically.
Device groups
Device groups control who sees which devices and how remediation works. Each group has:
- A remediation level (for example Full, Semi - require approval for any folders, or No automated response).
- Matching rules on name, domain, tag or OS.
- A rank: a device joins the first group (top to bottom) whose rule it matches.
Devices matching no rule fall into Ungrouped devices (default). Tags help: set them in the portal, with the API or with the registry, then match them in a group rule.
Roles and RBAC
Defender for Endpoint can use Microsoft Defender XDR Unified RBAC to grant permissions such as security operations, security posture and authorization. Under the older device-group RBAC, roles are scoped to device groups. Permissions such as Manage security settings, Active remediation actions and Live response capabilities (basic or advanced) are separate, so grant only what is needed.
Settings worth knowing
In Settings, Endpoints:
- Advanced features: live response, live response for servers, unsigned script execution.
- Automated investigation: controlled by device group levels.
- Device discovery: standard discovery finds unmanaged network devices.
- Tamper protection: blocks changes to security settings.
- Alert suppression: rules to hide known false positives.
Deep analysis works on portable executable files and detonates the submitted file in a sandbox. Script files such as .ps1 are not portable executables.
Exam traps
- Automation level belongs to a device group, not to an automation rule or playbook.
- Group order matters: first match wins.
- Having the live response permission is not enough if the feature is off in Advanced features.
- Server onboarding through Defender for Cloud needs Defender for Servers enabled on the subscription.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. Devices in a pilot must get automatic remediation while other devices stay untouched. What do you create first?
Show answer
Answer: B.Automated investigation and remediation is set per device group through its automation level, so create the group first.
2. A new Android device is onboarded and matches no device group rule. Where does it land?
Show answer
Answer: B.Devices that match no rule go to the Ungrouped devices (default) group, the last in the matching order.
3. What is the simplest way to onboard a few hundred Windows devices that are already managed by Intune?
Show answer
Answer: B.An EDR onboarding policy pushed through Intune needs no scripts and minimizes effort.
4. Which setting must be turned on before analysts can use live response on a device?
Show answer
Answer: B.Live response must be enabled in Settings, Endpoints, Advanced features, and the user needs the live response permission.