Create and manage Microsoft Defender for Endpoint Device tags for macOS

I recently worked on an implementation project for Microsoft Defender for Endpoint for macOS devices and while I will love to cover all the bells and whistles involving the setup, for now I will just focus on one particular aspect of the setup i.e. MDE device tags.

What is an MDE Device Tag anyway?

Tags are used primarily to label and classify devices in an environment. This helps in making the searching easy and streamlining the designating rules to specific groups or categories. Device tags support proper mapping of the network, enabling you to attach different tags to capture context and to enable dynamic list creation as part of an incident in Defender. Here are some common uses of device tags -

1. Device Filter - One can be use a filter in the Device inventory view, or to group devices.

2. RBAC - You can create device groups in Defender using tags for the purpose of enforcing Role Based Access Control in the Defender Portal.

3. Device Grouping - You can create device groups in Defender using tags for the purpose of assignments against Web content filtering and Indicators of Compromise rules.

4. Advanced Hunting - You can leverage tag information in Device info schema in Advanced hunting in Defender for reporting and inspect events in your network to locate threat indicators and entities.

How to create MDE device tags?

There are multiple ways of creating a tag.

Manual

The manual method involves creating and assigning the tag directly in the Defender Portal.

1. Open Microsoft Defender.

2. Navigate to Assets>Devices

3. Click on the particular macOS device and select Manage tags on the top right.

4. Create the tag as shown below.

However, this method is only good if you are dealing with a handful of machines. That is where the next method is more preferable.

Automated

If you are managing devices using Intune, then you can easily assign tags using an Intune policy. You can either create a configuration file based on .plist preferences or just use Settings catalog. Needless to say, the later is going to be the choice of preference for many.

1. Open Microsoft Intune admin center.

2. Navigate to Devices>macOS>Configuration profiles>Create>Settings Catalog

3. Give a name and search for EDR as shown below.

4. Check Type of tag which will also select Value of tag. Once done, you can give whatever value you want for the tag. Note: Filtering might not work on tag names that contain parenthesis or commas so avoid these characters.

5. Assign the profile to a group of devices as normal. Note: It can take up to 18 hours for the tag information to populate so patience is the key.

How & where to verify?

First and foremost, check if the Intune profile is applying correctly.

Secondly, head over to Defender Portal and see if the tag is populating for your targeted devices or not. You can do this by applying filters.

You can also check for device info in advanced hunting on the Defender Portal. Run the following query to get the details.

// Get latest information on user/device
DeviceInfo
| where RegistryDeviceTag has "Intune-macOS-DigitalDesign"

Final Thoughts..

Device tags within Microsoft Defender for Endpoint is device tags is a pretty useful feature which in my opinion get overlooked. This functionality allows granular level of control over how an organization can manage their devices. There are other aspects of MDE device tags like RBAC, using API & scripts for automated method of creation of tags which I haven't covered in this blog. However, I do intend to cover them in the coming weeks along with creating MDE device tags for other platforms.

Until next time..