Defender for Business: Understanding Device Groups, Policy Assignment and Priority
Source: Microsoft
If you work across different Microsoft 365 environments, you have probably noticed that the Microsoft Defender portal can be a bit of a moving target. One day you are working in an enterprise environment (with Defender for Endpoint Plan 2) and you know exactly where everything is. The next day, you log into an SMB client's tenant running Microsoft 365 Business Premium (Defender for Business) and things look a lot different.
A classic example of this is Device Groups. If you search online or read standard enterprise documentation, you will be told to go to Settings > Endpoints > Permissions > Device groups. But if you try that in a Defender for Business or a Business Premium tenant, you will get a frustrating surprise. The menu isn't there, and clicking the hyperlink under a supported feature like AIR, just brings you back to the homepage.
So what is really going on? Is this by design or a bug? Let’s explore..
Where are the Device Groups
The disappearance isn't a permissions bug or an Entra ID RBAC issue. It is a completely intentional architectural difference in how Microsoft treats security group workflows based on your licensing. In a Business Premium or Defender for Business tenant, the device groups are managed directly as an integrated step within the Defender for Business policy workflow.
You can find the configuration under: Microsoft Defender (security.microsoft.com) → Endpoints → Configuration management → Device configuration
When creating or editing a next-generation protection or firewall policy, you define the device group directly inside the policy creation wizard.
Here is where things get interesting. If you check a freshly provisioned Business Premium tenant before you have ever created your own security architecture or even touched the Defender portal settings, you will find two policies already waiting for you in Intune.
These default profiles are created out-of-the-box natively inside Intune. Thankfully, the policies are left unassigned. While Microsoft's documentation does mention these policies are included in Defender for Business by default, there is no mention of these policies getting created in Intune explicitly. Honestly I don't mind the policies getting created in Intune, however I can't seem to wonder if this can cause confusion in the wider technical community. Especially when it comes to managing similar policies between Defender and Intune. Could there be a conflict of some sort? More on that later in this blog post..
Policy Priority & Conflicts
Once you create more than one policy of the same type (e.g., multiple Next-Generation Protection profiles), Defender for Business introduces a safety mechanic through Policy Order. For example if you create different policies with a priority order, and if device falls in more than one group assigned, the highest priority applicable policy wins.
Unlike traditional Group Policies (GPOs) or standard Intune configurations, Defender profiles do not merge or combine. Defender follows a strict "First Match Wins" rule. The engine scans the list from top to bottom (starting at Priority 1). However, when you create these custom policies in Defender portal, then they will sync and show in Intune as well.
I also created a custom policy Windows SEC Defender AV in Intune with its own set of values assigned to the same group of devices as the policies synced from Defender and it immediately through a conflict error.
Microsoft's Intune documentation says that when multiple configuration policies set the same setting to different values, the conflict needs to be manually resolved. Intune doesn't simply use "first policy wins" for these configuration-policy conflicts & Defender policy priority only orders policies within the Defender for Business policy set. It does not establish precedence over a separately created Intune Endpoint Security policy. This is how the enforcement is determined -
The Security Feature Blindspot (Web Filtering & AIR)
If you are looing to use the inline Defender for Business device groups to build granular security control structures across other advanced features, you are going to hit a brick wall. Two massive examples of this are Web Content Filtering and Automated Investigation and Remediation (AIR).
Web Content Filtering: In Defender Plan 2, you can create a policy blocking gambling sites for one device group while allowing it for another. In Defender for Business, scoping does not apply. The portal completely locks targeting to a single, global policy that blankets all onboarded devices simultaneously. The wizard literally won't let you select an inline group. It is the same for Indicators of Compromise (IoC)
Final thoughts..
In the world of Defender for Business, device groups are strictly designed for one purpose - handling overlapping rules for Next-Gen Protection (Antivirus) and Firewall settings using a "First Match Wins" priority sequence. For everything else, the simplified portal treats your tenant as one massive, flat environment. Microsoft also specifically says that if you choose to use the Defender for Business simplified configuration, you should delete existing Intune security policies to avoid policy conflicts. Policies managed in Defender are listed in Intune, but separately created Intune policies can conflict with them.
References:
References:
Device groups in Microsoft Defender for Business - Microsoft Defender for Business | Microsoft Learn
Comments
Post a Comment