2.3.3. Device Groups, Permissions, and Automation Levels
💡 First Principle: Not every device should be treated the same. A kiosk can be remediated automatically; a trading-floor server might need a human to approve every action; a subsidiary's devices should be visible only to the subsidiary's SOC. Device groups divide the fleet so that access and automatic remediation can be set per group rather than tenant-wide.
A device group has a matching rule built from device name, domain, tags, and OS platform. Values within one property combine with OR; different properties combine with AND. Groups are ranked, and here is the rule that drives most exam items: a device that matches several groups joins only the highest-ranked group it matches. Devices that match no group fall into Ungrouped devices, which can't be deleted or re-ranked but can have its automation level and access set.
Each group carries two settings:
| Automation level | What automated investigation can do |
|---|---|
| Full - remediate threats automatically | Take remediation actions on its own (Microsoft's recommended level, and the default for new tenants) |
| Semi - require approval for all folders | Every remediation action waits for approval |
| Semi - require approval for core folders remediation | Approval needed for actions in system folders such as the Windows directory |
| Semi - require approval for non-temp folders remediation | Actions in temporary folders are automatic; others wait |
| No automated response | Investigation doesn't remediate (not recommended) |
Pending actions from Semi levels wait in the Action center, which is where an analyst approves or rejects them (2.4.2).
Permissions come from MDE role-based access control. You create roles (for example, one that can view data and another that can take response actions) and assign them to Microsoft Entra user groups, then grant those user groups access to specific device groups. RBAC roles must exist before you can grant device-group access, and a device group with no assigned user groups is visible to everyone with portal access. Changes can take minutes to hours to propagate. In tenants using Defender XDR unified RBAC, equivalent permissions are managed centrally across Defender workloads.
⚠️ Exam Trap: When a device unexpectedly gets the wrong automation level, check rank before anything else. If "All Windows servers" (rank 1) and "Finance servers - require approval" (rank 2) both match a finance server, the server joins the rank-1 group and its remediation is automatic. Promote the more specific group above the broader one.
Reflection Question: The European SOC must see and respond to only European devices, and the CFO's laptop must never be remediated without approval. Design the device groups, their ranks, automation levels, and user-group assignments, and explain why the order matters.
