In Microsoft Defender for Endpoint (part of Microsoft Defender XDR), device groups are used to organize endpoints for policy, automation, and investigation purposes. Tags provide a dynamic way to categorize devices temporarily or permanently.
To temporarily group high-value machines for investigation or response, the correct approach is to use tags and a new high-rank device group:
* Add a tag to the machines (C): Applying a tag allows quick identification and dynamic inclusion in a new group without permanently altering membership.
* Create a new device group (D): Creating a device group with a rank of 1 ensures it has the highest precedence and that devices tagged for this group are included immediately.
* Add a tag to the device group (A): The device group's membership rule can include the tag value, automating group inclusion.
This approach aligns with Microsoft Defender for Endpoint guidance to "use device tags and group ranks for dynamic grouping and prioritized policy application" - minimizing administrative effort while allowing targeted response actions.