
Explanation:
Box 1: Group2 only.
Device1 is a Windows 11.
The Rank 2 matching rule is matching, and Device1 is added to Group2.
Box 2: Group1 only.
Device2 is using Android
The Rank 1 matching rule is matching, and Device2 is added to Group1.
Note: Microsoft Defender applies rules and policies based on a priority order, where a lower numerical value indicates a higher priority; policies are processed in order, and the first matching rule determines the outcome for a recipient, stopping further processing for that item. Predefined preset security policies and custom policies are applied before a default policy, but preset policies must be enabled to take effect.
Reference:
https://learn.microsoft.com/en-us/defender-office-365/how-policies-and-protections-are-combined