Forum Discussion
Machine tagging in Defender
Hi all, I have tagged a number of now inactive devices and added them to a machine group. But whilst I tagged 24 devices, 31 are showing up in my device group. I have tagged the 24 devices InactiveR...
Did you see any duplicate entries in 31? Did you ever tried onboarding/ offboarding same devices more than one time? inactive entries remains in Device inventory until it's reaches the retention period.
Tags can be managed manually or through API.
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/add-or-remove-machine-tags?view=o365-worldwide
Tags can be managed manually or through API.
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/add-or-remove-machine-tags?view=o365-worldwide
Yes, there are duplicates as some devices are used for testing and so are reimaged frequently. I know about adding and removing tags manually, as this is what I have done.
My question is why are seemingly untagged devices being added to a machine group that is explicitly for devices with tags.
Are the untagged devices still somehow tagged?
My question is why are seemingly untagged devices being added to a machine group that is explicitly for devices with tags.
Are the untagged devices still somehow tagged?
- I am not sure what rule you have configured for device group. If any untagged devices or newly onboarded devices matches the rules configured in device group then it will be added to machine group.
- The only rule I have set for the machine group is to add those devices with the tag to the group. The tag is the same as the machine group name. There should be 24 devices in the group, but there are 31. When I check device inventory, only 24 devices have a tag.
I have noticed that the extra devices were previously tagged (before the group was created). I am wondering why these devices, which are not tagged, should be in the group.