Machine tagging in Defender

[GI472]

Hi all,

I have tagged a number of now inactive devices and added them to a machine group. But whilst I tagged 24 devices, 31 are showing up in my device group. I have tagged the 24 devices InactiveReimaged and the machine group is also InactiveReimaged. I chose to add devices to the group by using the Tag Equals InactiveReimaged option. 

I did tag and untag a couple of devices before setting up the group, as a test, but only the 24 devices are, or should be, tagged.

Any ideas on why more devices are showing up, and more importantly, how I can fix this?

[#2]

Did you see any duplicate entries in 31? Did you ever tried onboarding/ offboarding same devices more than one time? inactive entries remains in Device inventory until it's reaches the retention period.
Tags can be managed manually or through API.
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/add-or-remove-machine-tags...

[#3]

Yes, there are duplicates as some devices are used for testing and so are reimaged frequently. I know about adding and removing tags manually, as this is what I have done.

My question is why are seemingly untagged devices being added to a machine group that is explicitly for devices with tags.

Are the untagged devices still somehow tagged?

[#4]

I am not sure what rule you have configured for device group. If any untagged devices or newly onboarded devices matches the rules configured in device group then it will be added to machine group.

[#5]

The only rule I have set for the machine group is to add those devices with the tag to the group. The tag is the same as the machine group name. There should be 24 devices in the group, but there are 31. When I check device inventory, only 24 devices have a tag.

I have noticed that the extra devices were previously tagged (before the group was created). I am wondering why these devices, which are not tagged, should be in the group.