MDATP has the following options available for grouping:<\/p>\n\n\n\n These membership rules don’t say anything about the user, and the machine domains are all cloud native (no hybrid joins). So we need to use Tags to gain flexible targeting in MDATP.<\/p>\n\n\n\n The following PowerShell script can be scheduled as an Azure Runbook to automatically tag all your MDATP devices based on the ‘Company’ attribute of the device’s primary user. It could also be modified easily to e.g. parse a user’s group membership or UPN’s domain. <\/p>\n\n\n\n https:\/\/gitlab.com\/Lieben\/assortedFunctions\/-\/blob\/master\/set-MDATPCustomTags.ps1<\/a><\/p>\n\n\n\n If you have a lot of devices, it may take a while for the first run (beyond Azure Automation limits), in that case run it locally first and then schedule it.<\/p>\n","protected":false},"excerpt":{"rendered":" Microsoft Defender Advanced Threat Protection seems to be becoming the defacto leader in the A\/V industry, at least when Windows is concerned, but other OS’es seem to be following quickly \ud83d\ude42 At one of my international customers, many different locations and departments exist and we’d like to group devices in MDATP based on their primary … Continue reading Grouping devices in MDATP based on registered users<\/span> ![\"\"](\"https:\/\/www.lieben.nu\/liebensraum\/wp-content\/uploads\/2020\/10\/mdatp-grouping-rules.png\")
<\/a><\/figure>\n\n\n\n