You have 500 on-premises devices. You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. You onboard 100 devices to Microsoft…

To restrict network discovery to a specific subset of onboarded devices in Microsoft Defender for Endpoint, the designated method is to use device tags. The process involves creating a unique tag, applying that tag to the devices you want to perform discovery, and then configuring the Standard discovery settings to only use devices with that specific tag. Therefore, creating the tag is the necessary first step before it can be applied to devices and used in the discovery configuration.

A. Set Discovery mode to Basic:

This enables passive discovery on all eligible devices; it does not allow you to select which specific devices perform the discovery.

B. Create a device group:

Device groups are primarily used for role-based access control (RBAC) and applying policies, not for designating which devices perform discovery.

D. Create an exclusion:

Exclusions are used to prevent the discovery of devices within specified IP ranges or subnets, which is contrary to the goal of identifying unmanaged devices.

---

1. Microsoft Learn

"Configure device discovery": Under the "Standard discovery" section

the documentation states

"You can select the devices that will perform standard discovery by specifying device tags. Note: Only devices with the specified tags will perform standard discovery." This confirms that tagging is the mechanism to control which devices perform discovery

making the creation of a tag the logical first step.

2. Microsoft Learn

"Device discovery overview": This document explains the discovery methods. It clarifies that for Standard (active) discovery

"You can customize the list of devices that perform this discovery. You can enable standard discovery on a specific set of devices by specifying their device tags." This reinforces that the control mechanism is tagging.

3. Microsoft Learn

"Create and manage device tags": This page details the process of creating a tag in the Microsoft Defender portal. It outlines that a tag must first be created before it can be added to a device

establishing the correct sequence of operations required by the question.