Microsoft Defender Endpoints - When creating or editing a device group I can only select 'No automated response' in the dropdown of 'Remediation Level'

Jonah Albertijn 0

Basically as the title says. In the create or edit device group menu, my only option is to select 'No Automated Response' in the dropdown of Remediation Level. I've read that automated response should be active by default and you cannot turn it off.

My ungrouped devices has 'Full - Remediate Threats Automatically' active. If I try to edit this, my only option is 'No Automated Response' as well. This ungrouped devices group was added automatically.

Is this just a visual bug? Or is Automated Response turned of for my custom device group?

Shweta Mathur 29,751 Reputation points Microsoft Employee

2024-04-01T04:01:54.6666667+00:00

@Jonah Albertijn

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

1 answer

Shweta Mathur 29,751 Reputation points Microsoft Employee

2024-03-20T12:44:44.5666667+00:00

Hi @Jonah Albertijn ,

Thanks for reaching out.

If you are using Microsoft Defender for Endpoint P1, then it will only allow you to create Device Group, but not allow to choose any automation Level.

As mentioned https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-automated-investigations-remediation?view=o365-worldwide to configure different remediation levels you would require Microsoft Defender for Endpoint Plan 2.

Hope this will help.

Thanks,

Shweta

Please remember to "Accept Answer" if answer helped you.
Please sign in to rate this answer.
Jonah Albertijn 0 Reputation points

2024-03-21T11:16:35.8266667+00:00

Could you elaborate on why 'Ungrouped Devices', a group automatically made when creating another device group, has a different remediation level than my created group 'Leerkrachten & Personeel'? I cannot change the remediation level for either group.

Shweta Mathur 29,751 Reputation points Microsoft Employee

2024-03-22T07:05:48.8033333+00:00

Jonah Albertijn

Ungrouped devices are default group created. Devices that aren't matched to any groups are added to Ungrouped devices (default) group. You cannot change the rank of this group or delete it. However, you can change the remediation level of this group, and define the Microsoft Entra user groups that can access this group.

As mentioned above, you would require Microsoft Defender for Endpoint P2 to update remediation level.

Hope this will help.

Thanks,

Shweta

Please remember to "Accept Answer" if answer helped you.

Jonah Albertijn 0 Reputation points

2024-03-22T08:24:22.2633333+00:00

Thanks Shweta. We have Endpoint plan 1, so I guess I cannot change the remediation level. My question still remains though on why ungrouped has "full - remediate threats automatically", and my created has "no automated response" (see ref.). Is my created group at risk at the moment?

Thanks.

Shweta Mathur 29,751 Reputation points Microsoft Employee

2024-03-26T02:58:43.6466667+00:00

Jonah Albertijn

Full remediate is selected by default for ungrouped device before creating any device.

With no automated response, reduces the security posture of your organization's devices. However, other threat protection features, such as protection from potentially unwanted applications, can be in effect, depending on how your antivirus and next-generation protection features are configured but automated investigation doesn't run on your organization's devices.

Hope this will help.

Please remember to "Accept Answer" if answer helped you.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Microsoft Defender Endpoints - When creating or editing a device group I can only select 'No automated response' in the dropdown of 'Remediation Level'

1 answer

Your answer