Will already onboarded in Defender devices be affected in anyway when Onboarding is turned on in Purview?

Question

Will already onboarded in Defender devices be affected in anyway when Onboarding is turned on in Purview?

Agnes Compeau 20

We are in a pilot phase of configuring Purview in our tenant. All our devices have been already onboarded in Defender. I understand that once onboarding is turn on in Purview, all already onboarded in Defender devices will automatically populate in Purview.

Is there a way to turn on Onboarding for just a pilot group of devices?

If not, will turning on onboarding, and having all devices sync up to Purview have any affect on the devices. We have couple of old policies and couple of new ones configured in Purview, will the devices get the policies applied automatically?

Again, ideal scenario would be to onboard only a handful of devices for testing purposes.

Please let me know

0 comments

2 answers

Your answer

Answer 1

Agnes Compeau 20

Thank you so much for your answer.

I took a look at the portal and it seems like we have about dozen policies, 2 in "Simulation without notification" modes and rest is turned on. All policies Admin Unit is used/assigned to full Directory >> is this was the assignment to certain group comes in? If not, where do I assign a policy to certain group of users or machines?

Peram Venkateswara Reddy 5 Reputation points Microsoft External Staff Moderator

2026-08-05T11:38:15.5366667+00:00
Hi @Agnes Compeau , Hope you are doing well.
If your devices are already onboarded to Microsoft Defender for Endpoint (MDE), enabling device onboarding in Microsoft Purview will not require those devices to be onboarded again. They will automatically appear in the Purview managed devices list because device onboarding is shared between MDE and Microsoft Purview.

Regarding impact on existing devices:

Simply enabling Device Onboarding in Purview does not automatically apply Endpoint DLP controls to devices.

Devices become available to Purview services such as Endpoint DLP and Insider Risk Management, but policy enforcement depends on the policies you have configured and deployed.

For a pilot deployment, you can scope Endpoint DLP policies to specific device groups rather than broadly applying them across all onboarded devices. Microsoft provides support for device-based policy scoping using device groups (for example, dynamic Microsoft Entra ID device groups), which is a recommended approach for testing before wider rollout.

A common approach is:

Enable device onboarding in Purview.

Create a pilot device group containing a small set of test devices.

Assign new Endpoint DLP policies only to that device group.

Validate behavior in audit or simulation mode before expanding the deployment.

So, enabling onboarding itself should mainly make your MDE-onboarded devices visible in Purview. The primary area to review carefully is the scope and enforcement mode of any existing Endpoint DLP policies before moving to production.

References:

Device onboarding overview: https://learn.microsoft.com/purview/device-onboarding-overview

Create a DLP policy using device scoping: https://learn.microsoft.com/purview/endpoint-dlp-create-policy-device-scoping

Kind Regards,
Microsoft Support Team.

Answer 2

Burak VAROL 946

Hi @Agnes Compeau ,

If your devices are already onboarded to Microsoft Defender for Endpoint, enabling device onboarding in Purview will automatically make them appear in Purview. There is currently no way to sync only a subset of those already-onboarded devices.

For a pilot deployment, the recommended approach is to scope your Endpoint DLP policies to a test group (users or devices) and run them in Audit mode first. Also, using adaptive scopes or other scoped assignments can help limit the impact to your pilot users.

Enabling onboarding itself doesn't enforce policies. However, any existing Endpoint DLP policies that are in scope for those users or devices may start applying once the devices become available in Purview.

https://learn.microsoft.com/en-us/purview/device-onboarding-overview

Regards,
Burak V.

Agnes Compeau 20 Reputation points

2026-07-31T13:38:27.9+00:00

Thank you so much for your answer.

I took a look at the portal and it seems like we have about dozen policies, 2 in "Simulation without notification" modes and rest is turned on. All policies Admin Unit is used/assigned to full Directory >> is this was the assignment to certain group comes in? If not, where do I assign a policy to certain group of users or machines?