Automating tags to new onboarded servers in Defender

Question

We have created the MDE Management tag to onboard servers from the Defender portal to the Intune portal for scheduled AV weekly scanning. Currently, the MDE Management tag must be assigned manually to each server. Only after this manual assignment do the

Answer 1

Dear @Purna Durgarao Sugandhapu

There are now two supported methods to automate assignment of the MDE-Management tag.

The first is Dynamic Asset Rules in the Microsoft Defender portal. These rules can automatically assign the tag based on device attributes, making them a good fit for larger environments where newly onboarded servers should be included without manual intervention.

The second option is registry-based tagging on Windows servers by configuring the supported DeviceTagging policy and setting the Group value to MDE-Management. This approach is particularly useful if registry settings are already being deployed through Group Policy, Configuration Manager, or another configuration management solution.

For Security Settings Management, Microsoft continues to recommend enabling the enforcement scope for On tagged devices and using the MDE-Management tag to target an initial pilot group. Once you've confirmed that policies are being applied as expected, you can gradually expand the deployment by automating tag assignment through either of the supported methods.

Microsoft offical guide: Create and manage device tags and target devices

---

If this answers your query, please click Accept Answer and Upvote if you found it helpful. If you have any further questions, feel free to let us know.

Answer 2

For MDE-Management, manual tagging is no longer the only option.

Two supported approaches are available:

1. Dynamic rules in Defender
   • Device tags can be assigned automatically by creating dynamic rules in the Defender portal.
   • This is supported for device tagging generally, and for MDE-Management specifically, dynamic asset rules are supported for defining the devices in that tag in public preview.
   • This is the best fit for automatically tagging newly onboarded servers based on device properties instead of assigning the tag one server at a time.
2. Registry-based tagging on Windows servers
   • On Windows, a tag can be set by configuring: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection\DeviceTagging\
   • Create a REG_SZ value named Group and set it to the tag name, for example MDE-Management.
   • Tag length can be up to 200 characters.
   • Tags sync once daily; restarting the device triggers immediate sync.
   • To remove the tag, clear the value data instead of deleting the Group key.
   • Warning: registry changes can affect device configuration. Validate on a small pilot group first.

For the Intune security settings management scenario, the recommended rollout is:

1. In the Microsoft Defender portal, go to Settings > Endpoints > Configuration Management > Enforcement Scope.
2. Enable the relevant platform for security settings management.
3. Select On tagged devices.
4. Use the MDE-Management tag for the pilot scope.
5. Automate assignment of that tag by using dynamic rules or Windows tagging through the registry.

Additional points from the documented behavior:

• Microsoft recommends starting with On tagged devices and using the MDE-Management tag to validate rollout on a small number of devices.
• Most devices enroll and apply policy within a few minutes, but some can take up to 24 hours.
• Automating the Enforcement Scope setting itself through API is not supported.

---

• Create and manage device tags and target devices
• Learn how to use Intune endpoint security policies to manage Microsoft Defender for Endpoint on devices that are not enrolled with Intune
• Defender Enforcement Scope API - Microsoft Q&A