Daily Defender News
Aboutmerill.net
Microsoft Defender for Business
Endpoint protection

Device groups in Microsoft Defender for Business - Microsoft Defender for Business | Microsoft Learn

1 October 2026Doc update+14 / −23 lines

In brief

The article was revised with clearer descriptions of device groups, updated terminology, and refreshed create/edit policy instructions and formatting.

What Defender admins need to know

Administrators can use the updated article when managing device groups and assigning policies; no action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Device groups in Microsoft Defender for Business - Microsoft Defender for Business | Microsoft Learn

In Defender for Business, you apply policies are applied to devices through certain collections that are called device groups.

This article describes:

  • What device groups are
  • How to create device groups in Defender for Business
  • How to view an existing device group
  • What the Add All Devices option does
.

What is a device group?

A device group is a collection of devices that are grouped together because of certainbased on specified criteria, such as operating system version. Devices that meet the criteria are included in that device group, unless you exclude them. In Defender for Business, you apply policies are applied to devices by using device groups.

Defender for Business includes default device groups that you can use. The default device groups include all the devices that are onboardedyou onboard to Defender for Business. For example, there's a default device group for Windows devices. WheneverWhen you onboard Windows devices, they're addedyou automatically add them to the default device group automatically.group.

You can also create new device groups to assign policies with specific settings to certain devices. For example, you might have a firewall policy assigned to one set of Windows devices, and a different firewall policy assigned to another set of Windows devices. You can define specific device groups to use with your policies.

Note

As you create policies in Defender for Business, the system assigns an order of priority is assigned.priority. If you apply multiple policies to a given set of devices, those devices receive the first applied policy only. For more information, see Understand policy order in Defender for Business.

All device groups, including your default device groups and any custom device groups that you define, are stored in Microsoft Entra ID (Microsoft Entra ID).

Create a new device group

  1. In the navigation pane, choose Configuration management and select Device configuration.

  2. Take one of the following actions:

      • Select an existing policy, and then choose Edit.
      • Choose + Add to create a new policy.

    Tip

    To get help creating or editing a policy, see View or edit policies in Defender for Business.

  3. On the General information step,page, review the information, edit if necessary, and then choose Next.

  4. Choose + Create new group.

  5. Specify a name and description for the device group, and then choose Next.

  6. Select the devices to include in the group, and then choose Create group.

  7. In the navigation pane, choose Device configuration.

  8. Take one of the following actions:

      • Select an existing policy, and then choose Edit.
      • Choose + Add to create a new policy.

    Tip

    To get help creating or editing a policy, see View or edit policies in Defender for Business.

  9. On the General information step, review the information, edit if necessary, and then chooseselect Next.

  10. ChooseSelect Use existing group. A flyout opens and displays device groups. If you don't have any device groups yet, it prompts you're prompted to create a new device group.

What does the Add All Devices option do?

When you're creating create or editingedit a policy, you might see the Add all devices option.

Screenshot of the Add All Devices option.