Security Policy Errors

How to Create a Dynamic Security Group for Devices with Defender for Endpoint

Aamir Naveed Akram Oct 10, 2026 869 views

Question details

The user needs to create a Microsoft Entra dynamic security group that automatically contains devices where Microsoft Defender for Endpoint has been installed either manually or through Intune.

Create a Dynamic Security Group for Devices with Defender for Endpoint

Product: Microsoft Entra ID / Intune
Device & OS: not provided
Scenario: Grouping managed devices automatically based on the presence of Microsoft Defender for Endpoint to streamline security policies.
Observed behavior: Device installation status for Defender is not natively available as a direct dynamic-group attribute, requiring alternative device properties, tagging, or support assistance to formulate the query.

Before you start

Ensure you are signed in with Global Administrator or Intune Administrator privileges in your Microsoft 365 tenant, and have access to the Microsoft Entra and Intune admin centers.

Solution 1Recommended

Use Intune Device Tags or Extension Attributes

Since direct software installation status isn't available as a dynamic attribute, assign a specific device tag or extension attribute in Intune to Defender-enrolled devices to populate the dynamic group.

Microsoft Entra dynamic groups do not currently support direct querying of installed applications like Defender for Endpoint. The most reliable workaround is to use Intune to assign a custom category, scope tag, or extension attribute to these devices, and then build the dynamic group rule around that property.

Assign a property to devices

Sign in to the Microsoft Intune admin center. Assign a specific extension attribute or device category (e.g., 'DefenderEnrolled') to the devices that have Microsoft Defender for Endpoint installed.

Navigate to Microsoft Entra Groups

Go to the Microsoft Entra admin center, select 'Groups' from the left menu, and click on 'New group'.

Configure group settings

Enter a group name, set the Membership type to 'Dynamic Device', and click on 'Add dynamic query'.

Create the dynamic rule

Configure the rule syntax to match the property you set in Intune (for example, '(device.extensionAttribute1 -eq "DefenderEnrolled")'). Save the query and create the group.

Use Intune Device Tags or Extension Attributes

Processing Time: Dynamic group rules can take up to 24 hours to fully populate depending on the size of your tenant and device count.

Solution 2

Open a Microsoft 365 Support Ticket

If standard tagging approaches do not meet your compliance requirements, contact Microsoft Support to identify the best supported query approach for your specific tenant.

Free Microsoft Office alternative

Enhance Your Productivity with WPS Office

While you manage your organization's security groups and device deployments, streamline your daily document tasks with WPS Office. It provides a lightweight, enterprise-friendly, and cost-effective solution for teams needing reliable office software.

1. Download the Installer: Visit the official WPS Office website and click the free download button.
2. Install on your Device: Run the lightweight installer and follow the simple on-screen instructions.
3. Edit Seamlessly: Open WPS Office and instantly start working on your existing Microsoft Office documents without formatting loss.

Fully compatible with Microsoft Word, Excel, and PowerPoint formatsLightweight installation ideal for Intune-managed endpoint deploymentsFamiliar user interface reduces training time for employeesFree alternative to help organizations reduce software licensing costs

microsoft office alternative - wps office

Frequently Asked Questions

Can I query Defender for Endpoint installation status directly in Entra dynamic groups?

No, specific software installation status, including Microsoft Defender for Endpoint, is not currently available as a direct dynamic-group attribute in Microsoft Entra. You must use workarounds such as device extension attributes or Intune device categories.

What permissions are required to create a dynamic device group?

You need to be signed in as a Global Administrator, Intune Administrator, or Groups Administrator in Microsoft Entra ID to create and manage dynamic device groups.

How long does it take for a dynamic group to update its device membership?

Dynamic group membership processing typically completes within a few minutes, but it can take up to 24 hours depending on the size of your Azure AD tenant and the complexity of the dynamic rules.

Can I mix dynamic device rules and dynamic user rules in one group?

No, Microsoft Entra dynamic groups support either dynamic devices or dynamic users exclusively. You cannot combine user attributes and device attributes in a single group.

Microsoft Office Security Issues