0

For one of our client we have onboarded 500+ custom detection rules in Microsoft Defender, as they were migrating from another EDR solution to Defender. Now client ask is, they have created a new device group/organizational scope for testing rules and for all 500+ rules they are expecting us to change the device group as the new one they have onboarded now.

Is there any way we can change or update the device group/organizational scope in one go for all 500+ rules, any PowerShell script or automation that can help us achieve this?

Improve this question
2
  • Hi Manisha, Just for my understanding - Why didn't they opt to edit the already existing groups/ organization scope that has been configured for the earlier detection rules? Commented Apr 28 at 5:33
  • Hi @CatherineKyalo, they wanted to test Defender capability over the production rules from previous EDR. Commented Jul 5 at 7:31
Load 5 more related questions Show fewer related questions

0

Reset to default

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.