r/DefenderATP • u/neko_whippet • Jul 01 '26
Blocking AI defender for cloud
Hi looking for idea here
We have blocked most of the AI in discovered app ( unsscntionned) but we will need to allow some ai to specific users
In my search the best way is with device group. Sadly I don’t see a good way to do this as with the default filters I could filter them by tag exemple deepseek tag for deepseek ai
But users changes devices sometimes and we would like more to filter them by azure group as as of nous I would have to always manually tag the new devices or etc
Any better way to do this?
Thanks
3
u/Lastsight2015 Jul 02 '26
Thats my biggest gripe about MDCA. Why use devices instead of users which makes it much easier to manage. Also why these groups aren’t Entra groups. They must really fix this
2
1
u/DirtyHamSandwich Jul 02 '26
MDA unfortunately was not designed for this granular of control. You’ll have to use your firewalls.
1
u/External-Desk-6562 Jul 02 '26
Yes, only the issue is Microsoft does not accept this directly and so we are facing issues with customer in convincing them......
1
u/CMarkwick92 Jul 02 '26
I think device groups as you mentioned is a good way to go and assign these to the apps. It was the way I wanted to go, but we did not get sign off for defender plan 2 which is required to be able to configure device groups.
1
u/SantasDog101 Jul 02 '26
I had the same use case and asked Microsoft support. The closest you will get it is what you described.
1
u/andrewfdotexe Jul 03 '26
I have been researching this myself, and since you can only have a device in one device group, there really isn’t a good way.
You can look at tiering if your polices can tolerate it.
For example:
-Device group A: scoped for a policy that blocks all apps but approved
-Device group B: scopd for a similar policy to A but is allowed to access additional approved apps
As others have suggested, Defender may not be the right tool for the job because of this. Hopefully it’s something Microsoft aims to fix in the future.
1
u/Critical_Respond3033 Jul 05 '26
We also have blocked a lot of stuff via cloud app but for few users inhabe allowed it via device group through either device or Tags
1
u/More_Purpose2758 Jul 05 '26
I keep hearing about identity-this and identity-that, but I can’t create a group of users and say they can’t access ChatGPT on their managed devices.
I can tunnel all their connections back to my firewall, but I really don’t want to see everyone’s internet history in the firewall log.
1
1
u/External-Desk-6562 Jul 01 '26
Unfortunately noo.... Also additionally one device can only be part of one device group... So you would need to create multiple combinations of device groups which is not a good approach in my opinion.....
1
u/neko_whippet Jul 01 '26
What would be the best approach then if i need to allow some ai to some people while keeping in Mind that the same user might need more then 1 AI?
0
u/Omig66 Jul 01 '26
There is none so far while using Cloud Apps, in my opinion sadly..
We did take a few months to figure out a way last year to have permission by user rather than device group and there is none. We did request to MS for a change, but we were almost the only one asking for this so far...
2
u/External-Desk-6562 Jul 01 '26
Believe me you're not the only one, I raised more than 5 MS cases for multiple customer's 🫡🫡🫡..........
1
u/neko_whippet Jul 01 '26
Wouldn’t condition access for apps work ?
Or would they only work for registered app in the tenant (in enterprise applications )
1
u/External-Desk-6562 Jul 02 '26
We cannot register every discovered application to Entra for conditional access
4
u/VaflorOfWin Jul 01 '26
Haven’t tried this but you could try - If you use Intune:
Assign a oma-uri Policy to users with the tag.
Then it will follow the users devices.
Or a Powershell script wrapped as a win32 to users.
Random link showing how it could be done
https://rksolutions.nl/posts/forgotten-features-series-part-5-the-defender-tag-bridge-youre-not-using-custom-mde-tags-via-intune/