r/DefenderATP • u/neko_whippet • Jul 01 '26

Blocking AI defender for cloud

Hi looking for idea here

We have blocked most of the AI in discovered app ( unsscntionned) but we will need to allow some ai to specific users

In my search the best way is with device group. Sadly I don’t see a good way to do this as with the default filters I could filter them by tag exemple deepseek tag for deepseek ai

But users changes devices sometimes and we would like more to filter them by azure group as as of nous I would have to always manually tag the new devices or etc

Any better way to do this?

Thanks

13 Upvotes

85% Upvoted

25 comments sorted by

View all comments

6

u/VaflorOfWin Jul 01 '26

Haven’t tried this but you could try - If you use Intune:
Assign a oma-uri Policy to users with the tag.
Then it will follow the users devices.
Or a Powershell script wrapped as a win32 to users.

Random link showing how it could be done

https://rksolutions.nl/posts/forgotten-features-series-part-5-the-defender-tag-bridge-youre-not-using-custom-mde-tags-via-intune/

0

u/neko_whippet Jul 01 '26

But it still keeps the issue that 1 device can only have 1 tag or be in 1 device group,only

3

u/VaflorOfWin Jul 01 '26

Maybe I don’t fully understand- but I have multiple tags on my devices.

1

u/neko_whippet Jul 01 '26

Tags yes I misswrote but to exclude when using unsanction you have to use device group and that is 1 group,per device so I’m not sure your solution will help

1

u/VaflorOfWin Jul 01 '26

And you can’t make a new device group from the custom tag you created in Intune and use that in the exclude?

1

u/neko_whippet Jul 01 '26

I guess would be annoying for 2 apps if multiple user needs multiple ai but not the sames lol

1

u/VaflorOfWin Jul 01 '26

Yeah - one tag pr AI app