Defender Device Tagging
Security automation
Designed and implemented automated device tagging to focus Microsoft Defender vulnerability views on active endpoints.
Operational · Accepted at BPC
The task
Inactive device records can make it difficult to assess the exposure of currently active endpoints.
My contribution
Designed the workflow, queried device activity with KQL and implemented the tag lifecycle through the Defender API.
Implementation
- Identify active, onboarded devices from recent activity.
- Apply tags to devices within the active scope and remove tags when they leave it.
- Use tag-based device groups to support focused vulnerability reviews.
Outcome
The workflow is operating and has been accepted at BPC. It maintains an active-device scope for security reviews.
Scope & limitations
Tagging changes the assessment scope. It does not remediate vulnerabilities or prove a reduction in the underlying exposure score.