You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You need to implement deception rules. The solution must ensure that you can limit the scope of the rules. What should you…

The correct answer is B. device tags. When configuring a deception role there's no option to use a device group, only device tags. https://learn.microsoft.com/en-us/defender-xdr/configure-deception

Submitted by katya_ua· Apr 18, 2026

Question

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You need to implement deception rules. The solution must ensure that you can limit the scope of the rules. What should you create first?

Options

Adevice groups
Bdevice tags
Choneytoken entity tags
Dsensitive entity tags

How the community answered

(31 responses)

A
16% (5)
B
71% (22)
C
3% (1)
D
10% (3)

Explanation

When configuring a deception role there's no option to use a device group, only device tags. https://learn.microsoft.com/en-us/defender-xdr/configure-deception

Community Discussion

No community discussion yet for this question.

Full SC-200 Practice