Unable to Create Defender for Endpoint Device Groups (Machine Groups) for Web Content Filtering Scope – Tenant Shows Defender for Business Subscription State Despite MDE Plan 2 License

Hi Team,

We are trying to configure Web Content Filtering in Microsoft Defender and scope the policy to a specific Device Group (Machine Group) instead of applying it to All devices in the organization.

As per Microsoft documentation, Device Groups can be created and managed under:

Settings → Endpoints → Permissions → Device Groups

and are supported in:

• Microsoft Defender for Endpoint Plan 1
• Microsoft Defender for Endpoint Plan 2

However, we are unable to locate the Device Groups/Machine Groups option in our tenant.

Tenant Licensing

Our tenant currently has the following licenses:

• Microsoft Defender for Business – 38 licenses
• Microsoft Defender for Endpoint Plan 1 – 1 license
• Microsoft Defender for Endpoint Plan 2 – 1 license

The user account being used for administration:

• Has the Microsoft Defender for Endpoint Plan 2 license assigned
• Has Global Administrator permissions
• Has Security Administrator permissions

Observation

Under Settings → Endpoints → Licenses, the portal displays:

Subscription State: Microsoft Defender for Business

and

All devices in the tenant will get Defender for Business protection.

We are able to create Device Groups while creating policies under:

Configuration Management → Device Configuration

For example, when creating Next-Generation Protection or Firewall policies, we can create and assign device groups.

However, these groups do not appear to be available for Web Content Filtering policy scoping.

Web Content Filtering Issue

When creating a Web Content Filtering policy:

Settings → Endpoints → Rules → Web Content Filtering

the Organizational Scope only shows:

All devices in my organization

We do not see any option to select or create Device Groups/Machine Groups as described in the Defender for Endpoint documentation.

Questions

1. Does the presence of a larger number of Defender for Business licenses cause the tenant to operate in Defender for Business mode even when Defender for Endpoint Plan 2 licenses exist?
2. Is the Subscription State = Microsoft Defender for Business the reason why the classic Defender for Endpoint Device Groups (Machine Groups) page is not available?
3. Are Device Groups created under Configuration Management → Device Configuration equivalent to Defender for Endpoint Device Groups (Machine Groups) used for Web Content Filtering scoping?
4. Can Web Content Filtering policies be scoped to Defender for Business device groups, or is the feature limited to Defender for Endpoint Device Groups?
5. What licensing or configuration changes are required to make Device Groups available for Web Content Filtering policy assignment in this tenant?

Expected Outcome

We would like to create a Device Group/Machine Group and use it to scope a Web Content Filtering policy to a subset of devices instead of applying the policy tenant-wide.

We have attached screenshots showing:

• Tenant licensing and Subscription State
• Available Device Configuration Group functionality
• Absence of Device Groups under Endpoints Permissions

Any clarification regarding how mixed Defender for Business and Defender for Endpoint Plan 2 licensing affects Device Group availability would be greatly appreciated.

Thank you.We are trying to configure Web Content Filtering in Microsoft Defender and scope the policy to a specific Device Group (Machine Group) instead of applying it to All devices in the organization.

As per Microsoft documentation, Device Groups can be created and managed under:

Settings → Endpoints → Permissions → Device Groups

and are supported in:

• Microsoft Defender for Endpoint Plan 1
• Microsoft Defender for Endpoint Plan 2

However, we are unable to locate the Device Groups/Machine Groups option in our tenant.

Tenant Licensing

Our tenant currently has the following licenses:

• Microsoft Defender for Business – 38 licenses
• Microsoft Defender for Endpoint Plan 1 – 1 license
• Microsoft Defender for Endpoint Plan 2 – 1 license

The user account being used for administration:

• Has the Microsoft Defender for Endpoint Plan 2 license assigned
• Has Global Administrator permissions
• Has Security Administrator permissions

Observation

Under Settings → Endpoints → Licenses, the portal displays:

Subscription State: Microsoft Defender for Business

and

All devices in the tenant will get Defender for Business protection.

We are able to create Device Groups while creating policies under:

Configuration Management → Device Configuration

For example, when creating Next-Generation Protection or Firewall policies, we can create and assign device groups.

However, these groups do not appear to be available for Web Content Filtering policy scoping.

Web Content Filtering Issue

When creating a Web Content Filtering policy:

Settings → Endpoints → Rules → Web Content Filtering

the Organizational Scope only shows:

All devices in my organization

We do not see any option to select or create Device Groups/Machine Groups as described in the Defender for Endpoint documentation.

Questions

1. Does the presence of a larger number of Defender for Business licenses cause the tenant to operate in Defender for Business mode even when Defender for Endpoint Plan 2 licenses exist?
2. Is the Subscription State = Microsoft Defender for Business the reason why the classic Defender for Endpoint Device Groups (Machine Groups) page is not available?
3. Are Device Groups created under Configuration Management → Device Configuration equivalent to Defender for Endpoint Device Groups (Machine Groups) used for Web Content Filtering scoping?
4. Can Web Content Filtering policies be scoped to Defender for Business device groups, or is the feature limited to Defender for Endpoint Device Groups?
5. What licensing or configuration changes are required to make Device Groups available for Web Content Filtering policy assignment in this tenant?

Expected Outcome

We would like to create a Device Group/Machine Group and use it to scope a Web Content Filtering policy to a subset of devices instead of applying the policy tenant-wide.

We have attached screenshots showing:

• Tenant licensing and Subscription State
• Available Device Configuration Group functionality
• Absence of Device Groups under Endpoints Permissions

Any clarification regarding how mixed Defender for Business and Defender for Endpoint Plan 2 licensing affects Device Group availability would be greatly appreciated.

Thank you.