Containing unmanaged Devices in Defender
For a long time we have been able to isolate onboarded devices in Microsoft Defender for Endpoint. But if a device is not onboarded we could not take any response actions to an eventual threat.
Microsoft has released a feature called Contain device which basically makes the opposite, instead of isolating the compromised device, we can tell all managed devices that they cannot communicate with the specific unmanaged device.
If a contained device changes IP address, the blocking will be updated and changed to the new IP address and the old will be “released” from block.