You are a global administrator in a company with a Microsoft 365 subscription with Microsoft 365 E5 licenses assigned to your users. You have Windows 10 devices that are onboarded to Microsoft Defender for Endpoint. You have created a device group, and want to configure permissions and security settings for your devices. First you create an Azure Active Directory user group. Which two actions should you do next?

Answer options:

A.In Microsoft Defender Security Center, create a role AND assign the role to your Device group
B.In Azure portal, create a RBAC role AND add your Azure AD user group to the RBAC role
C.In Security operations dashboard, select your devices AND create new tags for your devices
D.In Azure Portal, create a new security group AND add you Device group to the new security group.

Correct Answer: A 
You should create a new role in Microsoft Defender Security Center and assign it to the Azure Active Directory user group you created first (in question text). Then you must assign your device group to the new role you created. This will ensure that access to the devices will be provided using the configured settings in the role.Option B is incorrect. Granting your user group a RBAC role will not configure security settings for your devices.
Option C is incorrect. Adding tags to your devices will help you to logically group them, but this not configure the security settings.
Option D is incorrect. Adding your device group to a new security group does not make sense in this scenario, and is not the correct answer. 
Reference: 
To know more about adding roles in Microsoft Defender, please refer to the link below: 

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/user-roles?view=o365-worldwide