Which Devices Support Custom IoCs in Defender for Endpoint?

Why the Answer Is Correct

Custom indicators of compromise in Microsoft Defender for Endpoint are applied through device-level enforcement, so a device must both be onboarded and run a supported platform before custom IoCs can take effect. In the exhibited environment, Device1, Device2, and Device3 meet those requirements, while Device4 does not. That support boundary makes option D the only answer that lists exactly the eligible devices. Options that add Device4 or drop an eligible device are therefore too broad or too narrow.

Why the Other Options Are Wrong

Option A is wrong because it excludes Device2 and Device3, both of which can use custom IoCs in this scenario. Option B is wrong because it omits Device1 and Device3 and incorrectly includes Device4. Option C is wrong because it leaves out Device2 even though Device2 satisfies the custom IoC requirements. Option E is wrong because it treats Device4 as supported when it falls outside the Defender for Endpoint custom indicator boundary.

Community Comment Notes

Leonit recorded D as the answer and described it as "correct!", which aligns with the support requirements shown in the scenario. No other substantive community reasoning is present here, so the decisive point remains the Defender for Endpoint device-support matrix rather than vote count alone.