Is there any way to statically assign endpoints to a group as part of an authorization result. Or any way to capture the current population of devices so new devices can be identified.
To accelerate the process of identifying new unauthorized devices in an environment, it would be useful to capture the existing population of devices as the known unknown "to be reviewed" device group. This group of devices could then be reviewed and moved into approved use cases with matching authorization rules .
Initially the default rule would be configured to assign any devices that hit it to the "to be reviewed" group.
After the existing devices have been captured in the group, a rule immediately before the default rule would be created to permit the known unknown devices. The new default rule would be used to trigger an immediate unauthorized device investigation. Many of these investigations will identify authorized devices that are not being on-boarded properly.
This would allow the "to be reviewed" group to be emptied over time. And once the unauthorized devices investigations have a low false positive rate the customer could change the default rule to a deny or guest access.
This process is dependent on capturing the initial list of grand fathered devices, and it seems that being able to statically assign endpoints to a group as part of the authorization result would be the simplest way.
