Microsoft Defender XDR (Defender for Endpoint decepti on) lets you plant advanced lures such as fake cached credentials on endpoints and raise incidents if an attacker tries to use them. To scope lures only to the finance machines, you first create a device group targeting those endpoints (e.g., using tags or attributes). Defender deception supports scoping rules so that planting occurs only on devices in the selected group—meeting the “finance-only” requirement.

To ensure an incident is created when the fake credentials are used, you configure a Honeytoken ac count (Identities). Honeytokens are decoy identities monitored by Microsoft Defender; any authentication attempt using these credentials generates high-fidelity alerts/incidents. After the honeytoken exists, create an advanced lure (not a basic lure) under Endpoints → Deception, select cached credentials as the lure type, associate it with the finance device group , and tie it to the honeytoken . Defender plants the decoy credentials on a random subset of targeted devices and automatically triggers incidents on attempted use—no custom detection rule required.

Thus, the correct sequence to satisfy all goals with least steps is: create device group → configure honeytoken → create advanced lure .