Your company has a Microsoft $365$ tenant named contoso.com.

You purchase a Windows $11$ device named Device$1$ and create a user named User$1$ on the device.

You need to ensure that User$1$ can onboard Device$1$ to Microsoft Defender for Endpoint by using local script. The solution must use the principle of least privilege.

To which group should you add User$1$ on Device$1?$