Press "Enter" to skip to content

Offboard Obsolete Machines from Microsoft Defender for Endpoint

Published August 2, 2021 by Amit Malik
133

Microsoft Defender for Endpoint (formerly known as Defender ATP) allows you to onboard and offboard devices using various tools such as Microsoft Endpoint Manager, Group Policies or through a custom script.

This works great when your device is still accessible, however what if the device is no longer managed by your organization’s MEM or other configuration management tool? This happens a lot in BYOD scenarios, where once an employee leaves the organization, they just remove the Azure AD Join association without offboarding the device from Defender.

Ideally, there should be an option to automatically offboard the machines from Defender during the disjoining from Azure AD Process. It may be possible that Microsoft is already working on it, until then you can use this method to remove the offboard the devices from Defender ATP using API.

Let’s get started, it is assumed that you have the required permissions (Global Admin or others) to offboard devices.

Steps to Offboard Obsolete Devices

  1. Login to Defender for Endpoint admin center. ( https://securitycenter.windows.com/ ) or the new M365 security center (https://security.microsoft.com)
  2. Under devices, find the device you want to offboard. Click on the device name to open the device page.
  3. Once you open the device page, you will find a device id in the URL. In below example, the highlighted value is the device ID. Make a note of this device id.

https://securitycenter.windows.com/machines/5e2a880e05a9f035ff5976b19589c21681e02d22/overview or https://security.microsoft.com/machines/v2/ 5e2a880e05a9f035ff5976b19589c21681e02d22

4. Please note that this device id is different than the Azure AD device ID.

5. In Defender admin center, navigate to Partners & API > API Explorer .

6. In the API explorer, change the API call type to Post and enter following URL. Be sure to replace the device id with actual device id copied in previous step.

POST https://api.securitycenter.microsoft.com/api/machines/enterdeviceidhere/offboard

7. In Body area, enter following JSON data.

               {“Comment”: “Offboard machine by automation”}

8.. Click Run Query, if you get a 200 response, the request for offboarding is submitted. In case of any errors, you will see the details in output.

9. It may take few hours (to few days in some cases) for offboarding to complete. If you try to run the API call again, you should see the error message stating that offboarding request already exists.

You can offboard as many devices as you want with this method. You can look at using automation scripts to this programmatically and authenticate using a Service Principal.

That’s it.

Amit Malik

Amit Malik

Published in Microsoft 365 and Uncategorized

  1. TheGift73 TheGift73

    Incase anyone gets an error saying the Request Comment was incorrect, try changing the quotation marks (“) that wrap the Offboard machine by automation to single quotations instead, so it looks like below:

    {‘Comment’: ‘Offboard machine by automation’}

    Reply
  2. My Homepage My Homepage

    … [Trackback]

    […] Read More: amitmalik.net/defender-for-endpoint-delete-device/ […]

    Reply
  3. My Site My Site

    Such great website

    Amazing blog thanks for sharing today on this blog

    Reply
  4. Zimue Zimue

    Can somebody tell me what i am doing wrong i entered the URL with my device ID and under the request body i entered the same as you above (also tried the Reply from TheGift73 still get the following

    Failure – Status code 400, 58ms
    {
    “error”: {
    “code”: “InvalidRequestBody”,
    “message”: “Request body is incorrect”,
    “target”: “3186017d-dcfe-496f-b702-54e991251bed”
    }
    }

    Reply
  5. Browser MMORPG Browser MMORPG

    Fantasy MMORPG

    Skidson is the best top online MMO RPG based on Adventure Quest Worlds

    Reply
  6. Fantasy MMORPG Fantasy MMORPG

    Browser MMORPG

    Skidson is the greatest fastest browser MMO RPG based on Adventure Quest Worlds

    Reply
  7. Fantasy MMORPG Fantasy MMORPG

    Browser MMORPG

    Skidson.Online is the greatest smoothest fantasy MMO based on AdventureQuest Worlds

    Reply
  8. Fantasy MMORPG Fantasy MMORPG

    Browser MMORPG

    Skidson.Online is the greatest fastest fantasy MMO RPG based on Adventure Quest Worlds

    Reply
  9. Fantasy MMORPG Fantasy MMORPG

    Browser MMORPG

    Skidson is the best free to play online MMO RPG based on AQWorlds

    Reply
  11. Fantasy MMORPG Fantasy MMORPG

    Browser MMORPG

    Skidson is the greatest fastest online MMO RPG based on AdventureQuest Worlds

    Reply
  12. Browser MMORPG Browser MMORPG

    Fantasy MMORPG

    Skidson.Online is the greatest top online MMORPG based on AdventureQuest Worlds

    Reply
  13. Free Hosting Free Hosting

    Free VPS

    Looking for cheap virtual private server and web hosting? Look no further, here is the best place to host your website or application.

    Reply
  14. MMORPG MMORPG

    AQWorlds Server

    Probably the best AQW Private Server in existence, best Browser MMORPG game on the planet, join NOW.

    Reply
  15. MMORPG MMORPG

    Fantasy MMORPG

    Simply the best AQW Private Server in existence, top MMORPG online game on the planet, join NOW.

    Reply
  16. Free MMORPG Free MMORPG

    AQW Server

    Probably the best AQW Server in existence, top Fantasy MMORPG online game on the universe, join today!

    Reply
  31. FFXIV Gil for sale FFXIV Gil for sale

    … [Trackback]

    […] Read More on on that Topic: amitmalik.net/defender-for-endpoint-delete-device/ […]

    Reply
  33. enterprise seo saas enterprise seo saas

    … [Trackback]

    […] Info to that Topic: amitmalik.net/defender-for-endpoint-delete-device/ […]

    Reply
  35. canadian pharmacys canadian pharmacys

    canadian pharmacy online 24 pinshape.com/users/2441621-canadian-pharmaceutical-companies

    Regards. Loads of write ups!

    Reply
  37. Ritik Ritik

    Aewsome post and the information shared by the author is really helpful for everyone…..

    Reply
  54. 온라인카지노 온라인카지노

    My male boss scolded me because I didn’t do a good job. I was sad that day because I had done a lot before going to work. then he won’t be able to appreciate everything I did. I lost all my sadness when I saw your site, it’s so beautiful and amazing.

    Reply
  116. totosite totosite

    I’ve been looking for photos and articles on this topic over the past few days due to a school assignment, totosite and I’m really happy to find a post with the material I was looking for! I bookmark and will come often! Thanks 😀

    Reply
  118. majorsite majorsite

    Your article has answered the question I was wondering about! I would like to write a thesis on this subject, but I would like you to give your opinion once 😀 majorsite

    Reply
  120. jason jason

    format it like this:

    {
    “Comment”: “Offboard device by whateveryouwanthere”
    }

    Reply
  121. majorsite majorsite

    I’ve been searching for hours on this topic and finally found your post. majorsite, I have read your post and I am very impressed. We prefer your opinion and will visit this site frequently to refer to your opinion. When would you like to visit my site?

    Reply
  122. bitcoincasino bitcoincasino

    First of all, thank you for your post. bitcoincasino Your posts are neatly organized with the information I want, so there are plenty of resources to reference. I bookmark this site and will find your posts frequently in the future. Thanks again ^^

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *