As devices are replaced or retired, or your business needs change, you can offboard devices from Defender for Business. Offboarding a device causes the device to stop sending data to Defender for Business, and its status changes to Inactive within seven days. You don't have to offboard devices that are already listed as Inactive.
Data from a device, such as alerts, vulnerabilities, and detected threats, remains visible in the Microsoft Defender portal until the configured retention period expires (usually 180 days).
Devices that weren't active within the last 30 days aren't factored into your organization's exposure score.
What to do
Select one of the following tabs:
- Windows 10 or 11
- Mac
- Servers (Windows Server or Linux Server)
- Mobile (for iOS/iPadOS or Android devices)
Follow the guidance on the selected tab.
Proceed to your next steps.
Windows 10 or 11
Go to the Microsoft Defender portal (https://security.microsoft.com) and sign in.
In the navigation pane, choose Settings, and then choose Endpoints.
Under Device management, choose Offboarding.
Select an operating system, such as Windows 10 and 11, and then, under Offboard a device, in the Deployment method section, choose Local script.
In the confirmation screen, review the information, and then choose Download to proceed.
Select Download offboarding package. We recommend saving the offboarding package to a removable drive.
Run the script on each device that you want to offboard.
Mac
Go to the Microsoft Defender portal (https://security.microsoft.com) and sign in.
In the navigation pane, choose Settings, and then choose Endpoints.
Under Device management, choose Offboarding.
In the Select operating system to start the offboarding process list, select macOS.
In the Deployment method section, select either Local Script or Mobile Device Management / Microsoft Intune, depending on your preferred method.
Select Download package. We recommend saving the offboarding package to a removable drive.
Run the script on each Mac computer that you want to offboard.
Servers
Choose the operating system for your server:
Windows Server
Go to the Microsoft Defender portal (https://security.microsoft.com), and sign in.
In the navigation pane, choose Settings > Endpoints, and then under Device management, choose Offboarding.
Select an operating system, such as Windows Server 1803, 2019, and 2022, and then in the Deployment method section, choose Local script.
Select Download package. We recommend that you save the offboarding package to a removable drive. The zipped folder will be called WindowsDefenderATPOffboardingPackage_valid_until_YYYY-MM-DD.zip (where YYYY-MM-DD is the expiry date of the package).
On your Windows Server device, extract the contents of the zipped folder to a ___location such as the Desktop folder.
Open a command prompt as an administrator.
Type the ___location of the script file. For example, if you copied the file to the Desktop folder, you would type %userprofile%\Desktop\WindowsDefenderATPOffboardingScript_valid_until_2022-11-11.cmd (where YYYY-MM-DD is the expiry date of the package), and then press Enter (or select OK).
Linux Server
Go to the Microsoft Defender portal (https://security.microsoft.com), and sign in.
In the navigation pane, choose Settings > Endpoints, and then under Device management, choose Offboarding.
Select Linux Server for the operating system, and then in the Deployment method section, choose Local script.
Select Download package. We recommend that you save the offboarding package to a removable drive. The zipped folder will be called WindowsDefenderATPOffboardingPackage_valid_until_YYYY-MM-DD.zip (where YYYY-MM-DD is the expiry date of the package).
On your Linux Server device, extract the contents of the zipped folder to a ___location such as the Desktop folder.
Open a terminal, and navigate to the directory where the MicrosoftDefenderATPOffboardingLinuxServer_valid_until_YYYY-MM-DD file (where YYYY-MM-DD is the expiry date of the file) is located.
Type python MicrosoftDefenderATPOffboardingLinuxServer_valid_until_YYYY-MM-DD.py in the terminal.
Tip
For more information, see Uninstall in the Microsoft Defender for Endpoint on Linux guidance.
Next steps