{"id":8229,"date":"2024-09-12T10:39:42","date_gmt":"2024-09-12T02:39:42","guid":{"rendered":"https:\/\/www.jameseduard.com\/?p=8229"},"modified":"2024-09-12T10:39:42","modified_gmt":"2024-09-12T02:39:42","slug":"how-to-offboard-a-device-via-microsoft-defender-for-endpoint-api-explorer","status":"publish","type":"post","link":"https:\/\/www.jameseduard.com\/?p=8229","title":{"rendered":"How to Offboard a Device via Microsoft Defender for Endpoint API Explorer"},"content":{"rendered":"\n\n\n<p class=\"wp-block-paragraph\">Offboarding a device from Microsoft Defender for Endpoint can be essential for various reasons, such as decommissioning a device or troubleshooting. This guide will walk you through the steps to offboard a device using the Defender for Endpoint API Explorer.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Prerequisites<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Before you begin, ensure you have the following:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Permissions<\/strong>: You need to have either Security Administrator or Global Administrator permissions.<\/li>\n\n\n\n<li><strong>Device ID<\/strong>: The unique identifier for the device you want to offboard.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Steps to Offboard a Device<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Log in to the Security Center<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Navigate to&nbsp;<a is=\"cib-link\" href=\"https:\/\/security.microsoft.com\/\" target=\"_blank\" rel=\"noreferrer noopener\">Microsoft Security Center<\/a>&nbsp;and log in with an account that has the necessary permissions.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Locate the Device<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to the&nbsp;<strong>Devices<\/strong>&nbsp;section.<\/li>\n\n\n\n<li>Find and click on the device you want to offboard.<\/li>\n\n\n\n<li>Copy the&nbsp;<strong>Device ID<\/strong>&nbsp;from the URL. It is typically a 40-digit alphanumeric string.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Access API Explorer<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>In the left pane, navigate to&nbsp;<strong>Partners and APIs<\/strong>&nbsp;and then select&nbsp;<strong>API Explorer<\/strong>.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Set Up the API Request:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Change the HTTP method to&nbsp;<code>POST<\/code>.<\/li>\n\n\n\n<li>Enter the following URL in the API Explorer:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"\">https:\/\/api.securitycenter.microsoft.com\/api\/machines\/{DeviceID}\/offboard<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Replace\u00a0<code>{DeviceID}<\/code>\u00a0with the actual Device ID you copied earlier.<br><\/p>\n\n\n\n<figure class=\"wp-block-gallery aligncenter has-nested-images columns-default is-cropped wp-block-gallery-1 is-layout-flex wp-block-gallery-is-layout-flex\">\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" data-id=\"8244\" src=\"https:\/\/www.jameseduard.com\/wp-content\/uploads\/2024\/09\/image-2-1050x550.png\" alt=\"\" class=\"wp-image-8244\"\/><\/figure>\n<\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Add Request Body<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>In the request body, add the following JSON object:<\/li>\n\n\n\n<li>Note that the&nbsp;Comment&nbsp;field is case-sensitive.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"\">{\n  \"Comment\": \"Offboard machine by automation\"\n}\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Run the Query<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Click on&nbsp;<strong>Run Query<\/strong>&nbsp;to execute the offboarding process.<\/li>\n\n\n\n<li>If successful, the device will start the offboarding process.&nbsp;If the device is already in the process of being offboarded, you might receive an error indicating that an active request already exists.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Important Considerations<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Retention Period<\/strong>: Offboarded devices may remain in your device inventory for up to 180 days.&nbsp;During this period, they will not contribute to tenant-wide calculations or secure scores.<\/li>\n\n\n\n<li><strong>Permissions<\/strong>: Ensure that the account used has the appropriate permissions to avoid errors during the process.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">By following these steps, you can efficiently offboard a device from Microsoft Defender for Endpoint using the API Explorer. This method is particularly useful when you do not have direct access to the device but need to ensure it is properly offboarded from your security environment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Feel free to share your experiences or any additional tips in the comments below!<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">I hope this guide helps you with offboarding devices via the Defender for Endpoint API Explorer. If you have any questions or run into issues, don\u2019t hesitate to ask!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Reference:<br><a href=\"https:\/\/learn.microsoft.com\/en-us\/defender-endpoint\/api\/offboard-machine-api?view=o365-worldwide\">Offboard machine API &#8211; Microsoft Defender for Endpoint | Microsoft Learn<\/a><br><a href=\"https:\/\/learn.microsoft.com\/en-us\/defender-endpoint\/api\/apis-intro?view=o365-worldwide\">Access the Microsoft Defender for Endpoint APIs &#8211; Microsoft Defender for Endpoint | Microsoft Learn<\/a><br><a href=\"https:\/\/learn.microsoft.com\/en-us\/defender-endpoint\/api\/exposed-apis-create-app-webapp?view=o365-worldwide\">Create an app to access Microsoft Defender for Endpoint without a user &#8211; Microsoft Defender for Endpoint | Microsoft Learn<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>Offboarding a device from Microsoft Defender for Endpoint can be essential for various reasons, such as decommissioning a device or troubleshooting. This guide will walk you through the steps to offboard a device using the Defender for Endpoint API Explorer. Prerequisites Before you begin, ensure you have the following: Steps to Offboard a Device Log<\/p>\n","protected":false},"author":1,"featured_media":8164,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[52,47,892,979],"tags":[1014,1015,1016,1017,1018,1019],"class_list":["post-8229","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops","category-how-tos","category-microsoft-defender","category-windows-defender","tag-api-explorer","tag-cybersecurity-automation","tag-endpoint-protection","tag-endpoint-security","tag-microsoft-defender-for-endpoint","tag-security-management"],"_links":{"self":[{"href":"https:\/\/www.jameseduard.com\/index.php?rest_route=\/wp\/v2\/posts\/8229","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jameseduard.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jameseduard.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jameseduard.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jameseduard.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8229"}],"version-history":[{"count":0,"href":"https:\/\/www.jameseduard.com\/index.php?rest_route=\/wp\/v2\/posts\/8229\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.jameseduard.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8229"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jameseduard.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8229"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jameseduard.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8229"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}