Forum Discussion
Solved
Remove devices from MDATP portal
We have a couple of devices that are showing in MDATP which we would like to get rid of, however we are not in a position to run any scripts... One was registered in InTune by mistake and has been u...
neilcarden Sorry for the confusion, it's poorly labeled in ATP. Here is a screenshot of what it should look like before you run the query (it looks like you're entering the comment in the bottom "Response body" when it should be the top unlabeled input box):
Thank you,
Kate
That's very good to know, however it requires that the device is online and the offboarding can kick in. If the device is not online (e.g. decommissioned), then I guess we have to wait until it gets removed after the retention period expires for it right?
Correct. It will tidy itself up when retention expires.
I initially questioned this as I like things clean, however when the reason was explained, ie if there is a mechanism to manually remove stuff from Defender, then there is an attack surface that can leverage that mechanism and that would be bad times. Id rather have it this way than some bad actor removing everything 😉
I initially questioned this as I like things clean, however when the reason was explained, ie if there is a mechanism to manually remove stuff from Defender, then there is an attack surface that can leverage that mechanism and that would be bad times. Id rather have it this way than some bad actor removing everything 😉
