Similarly with Windows endpoints, in Defender for Endpoint for Linux, one of the key states to understand about your endpoints is, the offboarding state. In this state, machines are no longer reporting MDE telemetry to Defender portal and if another AV/AM solution is in place, the Defender Antivirus component needs to be switched to a passive mode to prevent performance issues at the endpoint if two AV solutions are running in active mode.
There are certain instances when a machine or machines are offboarded that the corresponding status takes an unusual amount of time to report in the Defender portal.
The status that is shown in the...
Updated Jan 21, 2026
Version 1.0
edgarus71
Microsoft
Microsoft