Clear all Device tags in ATP Portal

Question

Is there a way to clear all tags in the ATP portal?&nbsp; Right now I only see ways of doing it device by device (in portal and via API).&nbsp; We're instituting new tags and need to remove the old ones.

thijs lecomte · Answer

There is no quick way to do this through the portal.You could script this through the API though.You can write a script which retrieves the current tags and deletes them one by one

alexandertuvstrom · Answer

slundy99&nbsp;&nbsp;You can&nbsp;use Microsoft Flow&nbsp;to talk to the APIs, but you can get similar results with other tools like Logic Apps to automate machine tagging as well.&nbsp;Blog post from the Defender ATP team:https://techcommunity.microsoft.com/t5/microsoft-defender-atp/automated-machine-tagging-in-just-a-few-simple-steps/ba-p/309377

slundy99 · Answer

alexandertuvstrom&nbsp;Love the idea, but the advanced hunting requires premium access.&nbsp; I can do the free trial, but w/o being very knowledgeable in this I worry I'd waste the week just figuring out how to do what is required for what I need.&nbsp; I'll have to figure out the script option.&nbsp; Is there an api reference for ATP anywhere I can look at?&nbsp; I'll search but wanted to ask here as well.

alexandertuvstrom · Answer

slundy99&nbsp;Oh, I understand. The API access requires OAuth2.0 authentication so&nbsp;you’ll need to take the following steps to use the APIs:Create an AAD applicationGet an access token using this applicationUse the token to access Microsoft Defender ATP APIAssign the desired permission to the applicationMicrosoft&nbsp;defender ATP API reference:&nbsp;https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags&nbsp;&nbsp;

alexandertuvstrom · Answer

slundy99&nbsp;I found a good script example from anthonws on GitHub:&nbsp;https://github.com/anthonws/MDATP_PoSh_Scripts/blob/master/API/API_Tag_Sample.ps1

Forum Discussion

Clear all Device tags in ATP Portal

5 Replies

Resources