Forum Discussion

MVP

Oct 09, 2023

Exclude Device in Defender for endpoint

In the DfE GUI on security.microsoft.com it is possible to exclude a device manually adding a justification (eg Duplicate device) and additional Notes. Now I'd like to use an API - probably the Win...

elieelkarkafi

MVP

Oct 09, 2023

pwahlmueller i think the only supported MDE APIs are as follow in the link

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api/exposed-apis-list?view=o365-worldwide#in-this-section

and from the machine action section , most of the actions are listed except the exclude device action

machineAction resource type | Microsoft Learn

I will ask in the CCP is there is a roadmap for this

pwahlmueller
MVP
Apr 08, 2024
This is what I found yet. Not fully satisfying.

https://practical365.com/handling-inactive-devices-in-microsoft-defender-for-endpoint/
PerB
Copper Contributor
Nov 28, 2023
elieelkarkafi Any update?
- elieelkarkafi
  MVP
  Nov 28, 2023
  No update yet on this API to exclude devices in MDE
lukescott
Copper Contributor
Nov 15, 2023
Hey elieelkarkafi ,

Do you have an update regarding this?

Also, is there a specific reason why the offboard machine action is OS-specific?

Kind regards,

Luke
- elieelkarkafi
  MVP
  Nov 28, 2023
  lukescott now the offboard script is available on the portal for MacOS and Linux Devices
pwahlmueller
MVP
Oct 10, 2023
Oh thank you. Would be great to hear, if there is something planned.