Forum Discussion
MDE Community
Hi MDE Community,
I have question related Microsoft defender for endpoint after offboarding or renamed device, And these device changed status to inactive. How to force remove/delete endpoint from device inventory?
NY_Dina It's been asked before - the MDE inventory is immutable
Don't onboard anything that you don't want hanging around - forever
If needed, spin up a demo/trial Tenant and test things there
5 Replies
Hello,
Sorry to hijack this thread but I don't find how to open one.
On MDE (Microsoft Defender for Endpoints), what's the link between link and email meaning?
Only one of the two users clicked on the link (as per UrlClicked table) but link was present on the 3 mails. That's why I'm confused about the graph link being with 2 out of 3 email entity.
Can anyone clarify please?
- HeikeRitter
Microsoft
Offboarded devices will remain in the tenant until the retention policy deletes them. This is because you want the data in there for hunting across historical data. You can use filters in your device inventory, to only show onboarded devices.- Actually we have offboarded devices even our retention policy 180 days, Does device will remove from device inventory as the same retention policy? If like that don't anyway to force remove before retention policy because sometime it's seem messy on MDE portal. Thank you
yongrheemsftHi NY_Dina, please review the section named "Decommissioned machines" in the following blog post:
How to use tagging effectively (Part 1)
https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/how-to-use-tagging-effectively-part-1/ba-p/1964058
Thanks,
Yong Rhee
NY_Dina It's been asked before - the MDE inventory is immutable
Don't onboard anything that you don't want hanging around - forever
If needed, spin up a demo/trial Tenant and test things there
