Forum Discussion
offboarding
I discovered Windows 10 devices that have been integrated into our company's MS 365 Defender but have no connection to us; they originate from a different domain, how can I remove it.
I tried API, and isolate but no luck
- When you say you tried the API but 'no luck', what does that mean? If you use the API, the instruction to offboard is queued in the cloud and waits for the machine to check in and pick up the instruction. After the machine offboards, the device data will still show in the console until it ages out, so possibly the offboarding worked, check and see if you are still getting data from them.
- The devices still active, and last seen date is the date before run API.
- There's a offboarding script that you could run or the other alternative method is to find the SENSE registry keys that you would need to remove from each device.
Hope this helps
