Forum Discussion
Remove from security portal
Hello! This may be a really stupid question. We have a device which keeps popping up in the Defender portal as having hack tools installed. We believe this belonged to an old consultant and s...
You could try to offboard the device via API explorer through the Defender portal.
First get the device Id in Defender XDR of that device, either by going to the device page or using API (https://learn.microsoft.com/en-us/defender-endpoint/api/get-machines).
Then offboard the device via https://learn.microsoft.com/en-us/defender-endpoint/api/offboard-machine-api
After that, the device will no longer send any data to the portal. It will still be visible though and will be removed after 180 days automatically (https://learn.microsoft.com/en-us/defender-endpoint/offboard-machines).