Forum Discussion
Defender Streaming API is not removed during offboarding process (and cannot be deleted)
Hi StephanGee,
This export setting can be removed via API by sending a delete call to https://api.security.microsoft.com/api/dataexportsettings/<export setting name>. The export setting name should be the full name starting with SentinelExportSettings - for example: https://api.security.microsoft.com/api/dataexportsettings/SentinelExportSettings-sentinel-test
The easiest method to perform this is with the API explorer in the Microsoft 365 Defender portal (under Endpoints -> Partners and APIs -> API explorer), but you can use any method of calling an API (cURL, Postman, etc):
Following this and assuming you get a 200 status code returned, you can confirm in the portal that the setting has been deleted. You'll need to have the appropriate RBAC permissions to call this API.
MicrosoftHi StephanGee,
This export setting can be removed via API by sending a delete call to https://api.security.microsoft.com/api/dataexportsettings/<export setting name>. The export setting name should be the full name starting with SentinelExportSettings - for example: https://api.security.microsoft.com/api/dataexportsettings/SentinelExportSettings-sentinel-test
The easiest method to perform this is with the API explorer in the Microsoft 365 Defender portal (under Endpoints -> Partners and APIs -> API explorer), but you can use any method of calling an API (cURL, Postman, etc):
Following this and assuming you get a 200 status code returned, you can confirm in the portal that the setting has been deleted. You'll need to have the appropriate RBAC permissions to call this API.
