Forum Discussion
How to disconnect MDE Connector
Hi, We have enabled Defender for Endpoint and Defender 365 Connector in Sentinel looking for pointers on how to disconnect Defender for Endpoint connector from Sentinel to overcome duplication of data
1 Reply
- https://docs.microsoft.com/en-us/azure/sentinel/connect-microsoft-365-defender?tabs=MDE#connect-to-microsoft-365-defender
To avoid duplication of incidents, it is recommended to mark the check box labeled Turn off all Microsoft incident creation rules for these products.
Note
When you enable the Microsoft 365 Defender connector, all of the Microsoft 365 Defender components’ connectors (the ones mentioned at the beginning of this article) are automatically connected in the background. In order to disconnect one of the components’ connectors, you must first disconnect the Microsoft 365 Defender connector.
