Clear all Device tags in ATP Portal

[slundy99]

Is there a way to clear all tags in the ATP portal?  Right now I only see ways of doing it device by device (in portal and via API).  We're instituting new tags and need to remove the old ones.

[#2]

There is no quick way to do this through the portal.
You could script this through the API though.
You can write a script which retrieves the current tags and deletes them one by one

[#3]

@slundy99 

You can use Microsoft Flow to talk to the APIs, but you can get similar results with other tools like Logic Apps to automate machine tagging as well.

Blog post from the Defender ATP team:

https://techcommunity.microsoft.com/t5/microsoft-defender-atp/automated-machine-tagging-in-just-a-fe...

[#4]

@alexandertuvstrom Love the idea, but the advanced hunting requires premium access.  I can do the free trial, but w/o being very knowledgeable in this I worry I'd waste the week just figuring out how to do what is required for what I need.  I'll have to figure out the script option.  Is there an api reference for ATP anywhere I can look at?  I'll search but wanted to ask here as well.

[#5]

@slundy99 

Oh, I understand. The API access requires OAuth2.0 authentication so you’ll need to take the following steps to use the APIs:

• Create an AAD application
• Get an access token using this application
• Use the token to access Microsoft Defender ATP API
• Assign the desired permission to the application

Microsoft defender ATP API reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/add-or-re...

[#6]

@slundy99 

I found a good script example from anthonws on GitHub: 

https://github.com/anthonws/MDATP_PoSh_Scripts/blob/master/API/API_Tag_Sample.ps1