Offboard multiple machines (unreachable)

[JamesFritz]

So I can see how to POST one machine at a time in Defender ATP API Explorer to offboard one machine, but curious the best way to handle multiple machines.

Is there a way to post multiple machine IDs at one time to offboard all of them?

[#2]

@JamesFritz 

If you are familiar with PowerShell you could try out the PSMDATP module

https://github.com/alexverboon/PSMDATP

that has a Remove-MDATPDevice cmdlet to offboard devices. 

https://github.com/alexverboon/PSMDATP/blob/master/docs/Remove-MDATPDevice.md

With that you could create a text file with all the devies you want to remove and then simply run a forEach loop calling the remove-MDATPDevice cmdlet. 

[#3]

@Alex Verboon
I was trying to use this module to offboard some devices, but it does not seem to succeed, although I do see the devices have the tag "Offboarded."
I am able to get a list of devices, so other portions of the module are working correctly.
Here's what I get:
remove-MDATPDevice -DeviceName computer.mydomain
VERBOSE: GET https://api.securitycenter.windows.com/api/machines with 0-byte payload
VERBOSE: received 30374-byte response of content type application/json; odata.metadata=minimal


StatusCode : 200
StatusDescription : OK
Content : {"@odata.context":"https://api.securitycenter.windows.com/api/$metadata#Machines/$entity","id":"computerdeviceID","comp...
en...
RawContent : HTTP/1.1 200 OK
x-content-type-options: nosniff
x-request-id: {requestID}
OData-Version: 4.0
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Content-Lengt...
Forms : {}
Headers : {[x-content-type-options, nosniff], [x-request-id, {requestID}],
[OData-Version, 4.0], [Strict-Transport-Security, max-age=31536000 ; includeSubDomains]...}
Images : {}
InputFields : {}
Links : {}
ParsedHtml : mshtml.HTMLDocumentClass
RawContentLength : 903

True