Disable log collection from Defender for endpoint

[Qusai_Ismail]

Hello,

Is there a way to disable the log collection from endpoint device after onboard it to Microsoft Defender.

Thanks.

[#2 · Accepted solution]

You can go back into the data connector, unselect which information you no longer want, and then save those changes. Only those items that are selected will be ingested.

[#3]

@Qusai_Ismail 

running the offboarding script should also disable logging.

reference:

offboarding 

"Offboarding causes the device to stop sending sensor data to the portal but data from the device, including reference to any alerts it has had will be retained for up to 6 months."

[#4]

Thanks, but i need to disable that for specific device, not all the devices.@GBushey 

[#5]

Thank you, but is there a way to still have the device onboarded but no logs received from that device.

[#6]

You may want to ask this in a Defender for EndPoint forum as Sentinel will either gather all devices or no devices.