Can I create a PowerAutomate flow to offboard devices in Defender for Endpoint?

Question

I would like to create a friendly interface for users to offboard devices in Defender for Endpoint, so they won't have to run this process manually.

Is this possible?

Answer 1

Hi @aa , you should be able to use the "HTTP" action in Power Automate to call the Microsoft Graph API to offboard devices: https://learn.microsoft.com/en-us/power-automate/desktop-flows/actions-reference/web1.

1. Add a "HTTP" action to the flow.
2. In the "HTTP" action, set the method to "DELETE".
3. In the "HTTP" action, set the method to "DELETE".
4. Set the URI to the following endpoint: https://graph.microsoft.com/beta/security/tiIndicators/{indicatorId}
5. In the "Headers" section, add an "Authorization" header with a bearer token for authentication.
6. In the "Body" section, add the JSON payload with the device ID(s) you want to offboard.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James