Confirmation for Offboarded servers

Question

Hi All!

I'm currently in the process of offboarding a bunch of servers (Windows Server 2012 R2 version) machines from Defender using the local script method to start (as a pilot to prove the process). https://learn.microsoft.com/en-us/defender-endpoint/configure-endpoints-script#offboard-devices-using-a-local-script

It seems to be successful, providing all the right signs that the machine has offboarded:

Server:

Machine:

However they don't disappear from the defender portal as would be expected (neither does the status of the machines change in any way).

I do believe Defender for Endpoint holds onto machines for 180 days as per the below:

However are there any tips or tricks to proving/understanding that the machines are in an "offboarded" state and would no longer be incurring charge?

I did consider that they maybe getting re-onboarded by a policy, but this has been checked and is not the case - also this would show in the Event viewer logs on the server itself (which isn't the case).

Any assistance would be appreciated - thanks.

Answer 1

@Eddie Vincent Thank you for reaching out to us, once the device is offboarded, it still appears in devices list. After seven days, the device health state should change to inactive. Machines will go into an ‘inactive’ state after 7 days of zero cyber data activity (for example if machines were offboarded, turned off, disconnected... etc.). Same information has been documented here - https://learn.microsoft.com/en-us/defender-endpoint/fix-unhealthy-sensors

Regarding the retention your understanding is correct. For security purposes, the device will remain in the portal as an historical record for up to 180 days. However, the device's data will be purged according to your retention period. 

I.e. The machines will “disappear” from the portal once the machines become inactive (they stop sending cyber data), and no later than 180 days since they stopped sending data to cloud. 

Let me know if you have any further questions, feel free to post back.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.