Remove Endpoint from Defender

Question

How we can delete endpoint from Asset - Device on Microsoft Defender portal? If I delete the device from Entra then the devices will be removed also from Defender portal?

Answer 1

Hey there, Handian Sudianto

Deleting a device from Entra will not remove it from Microsoft Defender. Microsoft Defender will keep the device listed until it meets normal inactivity and retention rules set. Then it will remove it. The endpoint becomes inactive after 7 days of inactivity. The device remains visible for around 180 days before being removed. More can be found in this article: https://learn.microsoft.com/en-us/defender-endpoint/fix-unhealthy-sensors#device-isnt-in-use

Microsoft keeps data retained for compliance and investigation purposes. In order to remove endpoints that are no longer needed, you must offboard them through the portal. Once you have done this, after seven days the end point will be listed as inactive and devices not active within the past 30 days are not factored in your organisation's exposure score. You can find more information on how to do this in this article: https://learn.microsoft.com/en-us/defender-endpoint/offboard-machines

Once you offboard the device from Microsoft Defender, please remove it from Intune. To learn how to do this, please follow the advice in this article: https://learn.microsoft.com/en-us/intune/device-management/actions/delete?pivots=windows

After you have removed the device from Intune, you can delete the device from Entra ID. You can learn how to do this in this article: https://learn.microsoft.com/en-us/entra/identity/devices/manage-device-identities

Hope this information helps,
Nathan