Microsoft Defender for Endpoint
Endpoint protectionOffboard or uninstall Microsoft Defender for Endpoint on Linux
In brief
The documentation now lists three ways to offboard a Linux server, adding the Offboard machine API for automation.
What Defender admins need to know
Administrators can use the API to automate Linux server offboarding; no action is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Offboard or uninstall Microsoft Defender for Endpoint on Linux
Offboard a device
TwoThree methods are available to offboard a Linux server from Microsoft Defender for Endpoint:
- Offboard using a
scriptscript. - Offboard using an offboarding JSON file.
- Offboard using the API.
BothAll methods achieve the same result, so you can choose the one that best fits your scenario.
Offboard using a script
- Extract the contents of the ZIP file and locate the mdatp_offboard.json file.
- Copy mdatp_offboard.json to the following location on the Linux server:
/etc/opt/microsoft/mdatp/mdatp_offboard.json
Offboard using the API
Use the Offboard machine API to automate offboarding a Linux server from Defender for Endpoint.
Uninstall the Defender application from a Linux server
Two methods are available to uninstall the Defender application from a Linux server: Uninstall using the Defender deployment tool (Recommended) or manual uninstallation. Both methods achieve the same result, so you can choose the one that best fits your scenario.
@@ -14,7 +14,7 @@ ms.collection: - tier3 - mde-linux search.appverid: met150-ms.date: 04/16/2026+ms.date: 08/11/2026 --- # Offboard or uninstall Microsoft Defender for Endpoint on Linux@@ -57,12 +57,13 @@ After a device has been successfully offboarded or uninstalled, the Defender app ## Offboard a device -Two methods are available to offboard a Linux server from Microsoft Defender for Endpoint:+Three methods are available to offboard a Linux server from Microsoft Defender for Endpoint: -- Offboard using a script+- Offboard using a script. - Offboard using an offboarding JSON file.+- Offboard using the API. -Both methods achieve the same result, so you can choose the one that best fits your scenario.+All methods achieve the same result, so you can choose the one that best fits your scenario. ### Offboard using a script @@ -87,6 +88,10 @@ Both methods achieve the same result, so you can choose the one that best fits y 1. Extract the contents of the ZIP file and locate the *mdatp_offboard.json* file. 1. Copy *mdatp_offboard.json* to the following location on the Linux server: `/etc/opt/microsoft/mdatp/mdatp_offboard.json` +### Offboard using the API++Use the [Offboard machine API](api/offboard-machine-api.md) to automate offboarding a Linux server from Defender for Endpoint.+ ## Uninstall the Defender application from a Linux server Two methods are available to uninstall the Defender application from a Linux server: Uninstall using the Defender deployment tool (Recommended) or manual uninstallation. Both methods achieve the same result, so you can choose the one that best fits your scenario.