Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Offboard Machines

21 October 2026Feature update+58 / −43 lines

In brief

The documentation now covers Windows, Linux client and server, macOS, Android, and iOS offboarding. It also distinguishes subscription-wide Azure server offboarding from manual individual-server offboarding and clarifies that offboarding does not uninstall software.

What Defender admins need to know

Administrators can follow OS-specific procedures and should choose the correct server path. Turning off Defender for Servers offboards eligible Azure servers automatically, while software removal requires separate uninstall steps.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Prerequisites

Supported

Offboarding is supported on devices running the following operating systems

systems:

  • Windows client devicesoperating systems
  • Windows Server 2012 R2 and later
  • Linux (client and server)
  • macOS
  • Android and iOS
  • Azure Stack HCI OS, version 23H2 and later
  • Mac

Offboard client devices
  • Linux

    • Offboard Windows client devices

    For information about offboarding and uninstalling Microsoft Defender for Endpoint on Linux, see Offboard Microsoft Defender for Endpoint on Linux.

    In theNavigate to Microsoft Defender portal, in the navigation pane, select Settings > Offboard, and then select an operating system to start the offboarding process.

    You can also use other methods, such as:

    Offboard servers

    Choose automatic Azure offboarding or manual endpoint offboarding based on the intended outcome. Verify plan coverage, endpoint reporting, and software removal separately.

    Choose the required outcome

    OutcomeWhat to do
    Offboard an Azure environmentUse automatic Azure offboarding.
    Change Defender for Servers coverageUse the plan-change procedure. Review the affected subscription and resource settings first.
    Offboard individual endpointsUse manual endpoint offboarding.
    Remove endpoint softwareUse the supported uninstall procedure for that operating system. Don't assume a plan change or offboarding package removes it.

    Prepare the change

    1. Record affected servers, existing coverage, and deployment policies.
    2. Review open investigations, evidence-retention needs, and any plans to onboard the server again or reinstall endpoint software.
    3. Remove conflicting onboarding assignments so deployment tools don't reverse the change.
    4. For Direct onboarding, review who is affected before changing a shared setting.

    Automatic Azure offboardingLinux client devices

    Turning off Defender for Servers for a subscription in the Azure portal automatically offboards eligible servers fromFor information about offboarding and uninstalling Microsoft Defender for Endpoint. Changing from Plan 2 to Plan 1 or moving a machine between subscriptions doesn't trigger automatic offboarding.

    Before starting, complete the steps in Prepare the change.

    To start offboarding and verify the result:

    If you turn the plan backEndpoint on before offboarding completes, the offboarding and onboarding actions run asynchronously. Defender for Endpoint is onboarded again after a few hours. Turning the plan back on doesn't immediately cancel offboarding.Linux clients, see Offboard Microsoft Defender for Endpoint on Linux.

    Manual endpoint offboarding

    Use a supported endpoint tool to offboard individual servers, including manually onboarded on-premises servers, or to complete an intended endpoint change after reviewing the automatic flow's result.

    Follow one of the methods below. Manual endpoint offboarding isn't a substitute for changing Defender for Servers coverage.

    Download an offboarding package

    Open the Offboarding page in Microsoft Defender. Use an account authorized to download the package, and then follow the relevant method's operating-system and package selections.

    Download a current package for the correct tenant, check its expiration, and store it securely. Package formats and validity periods differ by method.

    For local-script or Configuration Manager offboarding, select the Windows version group specified in that method's instructions. The generic Windows option opens the separate Defender deployment tool workflow, not the version-specific package workflow.

    Choose the supported method for your operating system and management environment:

    MethodProcedure
    Mobile device managementMobile Device Management offboarding
    API automationOffboard machine API

    Verify each outcome

    Intended changeCheck
    Software removalConfirm the relevant application, package, or service is absent using operating-system tools.
    No automatic returnRecheck after the deployment system's policy refresh.

    Historical records

    Past endpoint data can remain visible under the configured retention policy. A retained device record doesn't prove that protection or reporting is still active. See data retention.

    Offboard MacMacOS devices

    In the following procedure, steps 1 and 2 are optional if you do not want to see these devices that areas retired in the "Device inventory" for 180 days.

    1. Create a device tag, and name the tag decommissioned. Assign the tag to the Mac devices that you want to offboard from Defender for Endpoint.

    2. Create a Device group and name it something like, Decommissioned Mac. Assign this tag to an appropriate user group.

    3. Remove policies for Tamper Protection. See Set preferences on Mac: Tamper protection, or turn off tamper protection by using local configuration.

    4. In the Microsoft Defender portal, navigate to, System > Settings > Endpoints > Device management > Offboarding. Select macOS in Step 1, then choose your preferred deployment method, and select Download package to download the offboarding package.

      Or, if you're using a non-Microsoft device management solution, disable integration with Defender for Endpoint.

    5. Uninstall the Defender for Endpoint app on Mac devices.

    6. Remove Mac devices from the group for system extension policies if an MDM was used to set them.

    Offboard Android or iOS devices

    To offboard an Android or iOS device, uninstall the Microsoft Defender app on the device.

    Offboard cloud and on-premises servers

    Offboard an Azure environment in one step by turning off Defender for Servers for the subscription. Eligible servers are offboarded automatically, without running an offboarding package on each server. To offboard only selected servers, use manual offboarding.

    Choose an offboarding path

    Choose a path based on whether you want to offboard servers across an Azure subscription or only selected servers.

    OutcomeWhat to do
    Offboard an Azure subscription and all servers in itTurn off Defender for Servers for the subscription. Follow automatic Azure offboarding.
    Offboard individual serversFollow manual endpoint offboarding using a supported method for the operating system.

    Note

    • Change active Defender for Servers plan: Follow the plan-change procedure. Review the subscription and resource settings before making changes.
    • Uninstall Microsoft Defender for Endpoint: Follow the uninstall instructions for the server's operating system. Offboarding doesn't uninstall the software.

    Prepare for server offboarding

    1. Record affected servers, existing coverage, and deployment policies.
    2. Review open investigations, evidence-retention needs, and any plans to onboard the server again or reinstall endpoint software.
    3. Remove conflicting onboarding assignments so deployment tools don't reverse the change.
    4. For Direct onboarding, review who is affected before changing a shared setting.

    Offboard servers in an Azure subscription

    To offboard an Azure environment, turn off Defender for Servers for its subscription in the Azure portal. This automatically offboards eligible servers from Defender for Endpoint. No need to run an offboarding package on each server.

    • Use the subscription's Defender for Servers plan setting, not deletion of the Azure environment connector.
    • Changing from Plan 2 to Plan 1 or moving a server between subscriptions doesn't trigger automatic offboarding.

    To start offboarding and verify the result:

    If you turn the plan back on before offboarding completes, the offboarding and onboarding actions run asynchronously. Defender for Endpoint is onboarded again after a few hours. Turning the plan back on doesn't immediately cancel offboarding.

    Offboard individual servers

    Use manual offboarding to stop selected servers from reporting to Defender for Endpoint. Follow the method below for your operating system and management tool.

    Download an offboarding package (if required)

    Navigate to Microsoft Defender portal, in the navigation pane, select Settings > Cloud Security > Server security - Onboard and Manage > Manage offboarding, and then select an operating system to start the offboarding process.

    Note

    Use an account authorized to download the package, and then follow the relevant method's operating-system and package instructions.

    Download a current package for the correct tenant, check its expiration, and store it securely. Package formats and validity periods differ by method.

    For local-script or Configuration Manager offboarding, select the Windows version group specified in that method's instructions. The generic Windows option opens the separate Defender deployment tool workflow, not the version-specific package workflow.

    Choose a method for your operating system and management tool. Download an offboarding package only if the selected procedure requires one.

    MethodProcedure
    Mobile device managementMobile Device Management offboarding
    API automationOffboard machine API

    Validate server offboarding

    Intended changeCheck
    Software removalConfirm the relevant application, package, or service is absent using operating-system tools.
    No automatic returnRecheck after the deployment system's policy refresh.

    Historical records and retention

    \ No newline at end of file Past endpoint data can remain visible under the configured retention policy. A retained device record doesn't prove that protection or reporting is still active. See data retention. \ No newline at end of file