Offboard a device from Microsoft Defender for Business

If you want to offboard a device, use one of the following procedures:

Offboard a Windows device

  1. Go to the Microsoft 365 Defender portal ( and sign in.

  2. In the navigation pane, choose Settings, and then choose Endpoints.

  3. Under Device management, choose Offboarding.

  4. Select an operating system, such as Windows 10 and 11, and then, under Offboard a device, in the Deployment method section, choose Local script.

  5. In the confirmation screen, review the information, and then choose Download to proceed.

  6. Select Download offboarding package. We recommend saving the offboarding package to a removable drive.

  7. Run the script on each device that you want to offboard.

Offboard a macOS computer

  1. Go to Finder > Applications.

  2. Right click on Microsoft Defender for Business, and then choose Move to Trash.
    --- or ---
    Use the following command: sudo '/Library/Application Support/Microsoft/Defender/uninstall/uninstall'.


Offboarding a device causes the devices to stop sending data to Defender for Business. However, data received prior to offboarding is retained for up to six (6) months.

Next steps