Others

How to Offboard an Unbootable Device from Microsoft Defender for Endpoint

Maira Mehtab Oct 10, 2026 870 views

Question details

The user needs to remove a replaced or permanently unbootable computer from Microsoft Defender for Endpoint, as the device's state prevents the standard local offboarding script from running.

How to Offboard an Unbootable Device from Microsoft Defender for Endpoint

Product: Microsoft Defender for Endpoint
Device & OS: not provided
Scenario: A system administrator or security professional is attempting to clean up device inventory by removing records of dead or replaced machines from the Defender portal.
Observed behavior: The standard Microsoft Defender offboarding script cannot be used because the affected computer cannot be turned on or accessed.

Before you start

Ensure you have administrative privileges in the Microsoft 365 Defender portal and verify that the device is permanently decommissioned before taking steps to remove its record.

Solution 1Recommended

Rely on Data Retention Policies

Since the local script cannot be run, the most standard approach is to let the device naturally age out of your active inventory based on your tenant's data retention policy.

Microsoft Defender for Endpoint is designed to automatically drop inactive devices from the active portal view once they surpass the configured data retention period.

While waiting for the retention period to expire, the device will be marked as inactive and will eventually stop negatively impacting your security posture and compliance scores.

Access the Defender Portal

Log in to the Microsoft 365 Defender portal using an account with Security Administrator or Global Administrator privileges.

Check Retention Settings

Navigate to Settings > Endpoints > Data retention to view your organization's configured retention period, which typically ranges from 30 to 180 days.

Wait for Inactivity Drop-off

Leave the device disconnected. Once it has been offline for the duration of the retention period, it will automatically be removed from the active device inventory.

Security Score Impact: Inactive devices generally stop affecting your Microsoft Secure Score after 30 days of inactivity, even if they remain visible in your inventory until the full retention period ends.

Solution 2

Escalate to Microsoft Support for Tenant-Level Cleanup

If you require immediate removal of the device for compliance or auditing purposes, you must contact Microsoft Support for a backend cleanup.

Free Microsoft Office alternative

Need a Reliable Office Suite for Your Replacement Devices?

While you manage device provisioning and decommission unbootable endpoints, ensure your new machines are equipped with powerful productivity tools. WPS Office is a free, lightweight, and highly compatible alternative to Microsoft Office, perfect for rapid deployment on new or replacement hardware.

1. Download the Installer: Visit the official WPS website and download the free installation package for your new device.
2. Install the Software: Run the installer and follow the simple on-screen instructions to deploy the suite in minutes.
3. Open and Edit: Launch WPS Office to immediately start opening, editing, and saving your existing Microsoft Office documents without formatting loss.

Fully compatible with Microsoft Office formats, including DOCX, XLSX, and PPTX.Lightweight installation minimizes system resource usage on replacement devices.Includes built-in PDF editing and conversion tools for secure document management.Familiar tabbed interface ensures zero learning curve for users migrating from Microsoft Office.

Frequently Asked Questions

Can I run the Microsoft Defender offboarding script remotely on a broken machine?

No. The standard offboarding script requires the device's operating system to be bootable and accessible so that the local commands can sever the connection to the Defender service.

Is there a 'Delete' button for devices in the Microsoft Defender portal?

No, Microsoft Defender for Endpoint does not currently feature a manual 'Delete' button for individual devices. Devices are removed automatically based on the tenant's data retention policy once they become inactive.

Where can I get specialized technical guidance for Microsoft Defender?

For advanced issues and specialized guidance outside standard procedures, administrators are encouraged to post questions on the Microsoft Q&A platform under the Microsoft Defender for Endpoint tag.

Office Quick Solutions