{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-080-use-a-current-defender-offboarding-package-and-verify-the-sensor-outcome/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260917-080-use-a-current-defender-offboarding-package-and-verify-the-sensor-outcome/",
        "slug": "dse-20260917-080-use-a-current-defender-offboarding-package-and-verify-the-sensor-outcome",
        "url": "https://update.dsesecurity.com/updates/dse-20260917-080-use-a-current-defender-offboarding-package-and-verify-the-sensor-outcome/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260917-080-use-a-current-defender-offboarding-package-and-verify-the-sensor-outcome.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-080-use-a-current-defender-offboarding-package-and-verify-the-sensor-outcome/"
        },
        "title": "Use a current Defender offboarding package and verify the sensor outcome",
        "summary": "What should an Intune EDR offboarding check verify beyond policy deployment success?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-17T16:33:40+00:00",
        "modified_at": "2026-09-17T16:38:45+00:00",
        "reviewed_on": "2026-09-17",
        "reading_minutes": 1,
        "word_count": 197,
        "potentially_affected": "Apply this check to an explicitly approved Defender for Endpoint offboarding through Intune EDR policy. Confirm the device identity, reason and replacement protection plan before scheduling the action.",
        "dse_recommendation": "DSE recommends including package age and expected sensor state in the offboarding record.",
        "primary_source": {
            "name": "Deploy endpoint detection and response policy with Intune - Microsoft Intune | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/deploy-edr",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>A Defender offboarding package expires seven days after download, and devices reject expired packages. The package disables the Defender for Endpoint sensor without uninstalling the client; telemetry stops and the device appears inactive in Defender after seven days. <a href=\"https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/deploy-edr\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Apply this check to an explicitly approved Defender for Endpoint offboarding through Intune EDR policy. Confirm the device identity, reason and replacement protection plan before scheduling the action.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends including package age and expected sensor state in the offboarding record. Obtain the package close enough to the approved change to remain valid at delivery, and coordinate any replacement protection with the device owner. Make the distinction between offboarding and client removal explicit in the work request and helpdesk handoff.</p>\n<h2>Verification</h2>\n<p>After the authorized change, reconcile the Intune deployment result with the observed Defender telemetry and lifecycle state. Allow for the documented inactive-state timing when reviewing the portal. Retain the package download time, target device and observed outcome without storing the package in a broadly accessible ticket. Investigate a rejected or stale package before retrying the change.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/deploy-edr\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Deploy endpoint detection and response policy with Intune</a>. Source reviewed September 17, 2026.</p>",
        "content_text": "Source facts\nA Defender offboarding package expires seven days after download, and devices reject expired packages. The package disables the Defender for Endpoint sensor without uninstalling the client; telemetry stops and the device appears inactive in Defender after seven days. Microsoft Learn.\nApplicability\nApply this check to an explicitly approved Defender for Endpoint offboarding through Intune EDR policy. Confirm the device identity, reason and replacement protection plan before scheduling the action.\nDSE recommendation\nDSE recommends including package age and expected sensor state in the offboarding record. Obtain the package close enough to the approved change to remain valid at delivery, and coordinate any replacement protection with the device owner. Make the distinction between offboarding and client removal explicit in the work request and helpdesk handoff.\nVerification\nAfter the authorized change, reconcile the Intune deployment result with the observed Defender telemetry and lifecycle state. Allow for the documented inactive-state timing when reviewing the portal. Retain the package download time, target device and observed outcome without storing the package in a broadly accessible ticket. Investigate a rejected or stale package before retrying the change.\nOfficial references\nMicrosoft Learn: Deploy endpoint detection and response policy with Intune. Source reviewed September 17, 2026.",
        "content_markdown": "## Source facts\n\nA Defender offboarding package expires seven days after download, and devices reject expired packages. The package disables the Defender for Endpoint sensor without uninstalling the client; telemetry stops and the device appears inactive in Defender after seven days. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/deploy-edr).\n\n## Applicability\n\nApply this check to an explicitly approved Defender for Endpoint offboarding through Intune EDR policy. Confirm the device identity, reason and replacement protection plan before scheduling the action.\n\n## DSE recommendation\n\nDSE recommends including package age and expected sensor state in the offboarding record. Obtain the package close enough to the approved change to remain valid at delivery, and coordinate any replacement protection with the device owner. Make the distinction between offboarding and client removal explicit in the work request and helpdesk handoff.\n\n## Verification\n\nAfter the authorized change, reconcile the Intune deployment result with the observed Defender telemetry and lifecycle state. Allow for the documented inactive-state timing when reviewing the portal. Retain the package download time, target device and observed outcome without storing the package in a broadly accessible ticket. Investigate a rejected or stale package before retrying the change.\n\n## Official references\n\n[Microsoft Learn: Deploy endpoint detection and response policy with Intune](https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/deploy-edr). Source reviewed September 17, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-080-use-a-current-defender-offboarding-package-and-verify-the-sensor-outcome/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-080-use-a-current-defender-offboarding-package-and-verify-the-sensor-outcome/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-17"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-080-use-a-current-defender-offboarding-package-and-verify-the-sensor-outcome/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Use a current Defender offboarding package and verify the sensor outcome",
                        "item": "https://update.dsesecurity.com/updates/dse-20260917-080-use-a-current-defender-offboarding-package-and-verify-the-sensor-outcome/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-080-use-a-current-defender-offboarding-package-and-verify-the-sensor-outcome/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260917-080-use-a-current-defender-offboarding-package-and-verify-the-sensor-outcome/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-080-use-a-current-defender-offboarding-package-and-verify-the-sensor-outcome/",
                "headline": "Use a current Defender offboarding package and verify the sensor outcome",
                "description": "What should an Intune EDR offboarding check verify beyond policy deployment success?",
                "abstract": "What should an Intune EDR offboarding check verify beyond policy deployment success?",
                "articleBody": "Source facts\nA Defender offboarding package expires seven days after download, and devices reject expired packages. The package disables the Defender for Endpoint sensor without uninstalling the client; telemetry stops and the device appears inactive in Defender after seven days. Microsoft Learn.\nApplicability\nApply this check to an explicitly approved Defender for Endpoint offboarding through Intune EDR policy. Confirm the device identity, reason and replacement protection plan before scheduling the action.\nDSE recommendation\nDSE recommends including package age and expected sensor state in the offboarding record. Obtain the package close enough to the approved change to remain valid at delivery, and coordinate any replacement protection with the device owner. Make the distinction between offboarding and client removal explicit in the work request and helpdesk handoff.\nVerification\nAfter the authorized change, reconcile the Intune deployment result with the observed Defender telemetry and lifecycle state. Allow for the documented inactive-state timing when reviewing the portal. Retain the package download time, target device and observed outcome without storing the package in a broadly accessible ticket. Investigate a rejected or stale package before retrying the change.\nOfficial references\nMicrosoft Learn: Deploy endpoint detection and response policy with Intune. Source reviewed September 17, 2026.",
                "datePublished": "2026-09-17T16:33:40+00:00",
                "dateModified": "2026-09-17T16:38:45+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-080-use-a-current-defender-offboarding-package-and-verify-the-sensor-outcome/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-080-use-a-current-defender-offboarding-package-and-verify-the-sensor-outcome/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Use a current Defender offboarding package and verify the sensor outcome"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 197,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Deploy endpoint detection and response policy with Intune - Microsoft Intune | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/deploy-edr"
                }
            }
        ]
    }
}