# Use a current Defender offboarding package and verify the sensor outcome

> What should an Intune EDR offboarding check verify beyond policy deployment success?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-080-use-a-current-defender-offboarding-package-and-verify-the-sensor-outcome/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:40+00:00
- Modified: 2026-09-17T16:38:45+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

What should an Intune EDR offboarding check verify beyond policy deployment success?

## Potentially affected

Apply this check to an explicitly approved Defender for Endpoint offboarding through Intune EDR policy. Confirm the device identity, reason and replacement protection plan before scheduling the action.

## DSE recommendation

DSE recommends including package age and expected sensor state in the offboarding record.

## Article

## Source facts

A Defender offboarding package expires seven days after download, and devices reject expired packages. The package disables the Defender for Endpoint sensor without uninstalling the client; telemetry stops and the device appears inactive in Defender after seven days. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/deploy-edr).

## Applicability

Apply this check to an explicitly approved Defender for Endpoint offboarding through Intune EDR policy. Confirm the device identity, reason and replacement protection plan before scheduling the action.

## DSE recommendation

DSE recommends including package age and expected sensor state in the offboarding record. Obtain the package close enough to the approved change to remain valid at delivery, and coordinate any replacement protection with the device owner. Make the distinction between offboarding and client removal explicit in the work request and helpdesk handoff.

## Verification

After the authorized change, reconcile the Intune deployment result with the observed Defender telemetry and lifecycle state. Allow for the documented inactive-state timing when reviewing the portal. Retain the package download time, target device and observed outcome without storing the package in a broadly accessible ticket. Investigate a rejected or stale package before retrying the change.

## Official references

[Microsoft Learn: Deploy endpoint detection and response policy with Intune](https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/deploy-edr). Source reviewed September 17, 2026.

## Primary reference

- Name: Deploy endpoint detection and response policy with Intune - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/deploy-edr
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Use a current Defender offboarding package and verify the sensor outcome,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-080-use-a-current-defender-offboarding-package-and-verify-the-sensor-outcome/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.