Use a current Defender offboarding package and verify the sensor outcome

Source facts

A Defender offboarding package expires seven days after download, and devices reject expired packages. The package disables the Defender for Endpoint sensor without uninstalling the client; telemetry stops and the device appears inactive in Defender after seven days. Microsoft Learn.

Applicability

Apply this check to an explicitly approved Defender for Endpoint offboarding through Intune EDR policy. Confirm the device identity, reason and replacement protection plan before scheduling the action.

DSE recommendation

DSE recommends including package age and expected sensor state in the offboarding record. Obtain the package close enough to the approved change to remain valid at delivery, and coordinate any replacement protection with the device owner. Make the distinction between offboarding and client removal explicit in the work request and helpdesk handoff.

Verification

After the authorized change, reconcile the Intune deployment result with the observed Defender telemetry and lifecycle state. Allow for the documented inactive-state timing when reviewing the portal. Retain the package download time, target device and observed outcome without storing the package in a broadly accessible ticket. Investigate a rejected or stale package before retrying the change.

Official references

Microsoft Learn: Deploy endpoint detection and response policy with Intune. Source reviewed September 17, 2026.