Microsoft Defender for Identity
Identity protectionUninstall Sensor
In brief
The guidance now applies to servers, specifically v3.x sensors deployed without Defender for Endpoint. Administrators must run the offboarding package on the server before deleting its portal entry; deleting the entry alone may leave the sensor active, sending data, and able to reactivate.
What Defender admins need to know
Administrators offboarding affected v3.x sensors should use the package before removing the sensor from the portal.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Remove the Microsoft Defender for Identity sensor when you need to decommission a server, clean up orphaned or duplicate sensor entries, or stop Defender for Identity monitoring on a specific server. For sensors onboarded without Microsoft Defender for Endpoint deployment, follow the dedicated offboarding procedure before removing the sensor entry.
Offboard a domain controllerserver without Defender for Endpoint deployment
For a domain controllerserver onboarded without Defender for Endpoint deployment, run the offboarding package on the domain controllerserver before removing the v3.x sensor from the portal. Removing the portal entry alone doesn't uninstall the v3.x sensor component. The v3.x sensor can continue sending data and reactivate.
On the Sensor management tab of the On-premises page in the Microsoft Defender portal at https://security.microsoft.com/securitysettings/identities, select the v3.x sensor, and then select Delete.
In the removal dialog, select Download offboarding package.
Copy the downloaded offboarding package to the
domain controller.server.Open PowerShell as an administrator, and change to the folder that contains the offboarding package.
Run the deployment tool with the full path to the
.offboardingfile:
Important
For a v3.x sensor onboarded without Defender for Endpoint deployment, complete Offboard a domain controllerserver without Defender for Endpoint deployment before deleting the sensor entry.
To delete a v3.x sensor from the Microsoft Defender portal, follow these steps:
On the Sensor management tab of the On-premises page in the Microsoft Defender portal at https://security.microsoft.com/securitysettings/identities, select the
domain controllerserver where you want to deactivate Defender for Identity capabilities.Select Delete, and confirm your selection.
@@ -13,7 +13,7 @@ ms.service: microsoft-defender-for-identity uhfHeaderId: MSDocsHeader-MicrosoftDefender ms.suite: ems description: Remove the Microsoft Defender for Identity sensor from servers by deleting, uninstalling, or cleaning up orphaned and duplicate entries in the Microsoft Defender portal.-ms.date: 2026-10-06T00:00:00.0000000Z+ms.date: 2026-10-19T00:00:00.0000000Z ms.topic: how-to ms.reviewer: rlitinsky ms.custom: msecd-doc-authoring-1015@@ -46,15 +46,15 @@ platformId: 956293f4-c9be-c774-103b-3c49f82b9c9e Remove the Microsoft Defender for Identity sensor when you need to decommission a server, clean up orphaned or duplicate sensor entries, or stop Defender for Identity monitoring on a specific server. For sensors onboarded without Microsoft Defender for Endpoint deployment, follow the dedicated offboarding procedure before removing the sensor entry.
-## Offboard a domain controller without Defender for Endpoint deployment
+## Offboard a server without Defender for Endpoint deployment
-For a domain controller onboarded without Defender for Endpoint deployment, run the offboarding package on the domain controller before removing the sensor from the portal. Removing the portal entry alone doesn't uninstall the sensor component. The sensor can continue sending data and reactivate.
+For a server onboarded without Defender for Endpoint deployment, run the offboarding package on the server before removing the v3.x sensor from the portal. Removing the portal entry alone doesn't uninstall the v3.x sensor component. The v3.x sensor can continue sending data and reactivate.
1. On the **Sensor management** tab of the **On-premises** page in the Microsoft Defender portal at https://security.microsoft.com/securitysettings/identities, select the v3.x sensor, and then select **Delete**.
2. In the removal dialog, select **Download offboarding package**.
[](media/remove-sensor-without-defender-for-endpoint-deployment.png#lightbox)
-3. Copy the downloaded offboarding package to the domain controller.
+3. Copy the downloaded offboarding package to the server.
4. Open PowerShell as an administrator, and change to the folder that contains the offboarding package.
5. Run the deployment tool with the full path to the `.offboarding` file:
@@ -71,11 +71,11 @@ For a domain controller onboarded without Defender for Endpoint deployment, run
Important
-For a sensor onboarded without Defender for Endpoint deployment, complete Offboard a domain controller without Defender for Endpoint deployment before deleting the sensor entry.
+For a v3.x sensor onboarded without Defender for Endpoint deployment, complete Offboard a server without Defender for Endpoint deployment before deleting the sensor entry.
To delete a v3.x sensor from the Microsoft Defender portal, follow these steps:
-1. On the **Sensor management** tab of the **On-premises** page in the Microsoft Defender portal at https://security.microsoft.com/securitysettings/identities, select the domain controller where you want to deactivate Defender for Identity capabilities.
+1. On the **Sensor management** tab of the **On-premises** page in the Microsoft Defender portal at https://security.microsoft.com/securitysettings/identities, select the server where you want to deactivate Defender for Identity capabilities.
2. Select **Delete**, and confirm your selection.
[](media/screenshot-that-shows-how-to-delete-a-sensor.png#lightbox)