Additional Microsoft Defender tools and services that provide security across various platforms and environments
Request to offboard a personally-owned device from an orphaned Microsoft Defender for Endpoint tenant (enrolling organisation now defunct)
To the Microsoft Defender for Endpoint team,
I am the owner of a personally-owned Windows 11 laptop that remains onboarded to a Microsoft Defender for Endpoint (MDE) tenant belonging to an organisation that has since ceased to exist. I am seeking a server-side offboarding or tenant dissociation, as I have no way to obtain an offboarding package through the normal route.
Relevant details:
- The device is personal property. It was previously registered with a workplace/school account belonging to Edmund Rice Education Australia (domain erea.edu.au), which is no longer an operating entity and whose Microsoft tenancy I can no longer access.
- I have removed the erea.edu.au work-or-school account from the device. It is confirmed not Azure AD joined, not domain joined, and not enrolled in any active MDM.
- Despite this, the Defender for Endpoint sensor (Sense / MsSense.exe) is still running and still reports as onboarded. Diagnostic values from the device:
-
OnboardingState= 1- Orphaned OrgId = b6cacff9-7781-47b0-9cb2-aeebf3af6fea
- (My device's current Windows workplace registration is the University of Melbourne, tenant 0e5bf3cf-1ff4-46b7-9176-52c538c22a4d — a separate, legitimate registration that should remain untouched.)
- Orphaned OrgId = b6cacff9-7781-47b0-9cb2-aeebf3af6fea
-
Because the enrolling organisation is defunct, I cannot generate an offboarding script from its Defender portal, and the sensor's tamper protection prevents a clean local removal. On this Windows client the sensor is an OS component and cannot simply be uninstalled.
My request: please either dissociate this device from OrgId b6cacff9-7781-47b0-9cb2-aeebf3af6fea server-side, or advise a supported method for standing the sensor down given that the tenant no longer exists. I am happy to provide the device name, my Microsoft account email, or run any diagnostic you require to verify ownership.
Thank you for your help.
Kind regards, Adam Taylor
******@outlook.com
Device name: Hannah