MiDEO

A Python program to automate the offboarding of devices from Microsoft Defender for Endpoint (MDE)

This implementation currently takes an exported CSV file from Defender for Endpoint (security.microsoft.com) as the input and will offboard all machines in that file.

You can also offboard individual devices using the GUI application.

The offboarded devices are then inserted into a SQLite database, stored in the current working directory.
*** It is important to leave the columns and the format of the CSV file from Defender as-is. main.py is expecting to read the list of device IDs and hostnames from columns 0 and 1, respectively. Rows, however, can be removed as needed to prevent offboarding specific endpoints.***

Getting Started

Azure App Registration

You will need to create an App Registration with Microsoft Azure. Follow the instructions below on how to generate your app's secret keys and granting the appropriate application permissions.

1. Follow this Microsoft guide on creating an app registration. When the reach the API permissions section, move on to Step 2. https://learn.microsoft.com/en-us/azure/healthcare-apis/register-application
2. The following API permissions are required for this application: `Machine.Read.All` and `Machine.Offboard`
3. Take note of your Azure tenant ID, the app ID and the app secret (store this somewhere safe: if you lose it, you will have to generate a new one and break any pre-existing connections with this app)
4. Clone this repo to your location machine. Navigate to `config/.env` and paste your tenant ID, app ID and app secret in the appropriate fields

pip installs

The only package required to be installed is `dotenv`, a Python module that assists this project with the secure handling of API keys, application secret keys, etc.
`pip install python-dotenv`

Roadmap / TODO

1. Azure Key Vault to replace config.py and .env files (used only for local script execution)