Every time a session host is rebuilt under the same name, Microsoft Defender for Endpoint gains another device record for it. Defender Duplicate Cleanup stops that build-up at the source: whenever Atlas deletes a session host, whether you remove it, delete its host pool, replace or reimage it on a schedule, or clean up a failed deployment, Atlas offboards the VM from Defender before the VM is deleted and then hides the leftover record from Atlas' Defender views.
Key capabilities
- Offboards the VM from Defender for Endpoint before the VM is deleted, while its sensor can still receive the request
- Covers every way Atlas deletes a session host: single VM delete, host pool delete, scheduled replace and reimage, and failed-deployment cleanup
- Briefly starts a deallocated VM so the offboard can be delivered, then deletes it as usual
- Hides the leftover Inactive record from Atlas' Defender views, even when Defender could not deliver the offboard
- Works whether Atlas or another tool (Intune, Group Policy, a manual script) enrolled the host in Defender
- With Vulnerability Scanning (Atlas AVD), a Duplicate Devices count and drill-down on Security Posture list the hostnames enrolled more than once
Available on: Community plan and above
Defender Duplicate Cleanup is included in every Community subscription.