Actions41
- Advanced Query Actions
- Alert Actions
- Exposure Score Actions
- Indicator Actions
- Investigation Actions
- Machine Actions
- Machine Action Actions
- Recommendation Actions
- Remediation Actions
- Software Actions
- Vulnerability Actions
Machine Action → Isolate Machine
AI-generatedSummary
Isolate a specified device in Microsoft Defender by applying a network isolation type to control its connectivity.
Inputs
- Machine ID (required) — The unique identifier of the device to isolate.
- Comment — Optional comments to describe or justify the isolation action.
- Isolation Type — The type of isolation to apply: Full (for managed devices), Selective (restrict only certain applications), or UnManagedDevice (targets unmanaged devices only).
Output shape
The API response indicating the isolate action status, typically including details about the isolation request or action initiation.
The operation triggers a POST request to isolate the device by ID; no pagination or list is returned. The response will follow Microsoft Defender API standards for machine isolation actions.