Actions41
- Advanced Query Actions
- Alert Actions
- Exposure Score Actions
- Indicator Actions
- Investigation Actions
- Machine Actions
- Machine Action Actions
- Recommendation Actions
- Remediation Actions
- Software Actions
- Vulnerability Actions
Machine Action → Remove From Isolation
AI-generatedSummary
Remove a machine from network isolation in Microsoft Defender by specifying the machine ID and an optional comment.
Inputs
- Authentication (required) — Choose the authentication method to use, currently only OAuth2 is supported.
- Machine ID (required) — The unique identifier of the device to remove from isolation.
- Comment — Optional comments regarding the isolation removal action.
Output shape
A response object from the Microsoft Defender API confirming the machine has been removed from isolation, including details of the operation.
This operation sends a POST request to the endpoint /api/machines/{machineId}/unisolate and returns the API response. Authentication is required and must be configured accordingly.