Create retention-logic-inactive-devices-uninstalled-software.md

Author: denisebmsft

defender-vulnerability-management/retention-logic-inactive-devices-uninstalled-software.md

@@ -0,0 +1,53 @@
+---
+title: Understand retention logic for inactive devices and uninstalled software in Microsoft Defender Vulnerability Management
+description: Get an overview of retention logic for inactive devices or uninstalled software in MDVM.
+author: denisebmsft
+ms.author: deniseb
+manager: deniseb
+ms.reviewer: mobani
+ms.topic: concept-article
+ms.service: defender-vuln-mgmt
+ms.localizationpriority: medium
+ms.collection: 
+- tier1
+- m365-security
+- essentials-overview
+search.appverid: met150
+audience: ITPro
+ms.date: 04/28/2025
+---
+
+# Understand retention logic for inactive devices and uninstalled software in Microsoft Defender Vulnerability Management
+
+[Defender Vulnerability Management](defender-vulnerability-management.md) continuously prioritizes vulnerabilities across devices and provides security recommendations to mitigate risk in the Microsoft Defender portal. Defender Vulnerability Management recommendations uses different retention periods to determine when to stop flagging vulnerabilities based on event reporting activity. This article describes how retention works for two common scenarios: inactive devices and uninstalled software.
+
+## Inactive devices
+
+In Defender Vulnerability Management, a device can be listed as inactive for any of the following reasons:
+
+- The device has stopped sending sensor data for seven days or more
+- The device is offboarded from Defender for Endpoint at least seven days ago
+- The device has network connectivity issues, such as impaired communications, blocked URLs, or blocked ports, and sends some (but not all) events
+
+If a device stops reporting telemetry, Defender Vulnerability Management continues to display the latest vulnerability snapshot for 30 days. After that, the device is marked as inactive and vulnerabilities are no longer shown in the [Microsoft Defender portal](https://security.microsoft.com).
+
+> [!NOTE]
+> In the Microsoft Defender portal, in the device inventory, a device is considered inactive after six months of no reporting.
+
+To prevent misleading vulnerability data, you can exclude a device manually in the device inventory. 
+
+:::image type="content" source="../defender-endpoint/media/exclude-devices-menu.png" alt-text="Screenshot showing how to exclude devices in the Microsoft Defender portal device inventory.":::
+
+For more information, see [Exclude devices](../defender-endpoint/exclude-devices.md).
+
+## Uninstalled or inactive software
+
+A device can continue reporting some telemetry but stop sending signals for specific software. If no events are received for the software for 30 consecutive days, Defender Vulnerability Management assumes the software was removed and automatically stops flagging its vulnerabilities.
+
+For more information, see [Software inventory](tvm-software-inventory.md).
+
+## See also
+
+- [Device inventory](../defender-endpoint/machines-view-overview.md)
+- [Microsoft Defender Vulnerability Management dashboard](tvm-dashboard-insights.md)
+- [Vulnerabilities in my organization](tvm-weaknesses.md)