Skip to main content

Get-XdrCloudAppsPolicy

SYNOPSIS​

Retrieves policies from Microsoft Defender for Cloud Apps.

SYNTAX​

Default (Default)​

Get-XdrCloudAppsPolicy [-Limit <Int32>] [-Skip <Int32>] [-SortField <String>] [-SortDirection <String>]
 [-Filters <Hashtable>] [-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]

TypedPolicyId​

Get-XdrCloudAppsPolicy -Type <String> -PolicyId <String> [-Force] [-ProgressAction <ActionPreference>]
 [<CommonParameters>]

TypedPolicyLimit​

Get-XdrCloudAppsPolicy -Type <String> [-PolicyLimit] [-Force] [-ProgressAction <ActionPreference>]
 [<CommonParameters>]

TypedAction​

Get-XdrCloudAppsPolicy -Type <String> [-Action] [-Force] [-ProgressAction <ActionPreference>]
 [<CommonParameters>]

TypedMetadata​

Get-XdrCloudAppsPolicy -Type <String> [-Metadata] [-Force] [-ProgressAction <ActionPreference>]
 [<CommonParameters>]

Typed​

Get-XdrCloudAppsPolicy -Type <String> [-Limit <Int32>] [-Skip <Int32>] [-SortField <String>]
 [-SortDirection <String>] [-Filters <Hashtable>] [-Force] [-ProgressAction <ActionPreference>]
 [<CommonParameters>]

PolicyIdOnly​

Get-XdrCloudAppsPolicy -PolicyId <String> [-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]

Setting​

Get-XdrCloudAppsPolicy [-Setting] [-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION​

The Get-XdrCloudAppsPolicy cmdlet retrieves policies from Microsoft Defender for Cloud Apps. Policies help control and govern cloud application usage and data protection within your organization. You can filter, sort, and paginate the results using the available parameters.

Use -Type to retrieve specific policy types (ConditionalAccess, File, InformationProtection, OAuth, ShadowIT, Template, ThreatDetection). Use -Metadata with -Type to get filter and field definitions for that policy type. Use -Setting to retrieve policy settings.

For File and OAuth policies, additional options are available:

  • Use -PolicyId with -Type to retrieve a specific policy by ID
  • Use -Action with -Type File or -Type OAuth to get available actions
  • Use -PolicyLimit with -Type File to get file policy limits

EXAMPLES​

EXAMPLE 1​

Get-XdrCloudAppsPolicy

Retrieves all policies sorted by severity (highest first).

EXAMPLE 2​

Get-XdrCloudAppsPolicy -Type ConditionalAccess

Retrieves conditional access policies.

EXAMPLE 3​

Get-XdrCloudAppsPolicy -Type File

Retrieves file policies.

EXAMPLE 4​

Get-XdrCloudAppsPolicy -Type OAuth

Retrieves OAuth app policies.

EXAMPLE 5​

Get-XdrCloudAppsPolicy -Type File -PolicyId "abc123"

Retrieves a specific file policy by ID.

EXAMPLE 6​

Get-XdrCloudAppsPolicy -PolicyId "abc123"

Retrieves a policy by ID, automatically discovering the policy type.

EXAMPLE 7​

Get-XdrCloudAppsPolicy -Type ThreatDetection -Metadata

Retrieves metadata for threat detection policies including available filters.

EXAMPLE 8​

Get-XdrCloudAppsPolicy -Type OAuth -Metadata

Retrieves metadata for OAuth policies including available filters.

EXAMPLE 9​

Get-XdrCloudAppsPolicy -Type File -Action

Retrieves available actions for file policies.

EXAMPLE 10​

Get-XdrCloudAppsPolicy -Type OAuth -Action

Retrieves available actions for OAuth policies.

EXAMPLE 11​

Get-XdrCloudAppsPolicy -Type File -PolicyLimit

Retrieves file policy limits and constraints.

EXAMPLE 12​

Get-XdrCloudAppsPolicy -Type ShadowIT -Limit 50 -SortField "name" -SortDirection "asc"

Retrieves 50 Shadow IT policies sorted by name ascending.

EXAMPLE 13​

Get-XdrCloudAppsPolicy -Type Template

Retrieves policy templates.

EXAMPLE 14​

$filters = @ "enabled" = @ "eq" = @($true)  
Get-XdrCloudAppsPolicy -Type InformationProtection -Filters $filters

Retrieves enabled information protection policies.

EXAMPLE 15​

Get-XdrCloudAppsPolicy -Setting

Retrieves policy settings configuration.

EXAMPLE 16​

Get-XdrCloudAppsPolicy -Force

Forces a fresh retrieval of all policies, bypassing the cache.

PARAMETERS​

-Type​

The type of policies to retrieve. Valid values are:

  • ConditionalAccess: Policies controlling access based on conditions
  • File: File policies for data protection
  • InformationProtection: Policies protecting sensitive data
  • OAuth: OAuth app policies for third-party app governance
  • ShadowIT: Policies detecting unsanctioned cloud app usage
  • Template: Pre-configured policy templates
  • ThreatDetection: Policies identifying security threats
Type: String
Parameter Sets: TypedPolicyId, TypedPolicyLimit, TypedAction, TypedMetadata, Typed
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-PolicyId​

The unique identifier of a specific policy to retrieve. If -Type is specified, retrieves from that policy type's endpoint. If -Type is not specified, attempts to discover the policy type automatically.

Type: String
Parameter Sets: TypedPolicyId
Aliases: _id, Id

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
Type: String
Parameter Sets: PolicyIdOnly
Aliases: _id, Id

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Metadata​

When specified with -Type, retrieves metadata including available filters, fields, and configuration options instead of the policies themselves.

Type: SwitchParameter
Parameter Sets: TypedMetadata
Aliases:

Required: True
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-Action​

When specified with -Type File or -Type OAuth, retrieves available actions that can be configured for those policy types.

Type: SwitchParameter
Parameter Sets: TypedAction
Aliases:

Required: True
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-PolicyLimit​

When specified with -Type File, retrieves file policy limits and constraints.

Type: SwitchParameter
Parameter Sets: TypedPolicyLimit
Aliases:

Required: True
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-Setting​

When specified, retrieves policy settings configuration.

Type: SwitchParameter
Parameter Sets: Setting
Aliases:

Required: True
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-Limit​

The maximum number of policies to return. Default is 20.

Type: Int32
Parameter Sets: Default, Typed
Aliases:

Required: False
Position: Named
Default value: 20
Accept pipeline input: False
Accept wildcard characters: False

-Skip​

The number of policies to skip for pagination. Default is 0.

Type: Int32
Parameter Sets: Default, Typed
Aliases:

Required: False
Position: Named
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False

-SortField​

The field to sort results by. Default is "severity".

Type: String
Parameter Sets: Default, Typed
Aliases:

Required: False
Position: Named
Default value: Severity
Accept pipeline input: False
Accept wildcard characters: False

-SortDirection​

The sort direction. Valid values are "asc" or "desc". Default is "desc".

Type: String
Parameter Sets: Default, Typed
Aliases:

Required: False
Position: Named
Default value: Desc
Accept pipeline input: False
Accept wildcard characters: False

-Filters​

A hashtable of filters to apply to the policies query.

Type: Hashtable
Parameter Sets: Default, Typed
Aliases:

Required: False
Position: Named
Default value: @
Accept pipeline input: False
Accept wildcard characters: False

-Force​

Bypasses the cache and retrieves fresh data from the API.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

System.Management.Automation.PSObject​

NOTES​

Requires an active XDR session established via Connect-XdrByEstsCookie.