Skip to main content

Get-XdrEndpointDeviceTag

SYNOPSIS

Retrieves all device tags from Microsoft Defender for Endpoint.

SYNTAX

All (Default)

Get-XdrEndpointDeviceTag [-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]

DeviceId

Get-XdrEndpointDeviceTag -DeviceId <String> [-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION

Gets device tags from the Microsoft Defender XDR portal. Supports two modes:

  • All (default): Retrieves all device tags in the tenant.
  • DeviceId: Retrieves tags for a single device via the machineTags API. Returns an object with BuiltInTags, UserDefinedTags, and DynamicRulesTags arrays. Results are cached for 5 minutes. This function includes caching support to reduce API calls.

EXAMPLES

EXAMPLE 1

Get-XdrEndpointDeviceTag
Retrieves all device tags using cached data if available.

EXAMPLE 2

Get-XdrEndpointDeviceTag -Force
Forces a fresh retrieval of device tags, bypassing the cache.

EXAMPLE 3

Get-XdrEndpointDeviceTag -DeviceId "abc123def456"
Returns an object with BuiltInTags, UserDefinedTags, and DynamicRulesTags arrays.

EXAMPLE 4

(Get-XdrEndpointDeviceTag -DeviceId "abc123def456").UserDefinedTags
Returns only the user-defined tags for a single device.

PARAMETERS

-DeviceId

The device identifier (also known as MachineId or SenseMachineId). When specified, retrieves the tags for a single device. Results are cached for 5 minutes.

Type: String
Parameter Sets: DeviceId
Aliases: MachineId, SenseMachineId

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Force

Bypasses the cache and forces a fresh retrieval from the API.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

Object

When using -DeviceId, returns an object with BuiltInTags, UserDefinedTags, and DynamicRulesTags.

When using default mode, returns an array of all device tag strings in the tenant.

NOTES