Get-XdrEndpointDeviceTag
SYNOPSIS
Retrieves all device tags from Microsoft Defender for Endpoint.
SYNTAX
All (Default)
Get-XdrEndpointDeviceTag [-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]
DeviceId
Get-XdrEndpointDeviceTag -DeviceId <String> [-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Gets device tags from the Microsoft Defender XDR portal. Supports two modes:
- All (default): Retrieves all device tags in the tenant.
- DeviceId: Retrieves tags for a single device via the machineTags API. Returns an object with BuiltInTags, UserDefinedTags, and DynamicRulesTags arrays. Results are cached for 5 minutes. This function includes caching support to reduce API calls.
EXAMPLES
EXAMPLE 1
Get-XdrEndpointDeviceTag
Retrieves all device tags using cached data if available.
EXAMPLE 2
Get-XdrEndpointDeviceTag -Force
Forces a fresh retrieval of device tags, bypassing the cache.
EXAMPLE 3
Get-XdrEndpointDeviceTag -DeviceId "abc123def456"
Returns an object with BuiltInTags, UserDefinedTags, and DynamicRulesTags arrays.
EXAMPLE 4
(Get-XdrEndpointDeviceTag -DeviceId "abc123def456").UserDefinedTags
Returns only the user-defined tags for a single device.
PARAMETERS
-DeviceId
The device identifier (also known as MachineId or SenseMachineId). When specified, retrieves the tags for a single device. Results are cached for 5 minutes.
Type: String
Parameter Sets: DeviceId
Aliases: MachineId, SenseMachineId
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Force
Bypasses the cache and forces a fresh retrieval from the API.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.