Skip to main content

Get-XdrIdentityConfigurationDirectoryServiceAccount

SYNOPSIS

Retrieves directory service accounts for Microsoft Defender for Identity.

SYNTAX

Paged (Default)

Get-XdrIdentityConfigurationDirectoryServiceAccount [-PageSize <Int32>] [-Skip <Int32>] [-Force]
[-ProgressAction <ActionPreference>] [<CommonParameters>]

All

Get-XdrIdentityConfigurationDirectoryServiceAccount [-All] [-Force] [-ProgressAction <ActionPreference>]
[<CommonParameters>]

DESCRIPTION

Gets the directory service accounts (gMSA) configured for Microsoft Defender for Identity sensors. These accounts are used by MDI sensors to query Active Directory. This function includes caching support with a 30-minute TTL to reduce API calls.

EXAMPLES

EXAMPLE 1

Get-XdrIdentityConfigurationDirectoryServiceAccount
Retrieves the first 20 directory service accounts using cached data if available.

EXAMPLE 2

Get-XdrIdentityConfigurationDirectoryServiceAccount -PageSize 50 -Skip 20
Retrieves 50 accounts, skipping the first 20 (for pagination).

EXAMPLE 3

Get-XdrIdentityConfigurationDirectoryServiceAccount -All
Retrieves all directory service accounts by automatically paging through all results.

EXAMPLE 4

Get-XdrIdentityConfigurationDirectoryServiceAccount -Force
Forces a fresh retrieval of directory service accounts, bypassing the cache.

EXAMPLE 5

Get-XdrIdentityConfigurationDirectoryServiceAccount -All |
Where-Object $_.IsGroupManagedServiceAccount -eq $true
Retrieves all directory service accounts and filters for gMSAs.

PARAMETERS

-PageSize

The number of accounts to retrieve per page. Default is 20.

Type: Int32
Parameter Sets: Paged
Aliases:

Required: False
Position: Named
Default value: 20
Accept pipeline input: False
Accept wildcard characters: False

-Skip

The number of accounts to skip. Used for pagination. Default is 0.

Type: Int32
Parameter Sets: Paged
Aliases:

Required: False
Position: Named
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False

-All

Retrieves all directory service accounts by automatically paging through all results. When specified, PageSize and Skip parameters are ignored.

Type: SwitchParameter
Parameter Sets: All
Aliases:

Required: True
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-Force

Bypasses the cache and forces a fresh retrieval from the API.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

Object[]

Returns an array of directory service account objects containing:

- Id: User Principal Name of the account

- AccountName: Account name without domain

- DomainDnsName: Fully qualified domain name

- AccountPassword: Always null for gMSA accounts

- IsGroupManagedServiceAccount: Boolean indicating if account is a gMSA

- IsSingleLabelAccountDomainName: Boolean for single-label domain configuration

NOTES