Get-XdrIdentityServiceAccount
SYNOPSIS
Retrieves service accounts from Microsoft Defender for Identity.
SYNTAX
Get-XdrIdentityServiceAccount [[-AccountType] <String[]>] [[-PageSize] <Int32>] [[-Skip] <Int32>]
[[-IncludeAccountActivity] <Boolean>] [-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Gets service accounts from Microsoft Defender for Identity, including account activity information. Supports filtering by service account type (gMSA, sMSA, User). This function includes caching support with a 10-minute TTL to reduce API calls.
EXAMPLES
EXAMPLE 1
Get-XdrIdentityServiceAccount
Retrieves all service accounts using cached data if available.
EXAMPLE 2
Get-XdrIdentityServiceAccount -AccountType gMSA
Retrieves only group Managed Service Accounts (gMSA).
EXAMPLE 3
Get-XdrIdentityServiceAccount -AccountType sMSA, User
Retrieves standalone Managed Service Accounts (sMSA) and User accounts.
EXAMPLE 4
Get-XdrIdentityServiceAccount -PageSize 50 -Skip 20
Retrieves 50 service accounts, skipping the first 20 (for pagination).
EXAMPLE 5
Get-XdrIdentityServiceAccount -IncludeAccountActivity $false
Retrieves service accounts without account activity information.
EXAMPLE 6
Get-XdrIdentityServiceAccount -Force
Forces a fresh retrieval of service accounts, bypassing the cache.
PARAMETERS
-AccountType
Filters service accounts by type. Valid values are "gMSA", "sMSA", and "User". Multiple values can be specified. If not specified, all service account types are returned.
Type: String[]
Parameter Sets: (All)
Aliases:
Required: False
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-PageSize
The number of service accounts to retrieve per page. Default is 20. Maximum is 100.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: 2
Default value: 20
Accept pipeline input: False
Accept wildcard characters: False
-Skip
The number of service accounts to skip. Used for pagination. Default is 0.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: 3
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False
-IncludeAccountActivity
Whether to include account activity information. Default is $true.
Type: Boolean
Parameter Sets: (All)
Aliases:
Required: False
Position: 4
Default value: True
Accept pipeline input: False
Accept wildcard characters: False
-Force
Bypasses the cache and forces a fresh retrieval from the API.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.