Skip to main content

Get-XdrIdentityUser

SYNOPSIS​

Retrieves detailed user identity information from Microsoft Defender for Identity.

SYNTAX​

ByUpn (Default)​

Get-XdrIdentityUser -Upn <String> [-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]

ByAadId​

Get-XdrIdentityUser -AadId <String> [-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]

BySid​

Get-XdrIdentityUser -Sid <String> [-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]

ByRadiusUserId​

Get-XdrIdentityUser -RadiusUserId <String> [-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION​

Gets comprehensive user identity information by resolving identifiers across multiple workloads including Microsoft Graph, RADIUS, MCAS, MTP, MDI, and Sentinel.

This cmdlet calls the user/resolve API to get full identity details including:

  • All user identifiers (AAD ID, SID, UPN, radiusUserId, complexId, armId)
  • User profile information (displayName, email, phone, department, jobTitle)
  • Security information (riskLevel, status, PIM roles)
  • Activity timestamps (firstSeen, lastSeen, created)
  • Cloud app accounts, activity period, devices count, and manager details when available

The returned object can be piped to Get-XdrIdentityUserTimeline for timeline retrieval.

EXAMPLES​

EXAMPLE 1​

Get-XdrIdentityUser -Upn "nathan@contoso.com"

Retrieves user identity information by UPN.

EXAMPLE 2​

Get-XdrIdentityUser -AadId "a2307c5a-76df-4513-b575-0537842c1d8b"

Retrieves user identity information by Azure AD object ID.

EXAMPLE 3​

Get-XdrIdentityUser -Upn "nathan@contoso.com"

Retrieves user identity including enrichment data (accounts, activity period, devices count, manager when available).

EXAMPLE 4​

Get-XdrIdentityUser -Upn "nathan@contoso.com" | Get-XdrIdentityUserTimeline -LastNDays 7

Retrieves user identity and pipes to timeline cmdlet.

PARAMETERS​

-AadId​

The Azure AD object ID of the user.

Type: String
Parameter Sets: ByAadId
Aliases: aad, ObjectId

Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-Upn​

The User Principal Name (email address) of the user.

Type: String
Parameter Sets: ByUpn
Aliases: UserPrincipalName, Email

Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName, ByValue)
Accept wildcard characters: False

-Sid​

The Security Identifier (SID) of the user.

Type: String
Parameter Sets: BySid
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-RadiusUserId​

The RADIUS user ID in format "User_tenantId_userId".

Type: String
Parameter Sets: ByRadiusUserId
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-Force​

Bypass cache and force a fresh API call.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

XdrIdentityUser​

Returns a typed user identity object containing resolved identifiers and profile data.​

NOTES​

The returned object contains an 'ids' property with all resolved identifiers that can be used with other identity cmdlets.