Skip to main content

Remove-XdrConfigurationCriticalAssetManagementClassification

SYNOPSIS​

Removes a Critical Asset Management classification rule from Microsoft Defender XDR.

SYNTAX​

ByRuleId (Default)​

Remove-XdrConfigurationCriticalAssetManagementClassification [-RuleId] <String> [-Force]
 [-ProgressAction <ActionPreference>] [-WhatIf] [-Confirm] [<CommonParameters>]

ByInputObject​

Remove-XdrConfigurationCriticalAssetManagementClassification -InputObject <PSObject> [-Force]
 [-ProgressAction <ActionPreference>] [-WhatIf] [-Confirm] [<CommonParameters>]

DESCRIPTION​

Deletes a user-created Critical Asset Management classification rule. This operation marks the rule as deleted and it will no longer be evaluated against assets.

Note: Only user-created rules (ruleType = "CreatedByUser") can be deleted. Predefined rules cannot be deleted, only disabled.

EXAMPLES​

EXAMPLE 1​

Remove-XdrConfigurationCriticalAssetManagementClassification -RuleId "b2ccb988-5761-4947-93da-12e7c0ae6171"
Deletes the specified rule after confirmation.

EXAMPLE 2​

Remove-XdrConfigurationCriticalAssetManagementClassification -RuleId "b2ccb988-5761-4947-93da-12e7c0ae6171" -Force
Deletes the specified rule without confirmation.

EXAMPLE 3​

Get-XdrConfigurationCriticalAssetManagementClassification -RuleId "b2ccb988-5761-4947-93da-12e7c0ae6171" |
    Remove-XdrConfigurationCriticalAssetManagementClassification
Pipes a rule object to delete it.

EXAMPLE 4​

Get-XdrConfigurationCriticalAssetManagementClassification -RuleType CreatedByUser |
    Where-Object  $_.ruleName -like "*Test*"  |
    Remove-XdrConfigurationCriticalAssetManagementClassification -Force
Deletes all user-created rules with "Test" in the name.

EXAMPLE 5​

# Full create and cleanup workflow
$rule = New-XdrConfigurationCriticalAssetManagementClassification `
    -RuleName "Temporary Test Rule" `
    -RuleDescription "Rule for testing" `
    -AssetType Devices -CriticalityLevel Low `
    -Property "Tags" -Operator Contains -Value "TestTag" `
    -PassThru

Verify creation

Get-XdrConfigurationCriticalAssetManagementClassification -RuleId $rule.ruleId

Remove when done testing

$rule | Remove-XdrConfigurationCriticalAssetManagementClassification -Force

Creates a rule, verifies it exists, then removes it.

PARAMETERS​

-RuleId​

The unique identifier of the rule to delete.

Type: String
Parameter Sets: ByRuleId
Aliases:

Required: True
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-InputObject​

A rule object from Get-XdrConfigurationCriticalAssetManagementClassification to delete. Can be piped to this cmdlet.

Type: PSObject
Parameter Sets: ByInputObject
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: False

-Force​

Suppresses the confirmation prompt before deleting the rule.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-WhatIf​

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Confirm​

Prompts you for confirmation before running the cmdlet.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

None​

This cmdlet does not return any output on success.​

NOTES​

  • Only user-created rules can be deleted
  • Predefined rules cannot be deleted; use Set-XdrConfigurationCriticalAssetManagementClassification to disable them
  • This operation is permanent and cannot be undone