Skip to main content

Set-XdrConfigurationCriticalAssetManagementClassification

SYNOPSIS​

Updates critical asset management classification rule metadata in Microsoft Defender XDR.

SYNTAX​

ByRuleId (Default)​

Set-XdrConfigurationCriticalAssetManagementClassification -RuleId <String> -Enabled <Boolean> [-PassThru]
 [-ProgressAction <ActionPreference>] [-WhatIf] [-Confirm] [<CommonParameters>]

ByInputObject​

Set-XdrConfigurationCriticalAssetManagementClassification -InputObject <PSObject> -Enabled <Boolean>
 [-PassThru] [-ProgressAction <ActionPreference>] [-WhatIf] [-Confirm] [<CommonParameters>]

DESCRIPTION​

Modifies critical asset management rules in the Microsoft Defender XDR portal. This function allows enabling or disabling rules by updating their metadata.

Critical asset management allows you to define classification rules that identify high-value assets in your organization, such as privileged accounts, critical servers, or sensitive data repositories.

EXAMPLES​

EXAMPLE 1​

Set-XdrConfigurationCriticalAssetManagementClassification -RuleId "55a3f458c38a4b53b7d6a5564e0d1ac7" -Enabled $true
Enables the critical asset management rule with the specified ID.

EXAMPLE 2​

Set-XdrConfigurationCriticalAssetManagementClassification -RuleId "55a3f458c38a4b53b7d6a5564e0d1ac7" -Enabled $false
Disables the critical asset management rule with the specified ID.

EXAMPLE 3​

Get-XdrConfigurationCriticalAssetManagementClassification -RuleType Predefined -Enabled $false |
    Set-XdrConfigurationCriticalAssetManagementClassification -Enabled $true
Enables all disabled predefined critical asset management rules using pipeline.

EXAMPLE 4​

Set-XdrConfigurationCriticalAssetManagementClassification -RuleId "55a3f458c38a4b53b7d6a5564e0d1ac7" -Enabled $true -PassThru
Enables the rule and returns the updated rule object.

EXAMPLE 5​

Set-XdrConfigurationCriticalAssetManagementClassification -RuleId "55a3f458c38a4b53b7d6a5564e0d1ac7" -Enabled $true -WhatIf
Shows what would happen if the rule were enabled, without making any changes.

EXAMPLE 6​

# Create a rule, then disable it
$rule = New-XdrConfigurationCriticalAssetManagementClassification `
    -RuleName "Temp Rule" -RuleDescription "Test" `
    -AssetType Devices -CriticalityLevel Low `
    -Property "Tags" -Operator Contains -Value "Test" -PassThru

$rule | Set-XdrConfigurationCriticalAssetManagementClassification -Enabled $false

Creates a new rule and immediately disables it using the pipeline.

PARAMETERS​

-RuleId​

The unique identifier of the rule to update. This parameter is mandatory when not using -InputObject.

Type: String
Parameter Sets: ByRuleId
Aliases: id

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-InputObject​

A rule object from Get-XdrConfigurationCriticalAssetManagementClassification. When provided, avoids an extra API call to fetch rule details. Can be piped directly to this cmdlet.

Type: PSObject
Parameter Sets: ByInputObject
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: False

-Enabled​

Sets whether the rule should be enabled or disabled. Use $true to enable the rule or $false to disable it.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: True
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-PassThru​

When specified, returns the updated rule object after the operation completes. By default, this cmdlet does not generate any output.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-WhatIf​

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Confirm​

Prompts you for confirmation before running the cmdlet.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

System.Object​

You can pipe objects containing a 'ruleId', 'RuleId', or 'id' property to this cmdlet.​

OUTPUTS​

None by default. System.Object if -PassThru is specified.​

When PassThru is used, returns the updated rule object from Get-XdrConfigurationCriticalAssetManagementClassification.​

NOTES​

The PATCH endpoint updates rule metadata including the enabled state. After modifying a rule, the local cache is cleared to ensure subsequent Get-XdrConfigurationCriticalAssetManagementClassification calls return fresh data.