Skip to main content

Remove-XdrIdentityConfigurationRemediationActionAccount

SYNOPSIS​

Removes a remediation action account from Microsoft Defender for Identity.

SYNTAX​

Remove-XdrIdentityConfigurationRemediationActionAccount [-Id] <String> [-ProgressAction <ActionPreference>]
 [-WhatIf] [-Confirm] [<CommonParameters>]

DESCRIPTION​

Deletes a registered Group Managed Service Account (gMSA) from Microsoft Defender for Identity remediation actions. The account will no longer be used for automatic remediation actions.

EXAMPLES​

EXAMPLE 1​

Remove-XdrIdentityConfigurationRemediationActionAccount -Id "MDIRemediation@contoso.com"
Removes the specified remediation action account.

EXAMPLE 2​

"DefenderRemediator@corp.contoso.com" | Remove-XdrIdentityConfigurationRemediationActionAccount
Removes the remediation account using pipeline input.

EXAMPLE 3​

$accounts = Get-XdrIdentityConfigurationRemediationActionAccount
$accounts.RemediationAccounts | ForEach-Object 
    Remove-XdrIdentityConfigurationRemediationActionAccount -Id $_.Id

Removes all registered remediation accounts.

EXAMPLE 4​

Get-XdrIdentityConfigurationRemediationActionAccount |
    Select-Object -ExpandProperty RemediationAccounts |
    Remove-XdrIdentityConfigurationRemediationActionAccount
Removes all remediation accounts using pipeline input.

PARAMETERS​

-Id​

The User Principal Name (UPN) of the remediation account to remove. Must be in the format: accountname@domain.com Accepts pipeline input.

Type: String
Parameter Sets: (All)
Aliases:

Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName, ByValue)
Accept wildcard characters: False

-WhatIf​

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Confirm​

Prompts for confirmation before removing each account.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

None​

This cmdlet does not return any output.​

NOTES​

  • The Id parameter must be a valid UPN format (accountname@domain.com)
  • No response is expected from the API after successful deletion
  • After removing an account, consider configuring MDI to use Local System or registering a new account