Set-XdrEndpointDeviceExclusionState
SYNOPSIS
Sets the exclusion state on endpoint devices in Microsoft Defender XDR.
SYNTAX
Set-XdrEndpointDeviceExclusionState [-DeviceId] <String[]> [-ExclusionState] <String>
[[-Justification] <String>] [[-Notes] <String>] [-ProgressAction <ActionPreference>] [-WhatIf] [-Confirm]
[<CommonParameters>]
DESCRIPTION
Updates the exclusion state for one or more endpoint devices. Devices can be excluded from or included in Defender for Endpoint monitoring.
EXAMPLES
EXAMPLE 1
Set-XdrEndpointDeviceExclusionState -DeviceId "abc123" -ExclusionState Excluded -Justification "MachineOutOfScope" -Notes "Lab device"
Excludes the device with a justification and notes.
EXAMPLE 2
Set-XdrEndpointDeviceExclusionState -DeviceId "abc123" -ExclusionState Included
Re-includes a previously excluded device.
PARAMETERS
-DeviceId
One or more device IDs (SenseMachineIds) identifying the target devices.
Type: String[]
Parameter Sets: (All)
Aliases: MachineId, SenseMachineId
Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
-ExclusionState
The exclusion state to set. Valid values: Excluded, Included.
Type: String
Parameter Sets: (All)
Aliases:
Required: True
Position: 2
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Justification
Justification for the exclusion state change. Required when excluding devices.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: 3
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Notes
Additional notes for the exclusion state change.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: 4
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-WhatIf
Shows what would happen if the command runs. The command is not run.
Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Confirm
Prompts for confirmation before making changes.
Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.