POWERSHELL COMMAND
Remove-XdrIdentityConfigurationRemediationActionAccount
Removes a remediation action account from Microsoft Defender for Identity.
Deletes a registered Group Managed Service Account (gMSA) from Microsoft Defender for Identity remediation actions. The account will no longer be used for automatic remediation actions.
Syntax
Remove-XdrIdentityConfigurationRemediationActionAccount [-Id] <string> [-WhatIf] [-Confirm] [<CommonParameters>]
Parameters
-Id
| Property | Value |
|---|---|
| Type | String |
| Required | Yes |
| Position | 1 |
| Pipeline input | true (ByValue, ByPropertyName) |
| Default | Not documented |
The User Principal Name (UPN) of the remediation account to remove. Must be in the format: accountname@domain.com Accepts pipeline input.
-WhatIf
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | Not documented |
Shows what would happen if the cmdlet runs. The cmdlet is not run.
-Confirm
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | Not documented |
Prompts for confirmation before removing each account.
Examples
Remove-XdrIdentityConfigurationRemediationActionAccount -Id "MDIRemediation@contoso.com"
Removes the specified remediation action account.
"DefenderRemediator@corp.contoso.com" | Remove-XdrIdentityConfigurationRemediationActionAccount
Removes the remediation account using pipeline input.
$accounts = Get-XdrIdentityConfigurationRemediationActionAccount
$accounts.RemediationAccounts | ForEach-Object {
Remove-XdrIdentityConfigurationRemediationActionAccount -Id $_.Id
}
Removes all registered remediation accounts.
Get-XdrIdentityConfigurationRemediationActionAccount |
Select-Object -ExpandProperty RemediationAccounts |
Remove-XdrIdentityConfigurationRemediationActionAccount
Removes all remediation accounts using pipeline input.
Output
Type: None
This cmdlet does not return any output.