Get User Related Machines

description retrieve a list of machines associated with a specific user in microsoft defender using the user's unique identifier endpoint url /api/users/{{id}}/machines method get inputs path parameters (object) – required id (string) – required the id is not the full upn, but only the user name (for example, to retrieve machines for user1\@contoso com mailto\ user1\@contoso com use /api/users/user1/machines) output example \[ { "status code" 200, "response headers" { "date" "mon, 26 may 2025 09 21 18 gmt", "content type" "application/json; odata metadata=minimal; odata streaming=true; charset=utf 8", "transfer encoding" "chunked", "connection" "keep alive", "content encoding" "deflate", "vary" "accept encoding", "mise correlation id" "c6ccd948 929b 4073 be4d df4328ff6798", "odata version" "4 0", "strict transport security" "max age=31536000; includesubdomains" }, "reason" "ok", "json body" { "@odata context" "https //api securitycenter microsoft com/api/$metadata#machines", "value" \[ { "id" "machine 1", "computerdnsname" "device1 corp example com", "firstseen" "2024 01 01t00 00 00z", "lastseen" "2024 01 02t00 00 00z", "osplatform" "windows10", "onboardingstatus" "onboarded", "osprocessor" "x64", "version" "10 0 19045", "osbuild" 19045, "lastipaddress" "10 0 0 5", "lastexternalipaddress" "203 0 113 1", "healthstatus" "active", "rbacgroupname" "finance", "rbacgroupid" "group fin 001", "riskscore" "low", "aaddeviceid" "d9f1373e 1733 437e 8f4c 3f77f60d3c92", "machinetags" \[ "laptop", "finance" ], "exposurelevel" "medium", "devicevalue" "high", "ipaddresses" \[ { "ipaddress" "10 0 0 5", "type" "ipv4" }, { "ipaddress" "fe80 abcd", "type" "ipv6" } ], "osarchitecture" "64 bit" }, { "id" "machine 2", "computerdnsname" "device2 corp example com", "firstseen" "2024 03 10t08 15 00z", "lastseen" "2024 03 11t08 15 00z", "osplatform" "windows11", "onboardingstatus" "onboarded", "osprocessor" "x64", "version" "10 0 22000", "osbuild" 22000, "lastipaddress" "10 0 0 10", "lastexternalipaddress" "203 0 113 2", "healthstatus" "inactive", "rbacgroupname" "hr", "rbacgroupid" "group hr 001", "riskscore" "medium", "aaddeviceid" null, "machinetags" \[ "desktop", "hr" ], "exposurelevel" "low", "devicevalue" "normal", "ipaddresses" \[ { "ipaddress" "10 0 0 10", "type" "ipv4" } ], "osarchitecture" "64 bit" } ] } } ] output parameters status code (number) reason (string) json body (object) @odata context (string) value (array) id (string) computerdnsname (string) firstseen (string) lastseen (string) osplatform (string) onboardingstatus (string) osprocessor (string) version (string) osbuild (number) lastipaddress (string) lastexternalipaddress (string) healthstatus (string) rbacgroupname (string) rbacgroupid (string) riskscore (string) aaddeviceid (object) machinetags (array) exposurelevel (string) devicevalue (string) ipaddresses (array) ipaddress (string) type (string) osarchitecture (string) response headers header type date string content type string transfer encoding string connection string content encoding string vary string mise correlation id string odata version string strict transport security string