Intune Group Assignment Audit
Sweeps every assignable Intune resource type — apps, profiles, policies, scripts, Autopilot, enrollment configs — and reports everything actually targeted to one Entra group.
Overview
Intune spreads what's assigned to a group across more than a dozen separate blades — apps, configuration profiles, compliance policies, endpoint security, scripts, Autopilot profiles, enrollment configs — and none of them cross-reference each other. Answering "what does this group actually get" meant opening each blade in turn and writing down what matched.
Objective
One script, one group, one answer: every app, policy, script and profile assigned to a given Entra group, across every Intune surface that supports assignment, without opening more than one blade.
Approach
A resource map lists every assignable Intune surface as a Graph beta path — mobile apps, app configuration and protection policies, device configurations, the settings catalog, administrative templates, compliance policies, endpoint security intents, platform and shell scripts, proactive remediations, Autopilot profiles, and enrollment configurations. The script takes a group name or Object ID, auto-detecting which it is, then walks that resource map, paging through each endpoint with $expand=assignments, and keeps only the assignments whose target group ID matches.
Solution
Run it, enter a group name or ID, and it checks each resource type in turn — printing progress as it goes — before dropping every match, grouped by category and sorted by name, into the terminal and a CSV. Each row carries the assignment's category, the resource's real name and type, its intent (required / available / uninstall, for apps), and whether the group is included in or excluded from that assignment — enough to see not just that something is assigned, but what kind.
When nothing matches, it says so instead of returning an empty file — plenty of groups exist for licensing or mail distribution, not device management, and that's a useful answer on its own.
Technology
- PowerShell
- Microsoft Graph
- Microsoft Intune
Outcome
A question that used to mean opening a dozen separate Intune blades is now one script, one prompt, and one CSV — sorted and grouped by category, ready to hand to whoever asked.