Get-IntuneGroupAssignments.ps1
|
<#PSScriptInfo
.VERSION 1.0 .GUID ef633ce0-3bae-4f98-9d51-363cc9821a9e .AUTHOR shonpt@outlook.com .COMPANYNAME .COPYRIGHT 2019 Shon Thomas. All rights reserved .TAGS Intune AzureAD Policy Groups Assignments Audit MDM Graph .LICENSEURI .PROJECTURI https://github.com/pixelstroke/Intune.ToolHouse/Scripts .ICONURI .EXTERNALMODULEDEPENDENCIES .REQUIREDSCRIPTS .RELEASENOTES First release supports: Mapping Azure AD group to Intune configuration policy targets Retrieving all Intune configuration policies and their targets .PRIVATEDATA #> <# #Requires -Module AzureAD #Requires -Module Microsoft.Graph.Intune #> <# .NOTES =========================================================================== Created by: Shon Thomas Filename: Get-IntuneGroupAssignments.ps1 Required Modules: AzureAD, Microsoft.Graph.Intune IMPORTANT: YOU MUST RUN Connect-MSGraph -AdminConsent AND AUTHORIZE THE POWERSHELL MODULE IN YOUR TENANT =========================================================================== .SYNOPSIS Get all Intune group assignments for policy targets [included/excluded] .DESCRIPTION This script will connect to Azure AD for the named group ObjectId and use this ID to query all Intune policy objects for any target assignments .EXAMPLE Authenticate with Azure AD and MS Graph and search for "My Group" .\Get-IntuneGroupAssignments.ps1 -Name "My Group" All new queries are cashed into global variables to minimize network requests .\Get-IntuneGroupAssignments.ps1 -Name "My Other Group" Minimize the chatter about policies being retrieved .\Get-IntuneGroupAssignments.ps1 -Name "My Group"-Quiet Include all policies in the result even though they are not assigned directly .\Get-IntuneGroupAssignments.ps1 -Name "Some Group" -All -Quiet Refresh the cash to query Azure AD and MS Graph .\Get-IntuneGroupAssignments.ps1 -Name "My New Group" -Refresh .LINK https://github.com/pixelstroke/ #> #Requires -PSEdition Desktop -Version 5 param ( [Parameter(Mandatory = $true, HelpMessage = "Specify a group in Azure Active Directory")] [String]$Name, [Parameter(Mandatory = $false, HelpMessage = "Limit output in the console")] [Switch]$Quiet, [Parameter(Mandatory = $false, HelpMessage = "Do not limit Intune policy results to the searched Azure Active Directory Group")] [Switch]$All, [Parameter(Mandatory = $false, HelpMessage = "Refresh the cache by calling the MS Graph API")] [Switch]$Refresh ) ### Script ### if ($Refresh) { $Global:isStale = $false } ### Required Modules ### $requiredModules = @('Microsoft.Graph.Intune', 'AzureAD') foreach ($module in $requiredModules) { if (-not (Get-Module -Name $module -ListAvailable)) { Write-Host -ForegroundColor Red "Missing required module " -NoNewline Write-Host $module $input = $null while(-not ($input -imatch "y|yes|n|no")) { $input = Read-Host -Prompt "Install ${module}? [y/n]" if ($input -imatch "y|yes") { Install-Module -Name $module -Scope CurrentUser -AllowClobber -Force } else { Write-Host -ForegroundColor Red "Module not installed: " Write-Host $module Exit } } } Import-Module -Name $module -Force } ### Authenticate with Azure AD ### try { $null = Get-AzureADTenantDetail } catch [Microsoft.Open.Azure.AD.CommonLibrary.AadNeedAuthenticationException] { try { Write-Host -ForegroundColor Yellow "Connecting to Azure AD..." $null = Connect-AzureAD } catch [System.Exception] { Write-Host -ForegroundColor Red "Unable to connect to Azure AD`n" $_.Exception.Message Exit } } Write-Host -ForegroundColor Green "Connected to Azure AD" # # Azure AD - Get group # Write-Host -ForegroundColor Cyan "Searching Azure AD for '${Name}'`n" $filter = "DisplayName eq '${Name}'" $Group = Get-AzureADGroup -Filter "$filter" if (-not $group) { Write-Host -ForegroundColor Yellow "Couldn't find '${Name}' within the directory.`n" Exit } ### Authenticate with MS Graph ### try { Write-Host -ForegroundColor Yellow "Connecting to Microsoft Graph..." $null = Connect-MSGraph } catch [System.Exception] { Write-Host -ForegroundColor Red "Unable to connect to Microsoft Graph `n" $_.Exception.Message Exit } Write-Host -ForegroundColor Green "Connected to Microsoft Graph" ### Class IntuneObject ### class IntuneObject { [String]$Id [String]$Type [String]$PolicyName = "Empty" [Bool]$IsIncluded = $false [Bool]$IsExcluded = $false [Array]$IncludedGroups = "None" [Array]$ExcludedGroups = "None" } ### Function Get-IntuneAssignments ### function Get-IntuneAssignments { param ( [CmdletBinding()] [Parameter(Mandatory = $true, Position = 0, HelpMessage = "Specify object returned from MS Graph API", ParameterSetName = "Policies")] [Object]$Policy, [Parameter(Mandatory = $true, HelpMessage = "Retrieve Conditional Access Settings only", ParameterSetName = "CA")] [Switch]$ConditionalAccess, [Switch]$Quiet ) process { if ($ConditionalAccess) { $IntuneObj = Get-IntuneConditionalAccessSetting | ForEach-Object { $oDataType = ($_ | Get-Member | Select-Object -First 1).TypeName.Replace('microsoft.graph.', '') if (-not $Quiet) { Write-Host -ForegroundColor Blue "Retrieving Conditional Access settings..." -NoNewline Write-Host -ForegroundColor Yellow "[${oDataType}] " } $data = @{ Id = $_.id Type = $oDataType IncludedGroups = $_.includedGroups ExcludedGroups = $_.excludedGroups } return New-Object -TypeName IntuneObject -Property $data } return $IntuneObj } $oDataType = ($Policy | Get-Member | Select-Object -First 1).TypeName.Replace('microsoft.graph.', '') if (-not $Quiet) { Write-Host -ForegroundColor Blue "Retrieving assignment policy:" -NoNewline Write-Host -ForegroundColor Yellow "[${oDataType}] " -NoNewline Write-Host -ForegroundColor White "$($Policy.displayName)" } # # Return IntuneObject # $IntuneObj = New-Object -TypeName IntuneObject $IntuneObj.Id = $Policy.id $IntuneObj.PolicyName = $Policy.displayName $IntuneObj.Type = $oDataType $IntuneObj.IncludedGroups = $Policy.assignments.target | Where-Object { $_.'@odata.type' -inotmatch 'exclusion' } $IntuneObj.ExcludedGroups = $Policy.assignments.target | Where-Object { $_.'@odata.type' -imatch 'exclusion' } return $IntuneObj } } function Get-IntuneIsAssigned { param ( [CmdletBinding()] [Parameter(Mandatory = $true, Position = 0, HelpMessage = "Specify object that is a type of IntuneObject", ParameterSetName = "SingleIntuneObject")] [IntuneObject]$IntuneObject, [Parameter(Mandatory = $true, Position = 0, HelpMessage = "Specify a list of objects that are type of IntuneObject", ParameterSetName = "ManyIntuneObjects")] [Array]$IntuneObjectList, [Parameter(Mandatory = $true, HelpMessage = "Specify the AzureAD ObjectId")] [String]$ObjectId, [Parameter(HelpMessage = "Use the switch to include all objects unfiltered")] [Switch]$All ) process { if ($IntuneObject) { if ($IntuneObject.IncludedGroups -imatch $ObjectId) { $IntuneObject.IsIncluded = $true } else { $IntuneObject.IsIncluded = $false } if ($IntuneObject.ExcludedGroups -imatch $ObjectId) { $IntuneObject.IsExcluded = $true } else { $IntuneObject.IsExcluded = $false } if ($All) { return $IntuneObject } return $IntuneObject | Where-Object { $_.IncludedGroups -imatch $ObjectId -or $_.ExcludedGroups -imatch $ObjectId } } if ($IntuneObjectList) { [System.Collections.ArrayList]$List = @() foreach ($iObj in $IntuneObjectList) { if ($All) { [Void]$List.Add( (Get-IntuneIsAssigned -IntuneObject $iObj -ObjectId $ObjectId -All) ) } else { $objectToAdd = Get-IntuneIsAssigned -IntuneObject $iObj -ObjectId $ObjectId if ($objectToAdd) { [Void]$List.Add($objectToAdd) } } } return $List } } } try ## Collect configurations { # # Intune - Collect configuration data # if (-not $isStale) { Write-Host -ForegroundColor Cyan "Collecting Intune configuration objects...`n" $Global:DeviceConfigAssignments = Get-IntuneDeviceConfigurationPolicy -Select id, displayName -Expand assignments| ForEach-Object { Get-IntuneAssignments -Policy $_ -Quiet:$Quiet } $Global:DeviceComplianceAssignments = Get-IntuneDeviceCompliancePolicy -Select id, displayName -Expand assignments | ForEach-Object { Get-IntuneAssignments -Policy $_ -Quiet:$Quiet } $Global:MobileAppAssignments = Get-IntuneMobileApp -Select id, displayName -Expand assignments | ForEach-Object { Get-IntuneAssignments -Policy $_ -Quiet:$Quiet } $Global:AppProtectionPoliciesAndroid = Get-IntuneAppProtectionPolicyAndroid -Select id, displayName -Expand assignments | ForEach-Object { Get-IntuneAssignments -Policy $_ -Quiet:$Quiet } $Global:AppProtectionPoliciesiOS = Get-IntuneAppProtectionPolicyiOS -Select id, displayName -Expand assignments | ForEach-Object { Get-IntuneAssignments -Policy $_ -Quiet:$Quiet } $Global:WindowsInformationProtection = Get-IntuneWindowsInformationProtectionPolicy -Select id, displayName -Expand assignments | ForEach-Object { Get-IntuneAssignments -Policy $_ -Quiet:$Quiet } $Global:ConditionalAccessSettings = Get-IntuneAssignments -ConditionalAccess -Quiet:$Quiet } } catch [System.Exception] { Write-Host -ForegroundColor Red "Script encountered an error retrieving Intune policies..." Write-Host -ForegroundColor Red $_.Exception.Message } finally { $Global:isStale = $false } try ## Collect assignments { # # Global assignment list # [System.Collections.ArrayList]$Global:IntuneGroupAssignments = @() # # Intune - Search for named group in assignments # Write-Host -ForegroundColor Cyan 'Retrieving group assignments for ' -NoNewline Write-Host -ForegroundColor White "${Name}" Write-Host -ForegroundColor Cyan "Group ObjectId " -NoNewline Write-Host -ForegroundColor White "$($Group.ObjectId)" Get-IntuneIsAssigned -IntuneObjectList $DeviceConfigAssignments -ObjectId $Group.ObjectId -All:$All | ForEach-Object { [Void]$IntuneGroupAssignments.Add($_) } Get-IntuneIsAssigned -IntuneObjectList $DeviceComplianceAssignments -ObjectId $Group.ObjectId -All:$All | ForEach-Object { [Void]$IntuneGroupAssignments.Add($_) } Get-IntuneIsAssigned -IntuneObjectList $MobileAppAssignments -ObjectId $Group.ObjectId -All:$All | ForEach-Object { [Void]$IntuneGroupAssignments.Add($_) } Get-IntuneIsAssigned -IntuneObjectList $AppProtectionPoliciesAndroid -ObjectId $Group.ObjectId -All:$All | ForEach-Object { [Void]$IntuneGroupAssignments.Add($_) } Get-IntuneIsAssigned -IntuneObjectList $AppProtectionPoliciesiOS -ObjectId $Group.ObjectId -All:$All | ForEach-Object { [Void]$IntuneGroupAssignments.Add($_) } Get-IntuneIsAssigned -IntuneObjectList $WindowsInformationProtection -ObjectId $Group.ObjectId -All:$All | ForEach-Object { [Void]$IntuneGroupAssignments.Add($_) } Get-IntuneIsAssigned -IntuneObjectList $ConditionalAccessSettings -ObjectId $Group.ObjectId -All:$All | ForEach-Object { [Void]$IntuneGroupAssignments.Add($_) } # # Intune - Display all assignments # if ($IntuneGroupAssignments.Count -eq 0) { Write-Host -ForegroundColor Green "Group ${Name} is not part of any Intune policy assignments" } else { if (-not $All) { Write-Host -ForegroundColor Cyan "Total number of assignments: " -NoNewline Write-Host -ForegroundColor White "($($IntuneGroupAssignments.Count))" $IntuneGroupAssignments | Sort-Object -Property Type, IsIncluded | Select-Object Type, PolicyName, IsIncluded, IsExcluded | Format-Table -AutoSize } else { Write-Host -ForegroundColor Cyan "Total number of policies: " -NoNewline Write-Host -ForegroundColor White "($($IntuneGroupAssignments.Count))" $IntuneGroupAssignments | Select-Object Type, DisplayName, IsIncluded, IsExcluded | Group-Object Type | Sort-Object Name } Write-Host -ForegroundColor White "`nMore details available in " -NoNewline Write-Host -ForegroundColor Green '$IntuneGroupAssignments' } # # Minimize requests if Intune environment hasn't changed between queries # $Global:isStale = $true } catch [System.Exception] { Write-Host -ForegroundColor Red "Script encountered an error retrieving policy assignments...`n" Write-Host -ForegroundColor Red $_.Exception.Message $Global:isStale = $false } |