IntuneAssignmentChecker
4.3.0
Analyze and audit Microsoft Intune policy assignments. Check user, group, and device assignments, simulate group membership changes, search policies and settings, generate HTML reports, and more.
Minimum PowerShell version
7.0
Installation Options
Owners
Copyright
(c) Ugur Koc. All rights reserved.
Package Details
Author(s)
- Ugur Koc
Tags
Intune MEM Endpoint Assignment Policy Settings Audit Microsoft Graph
Functions
Invoke-IntuneAssignmentChecker Connect-IntuneAssignmentChecker Get-IntuneUserAssignment Get-IntuneGroupAssignment Get-IntuneDeviceAssignment Get-IntuneUserDeviceAssignment Get-IntuneAllPolicies Get-IntuneAllUsersAssignment Get-IntuneAllDevicesAssignment New-IntuneHTMLReport Get-IntuneUnassignedPolicy Get-IntuneEmptyGroup Compare-IntuneGroupAssignment Get-IntuneFailedAssignment Test-IntuneGroupMembership Test-IntuneGroupRemoval Search-IntunePolicy Search-IntuneSetting Update-IntuneSettingDefinition
Dependencies
Release Notes
Version 4.3.0:
- Show applications where the checked group is excluded in Get-IntuneGroupAssignment; Compare-IntuneGroupAssignment now marks excluded apps with [EXCLUDED] (issue #126).
- Rebuild the ten category-walk cmdlets on a shared scan engine: entity sets are fetched once per run (dozens fewer Graph calls), transient per-category failures no longer abort a run, and errors are raised on the error stream for automation (issue #123).
- Fix App Protection policies showing for every user regardless of group membership, app intent misclassification, broken multi-device input, junk rows in CSV exports, missing pagination past 100 items in group memberships / comparisons / assignment failures, and Get-IntuneEmptyGroup categories that were displayed but never checked.
- Security hardening: HTML-encode report values, escape OData group-name filters, URL-encode guest UPNs, add -ClientSecretCredential (PSCredential) as the preferred client secret input.
- Fix EDR policies missing from HTML reports due to a template mapping typo.
- Switch-Tenant now connects with the correct permission scopes and refreshes cached filter and group lookups.
- Register-IntuneAssignmentCheckerApp grants all documented permissions, uses a cross-platform temp path, and cleans up its temporary client secret on failure (issue #124).
Version 4.2.0:
- Add -AccessToken (SecureString) parameter for non-interactive authentication using a pre-fetched Microsoft Graph token (Azure Automation managed identities, Azure Functions, federated credentials, parent-script Connect-MgGraph sessions).
- Extend Test-IntuneGroupMembership and Test-IntuneGroupRemoval to accept a Device in addition to a User. The simulation now unions user-side and device-side group memberships.
- Add Option 16: What-If for a User on a specific Device. Lists every policy and app that would apply to that user/device pair, with a Source column indicating whether each assignment came from the user, the device, or both.
Version 4.1.0:
- Show Intune assignment filters on all assignments (issue #122). Filter name and include/exclude type now appear in console output, CSV exports, and HTML reports across all assignment, simulation, and search cmdlets.
- Add Get-AssignmentFilterLookup to cache filter metadata at connection time.
Version 4.0.0:
- BREAKING: Converted from script to PowerShell module (use Install-Module instead of Install-Script)
- Add Option 12: Simulate Group Membership Impact
- Add Option 13: Simulate Removing User from Group
- Add Option 14: Search Policy Assignments (reverse lookup)
- Add Option 15: Search for Specific Settings (across Settings Catalog and Endpoint Security)
- Add terminal-width-aware separators
- Add UPN format validation before network calls
- Normalize y/n prompts to accept Y/y/Yes/yes
- Fix app platform detection showing Windows apps (win32LobApp, winGetApp, microsoftStoreForBusinessApp, officeSuiteApp) as Multi-Platform in HTML report
- Remove deprecated groupPolicyConfigurations (Administrative Templates) policy type
- Migrate deviceStatuses API endpoints
- Fix hardcoded Graph URLs to use dynamic GraphEndpoint
- All features available as individual cmdlets (e.g., Get-IntuneUserAssignment, Search-IntuneSetting)
FileList
- IntuneAssignmentChecker.nuspec
- Data\SettingDefinitions.json
- IntuneAssignmentChecker.psd1
- IntuneAssignmentChecker.psm1
- Private\Add-AppExportData.ps1
- Private\Add-CategoryExportData.ps1
- Private\Add-ExportData.ps1
- Private\Add-IntentTemplateFamilyInfo.ps1
- Private\Export-PolicyData.ps1
- Private\Export-ResultsIfRequested.ps1
- Private\Filter-ByScopeTag.ps1
- Private\Format-AssignmentFilter.ps1
- Private\Format-AssignmentSummaryLine.ps1
- Private\Get-AllTargetReason.ps1
- Private\Get-AppProtectionAssignmentUri.ps1
- Private\Get-AssignmentFailures.ps1
- Private\Get-AssignmentFilterLookup.ps1
- Private\Get-AssignmentInfo.ps1
- Private\Get-DeviceInfo.ps1
- Private\Get-GroupAssignmentReasons.ps1
- Private\Get-GroupInfo.ps1
- Private\Get-GroupMemberships.ps1
- Private\Get-IntentTemplateFamilyLookup.ps1
- Private\Get-IntuneAssignments.ps1
- Private\Get-IntuneCategoryDefinition.ps1
- Private\Get-IntuneEntities.ps1
- Private\Get-PolicyPlatform.ps1
- Private\Get-ScopeTagLookup.ps1
- Private\Get-ScopeTagNames.ps1
- Private\Get-Separator.ps1
- Private\Get-TransitiveGroupMembership.ps1
- Private\Get-UserInfo.ps1
- Private\Invoke-IntuneCategoryScan.ps1
- Private\Invoke-MultipleAssignments.ps1
- Private\Resolve-AssignmentReason.ps1
- Private\Resolve-SimulatedAssignmentDelta.ps1
- Private\Set-Environment.ps1
- Private\Show-CategoryResultTable.ps1
- Private\Show-Menu.ps1
- Private\Show-SaveFileDialog.ps1
- Private\Switch-Tenant.ps1
- Private\Test-AppPlatformCompatibility.ps1
- Private\Test-PlatformCompatibility.ps1
- Public\Compare-IntuneGroupAssignment.ps1
- Public\Connect-IntuneAssignmentChecker.ps1
- Public\Get-IntuneAllDevicesAssignment.ps1
- Public\Get-IntuneAllPolicies.ps1
- Public\Get-IntuneAllUsersAssignment.ps1
- Public\Get-IntuneDeviceAssignment.ps1
- Public\Get-IntuneEmptyGroup.ps1
- Public\Get-IntuneFailedAssignment.ps1
- Public\Get-IntuneGroupAssignment.ps1
- Public\Get-IntuneUnassignedPolicy.ps1
- Public\Get-IntuneUserAssignment.ps1
- Public\Get-IntuneUserDeviceAssignment.ps1
- Public\Invoke-IntuneAssignmentChecker.ps1
- Public\New-IntuneHTMLReport.ps1
- Public\Search-IntunePolicy.ps1
- Public\Search-IntuneSetting.ps1
- Public\Test-IntuneGroupMembership.ps1
- Public\Test-IntuneGroupRemoval.ps1
- Public\Update-IntuneSettingDefinition.ps1
- html-export.ps1
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 4.3.0 (current version) | 20 | 7/3/2026 |
| 4.2.0 | 1,892 | 4/28/2026 |
| 4.1.0 | 85 | 4/27/2026 |
| 4.0.0 | 188 | 4/21/2026 |