ProvisionIntuneDevicesV5

This script checks for the new devices registered in the last x hours and automatically creates objects in Intune for their management using Intune roles

These are the objects created by this script:


AdminRole-OB. Intune Role created for users OB, with specific permissions copied from a custom Role

RoleAssigment-OB. Role assignment of the role AdminRole-OB.

   
The assignment contains the following:


AdminGroup-OB. Scope (Groups). Group that contains the users that has the assignment of that OB. This group will have permission to administer the devices

ScopeGroup-OB. Members. Scope Dynamic group that contains all the users that has the ‘State’ AAD field filled with the OB’s name. This group is the scope of the assignment

Tag-TG. Scope (Tags). Tag created for every OB. The assignment has this Tag as its scope.



The script generates logs that are stored in an storage account in Azure as well as uploaded to a workspace in Log Analytics.

This script in intended to be run as a runbook in Azure

References
https://github.com/Azure/azure-powershell/issues/8486 No way to read passord with the Get-AzAutomationCredential
https://github.com/microsoft/Intune-PowerShell-SDK/blob/master/README.md
https://github.com/microsoft/Intune-PowerShell-Management/tree/master/Samples

OB Office Branch
Required modules:
     Microsoft.Graph.Intune 6.1907.1.0
     AzureADPreview 2.0.2.62
     Az.OperationalInsights 1.3.4
     AZ.Accounts 1.7.1