TenantLens

0.5.0

Rules/INT-003.no-unassigned-profiles.psd1

@{
    Id          = 'INT-003'
    Title       = 'No orphaned configuration profiles without assignments'
    Area        = 'IntuneConfiguration'
    Severity    = 'Low'
    References  = @(
        'https://learn.microsoft.com/intune/intune-service/configuration/device-profiles'
    )
    Rationale   = 'Unassigned profiles do nothing but suggest coverage that does not exist - and they rot silently until someone assigns them by accident.'
    Remediation = 'Assign the flagged profiles to the intended groups or delete them.'
    Test        = {
        param($Snapshot)
        $configurationData = $Snapshot.IntuneConfiguration
        $unassigned = @()
        foreach ($configurationProfile in @($configurationData.deviceConfigurations)) {
            if (@($configurationProfile.assignments).Count -eq 0) { $unassigned += [string]$configurationProfile.displayName }
        }
        foreach ($policy in @($configurationData.settingsCatalogPolicies)) {
            if (@($policy.assignments).Count -eq 0) {
                $label = $(if ($policy.PSObject.Properties['name'] -and $policy.name) { [string]$policy.name } else { [string]$policy.id })
                $unassigned += "$label (settings catalog)"
            }
        }
        if ($unassigned.Count -gt 0) {
            New-TLRuleResult -Status Fail -Evidence $unassigned
        }
        else {
            $total = @($configurationData.deviceConfigurations).Count + @($configurationData.settingsCatalogPolicies).Count
            New-TLRuleResult -Status Pass -Evidence ("All {0} configuration profiles are assigned." -f $total)
        }
    }
}