Automating with PowerShell and Microsoft Graph

What it is

Intune offers two kinds of automation. PowerShell scripts that run on devices change settings or install things that no policy covers. Microsoft Graph is the API behind the admin center, so scripts and apps can manage Intune itself: list devices, run actions, create policies. A related tool, custom compliance, uses a script to extend what compliance can check.

How it works

PowerShell scripts on devices

Add a script under Devices, Scripts and remediations, Platform scripts, for Windows (PowerShell), macOS (shell) or Linux (Bash).

Facts to know:

• The Intune management extension (IME) runs the scripts, and installs automatically when a script, app or remediation is assigned.
• A platform script runs once, and runs again only if you change it or the device is re enrolled. For repeating checks, use a remediation.
• Scripts run after sign in, and user context scripts may not run during the Enrollment Status Page. Use the system context for scripts needed during provisioning.
• Do not put reboot commands in a script. Use the return code instead.
• Assign scripts to groups, and check device status for success and errors.
• Windows scripts can be protected by Multi Admin Approval.

Microsoft Graph and the Intune API

Graph exposes Intune under https://graph.microsoft.com/v1.0/deviceManagement/ and a beta endpoint with more features. Common calls:

The Microsoft Graph PowerShell SDK wraps these calls.

Connect-MgGraph -Scopes "DeviceManagementManagedDevices.ReadWrite.All"
Get-MgDeviceManagementManagedDevice -Filter "operatingSystem eq 'Windows'"
Invoke-MgSyncDeviceManagementManagedDevice -ManagedDeviceId $id

Authentication and permissions:

• Delegated permissions act as the signed in admin, limited by the admin's Intune role. Application permissions run unattended as the app, and need admin consent. Use least privilege scopes, such as DeviceManagementManagedDevices.Read.All rather than ReadWrite when only reading.
• For unattended automation, create an app registration in Entra ID, grant the application permissions, and authenticate with a certificate (preferred) or a client secret. A managed identity for an Azure Automation runbook avoids storing secrets.
• Calls that change protected resources are subject to Multi Admin Approval. Excluded enterprise applications can bypass an access policy, up to 50 per policy.
• Graph throttles heavy use, so batch requests and handle HTTP 429 responses.

Extending compliance with PowerShell

Custom compliance settings let compliance check anything a script can read.

1. Write a discovery script (PowerShell on Windows) that outputs a JSON of values, for example {"BitLockerOn": true}.
2. Write a JSON rules file that lists the settings, operators, data types, expected values and the remediation message shown to users.
3. Upload both in Devices, Compliance, Scripts, then create a compliance policy that uses the custom settings.

Custom compliance works for Windows, macOS and Linux (Ubuntu and Red Hat). The device runs the script on its own schedule and reports the values. Combine it with Conditional Access so noncompliant devices are blocked.

Choosing the right tool

A worked scenario

A company must set a registry value on 3,000 laptops and also nightly list devices without a recent check in. The registry change is a platform script that runs as SYSTEM. The nightly report is an Azure Automation runbook with a managed identity, that calls the Graph PowerShell SDK with the DeviceManagementManagedDevices.Read.All permission. Security also needs devices to prove a specific service is running, so a custom compliance script reports it and a JSON rule requires true.