Search for a command to run...
I work as System Administrator for more than 15 years now and I love to make my life easier by automating work & personal stuff via PowerShell (even silly things like food recipes list generation).
No comments yet. Be the first to comment.
Or any other Azure service requiring special authentication strength
If you are using Azure Local (HCI), you might find the following PowerShell script AzureLocalVMImageUpdater.ps1 useful. What is it good for? The code replaces the Windows VM images in the specified Azure Local cluster(s) with the latest compatible ve...
Problem It happens that the hardware hash of your Autopilot device gets changed. Thanks to the replacement of the motherboard or some other issue. This can lead to future problems when your users need to reinstall the operating system, but the Autopi...
Learn how to use undocumented Azure APIs for massive performance gains
Keeping a secure, version-controlled backup of your Intune-managed device data, including BitLocker, LAPS, and FileVault keys, is a best practice for any modern IT team. In this post, I’ll guide you through an Azure DevOps pipeline that automates the...
In my previous post, I've shown you how to get all assignable Intune policies. Now we can use this data to get all policies assigned to some specified account (user, device, group).
Say hello to the brand new PowerShell function Search-IntuneAccountPolicyAssignment, new member of my IntuneStuff module 🙂
How is this useful? This function can help you understand, what Intune policies are assigned/applied to the specific account. Which can be very helpful in the case of debugging etc.
Main benefits of this function:
To be able to use this function you need:
Install-Module IntuneStuff -Force
Import-Module IntuneStuff -Force
### authenticate to Graph API
Connect-MSGraph
### get all Intune policies directly and indirectly assigned to the selected account
# (policies assigned to groups, this group is a member of will be included)
# policies assigned to 'All Users' or 'All Devices' will be included too
# policies where exclude assignment for this account (or group he is member of) exists, will be skipped
Search-IntuneAccountPolicyAssignment -accountId a8r3da8b-6324-4feb-94ef-96723ba4fbf7
### get all Intune policies directly and indirectly assigned to the selected account
# (policies assigned to groups, this group is a member of will be included)
# policies assigned to 'All Users' or 'All Devices' will be included too
# policies where exclude assignment for this account (or group he is member of) exists, won't be skipped!
Search-IntuneAccountPolicyAssignment -accountId a8r3da8b-6324-4feb-94ef-96723ba4fbf7 -ignoreExcludes
### get all Intune policies directly and indirectly assigned to the selected account
# (policies assigned to groups, this group is a member of will be included)
# policies assigned to 'All Users' or 'All Devices' won't be included!
# policies where exclude assignment for this account (or group he is member of) exists, won't be skipped!
Search-IntuneAccountPolicyAssignment -accountId a8r3da8b-6324-4feb-94ef-96723ba4fbf7 -ignoreExcludes -skipAllUsersAllDevicesAssignments
### get all Intune policies directly assigned to the selected group
# (policies assigned to groups, this group is a member of won't be included)
# policies assigned to 'All Users' or 'All Devices' won't be included!
# policies where exclude assignment for this account (or group he is member of) exists, won't be skipped!
Search-IntuneAccountPolicyAssignment -accountId a8r3da8b-6324-4feb-94ef-96723ba4fbf7 -ignoreExcludes -justDirectGroupAssignments
And the result can look like this
You can cache Intune policies to speed up the searches, just use the parameter intunePolicy like 👇
# cache Intune policies
$intunePolicy = Get-IntunePolicy
# use the cached version in your searches
Search-IntuneAccountPolicyAssignment -intunePolicy $intunePolicy -accountId a815dh8b-6324-4feb-94ef-96723ba4fbf7 -basicOverview
Search-IntuneAccountPolicyAssignment -intunePolicy $intunePolicy -accountId 3465dk8b-6325-daeb-94ef-56723ba4f5gt
If you are ok with getting basically just policy name, use parameter basicOverview
Search-IntuneAccountPolicyAssignment -accountId a8r3da8b-6324-4feb-94ef-96723ba4fbf7 -basicOverview
If you are interested in just some of the available Intune policies, filter them using the parameter policyType
Search-IntuneAccountPolicyAssignment -accountId a8r3da8b-6324-4feb-94ef-96723ba4fbf7 -policyType app,configurationPolicy,compliancePolicy
Now you have two functions. Get-IntunePolicy to get all assignable Intune policies and Search-IntuneAccountPolicyAssignment to get just policies assigned to some account. And both are part of the module IntuneStuff.
Enjoy 👍