Search for a command to run...
As ZIP file or PS object 👍
I work as System Administrator for more than 15 years now and I love to make my life easier by automating work & personal stuff via PowerShell (even silly things like food recipes list generation).
No comments yet. Be the first to comment.
Or any other Azure service requiring special authentication strength
If you are using Azure Local (HCI), you might find the following PowerShell script AzureLocalVMImageUpdater.ps1 useful. What is it good for? The code replaces the Windows VM images in the specified Azure Local cluster(s) with the latest compatible ve...
Problem It happens that the hardware hash of your Autopilot device gets changed. Thanks to the replacement of the motherboard or some other issue. This can lead to future problems when your users need to reinstall the operating system, but the Autopi...
Learn how to use undocumented Azure APIs for massive performance gains
Keeping a secure, version-controlled backup of your Intune-managed device data, including BitLocker, LAPS, and FileVault keys, is a best practice for any modern IT team. In this post, I’ll guide you through an Azure DevOps pipeline that automates the...
In a previous post Get Intune Compliance data using PowerShell leveraging Graph API I wrote about getting compliance data from Intune.
Today I will show you how to retrieve Intune Reports as ZIP file or PS Object using PowerShell function leveraging Graph API.
At this Microsoft page you can find all available Intune reports.
Below you can find screenshot from that page. On the left side is the report name used in Intune api request, on the right side is a path, where you can find such report on the Intune page.
All these reports can be retrieved by Graph API.
To programmatically access Intune API (Graph API), you have to create App Registration with correct permissions in your Azure first. I've used this nice tutorial to learn how to do it.
In a nutshell, you have to:
New registration > Choose App name and click RegisterAPI permissions > Add a permission > Add following Application permissions (probably not all of them are needed, but I was too lazy to test it, sorry)Don't forget to
Grant admin consent
Certificates & secrets > New client secret
Choose validity period and some meaningful description. Don't forget to safely store generated password! We will need it later for requests authentication.You can download my Get-IntuneReport function from my GitHub. You will also need function New-IntuneAuthHeader for authentication purposes (how to use it).
To create Get-IntuneReport function I've followed Microsoft official tutorial, which isn't very user friendly, but helped :).
In general, the function has to create a request for generating the report, then waits for it to finish and downloads it.
The function supports TAB completion of reportName parameter thanks to 👇
[ValidateSet('DeviceCompliance', 'DeviceNonCompliance', 'Devices', 'DetectedAppsAggregate', 'FeatureUpdatePolicyFailuresAggregate', 'DeviceFailuresByFeatureUpdatePolicy', 'FeatureUpdateDeviceState', 'UnhealthyDefenderAgents', 'DefenderAgents', 'ActiveMalware', 'Malware', 'AllAppsList', 'AppInstallStatusAggregate', 'DeviceInstallStatusByApp', 'UserInstallStatusAggregateByApp')]
[string] $reportName
Some reports (FeatureUpdateDeviceState, DeviceInstallStatusByApp, UserInstallStatusAggregateByApp) requires selecting update/application you want the report for. So in case, you don't provide it, the function will offer you the list of all available updates/applications so you can easily make the choice.
Call function like this 👇
$header = New-IntuneAuthHeader
Get-IntuneReport -header $header -reportName UserInstallStatusAggregateByApp
Or if you want result as PS Object
$header = New-IntuneAuthHeader
Get-IntuneReport -header $header -reportName DeviceNonCompliance -asObject
How did I find all these Graph API request URIs you may ask? Using Web Browser Developer Mode (F12) and a lot of clicking 😀 
