Sync Intune Devices Using Azure AD Dynamic Groups and Powershell Graph API

As Microsoft puts it, the Sync device action forces the selected device to immediately check in with Intune. When a device checks in, it immediately receives any pending actions or policies that have been assigned to it. This feature can help you immediately validate and troubleshoot policies you’ve assigned, without waiting for the next scheduled check-in.

It is easy enough to send a sync to an individual Intune device using the portal. Intune — Devices — All Devices — Select a device — Sync 

But what if we want to sync multiple devices based on their AAD group membership? in this post, I am assuming a sync is being invoked to all members of a dynamic group of Windows 10 hybrid joined devices.

Creating AAD Dynamic Group

Let’s start by creating a dynamic group. This can be done either using the portal or Powershell.

The cmdlet New-AzureADMSGroup can be used to create the dynamic group, however, the one that comes with AzureAD module has missing parameters so the module we will be using is AzureADPreview

First, make sure you have the module installed by running the following code

In this example. I am creating a dynamic group for all Windows 10 devices that are hybrid joined to Azure AD

The result should look similar to this

In few seconds, the group will show up in the portal – verify the dynamic rules and give it some time to process the membership of matching devices

Invoking Sync on members of AAD Group

The code utilizes the Microsoft Graph API and the Azure Active Directory (AAD) PowerShell module to fetch information about devices and send a sync request to each device in a specific group.

The script begins by checking that the required module are present and if not installs them. Then it connects to MSGraph – An interactive prompt to login is expected at this point.

Then, we pipe the group we created earlier in this example e.g. “Windows 10 Hybrid Joined Devices” to a variable ($GroupName). This variable is used to identify the group of devices that the script will be working with.

The next step is to use the Get-AADGroup cmdlet to fetch the group ID of the group specified in the $GroupName variable. The cmdlet takes a filter parameter, which is set to the value of the $GroupName variable, and returns the ID of the group.

With the group ID in hand, the script then uses the Get-AADGroupMember cmdlet to fetch all the members of the group. The groupId parameter is set to the value of the $Groupid variable, which contains the group ID. The script also uses the Get-MSGraphAllPages cmdlet to ensure that all pages of the group members are retrieved.

Finally, the script enters a loop that iterates through each device in the group. For each device, the script uses the Get-IntuneManagedDevice cmdlet to fetch the device ID of the device. It then uses the Invoke-IntuneManagedDeviceSyncDevice cmdlet to send a sync request to the device, which will synchronize the device with Intune for management. The script also writes the device name and ID to the console for reference.