Is This Group Even Being Used? Introducing Get-IntuneAssignments!

Let’s be honest, we’ve all been there. You’re cleaning up your Azure AD groups, feeling confident, when you suddenly stop and ask yourself: “Wait… is this group even being used?” You check a few Intune assignments manually, click around the portal, squint at some policy names, and then… you give up and leave the group untouched. Forever. Just in case.

Well, fear not! I’ve written a PowerShell script that finally puts an end to this guesswork. Get-IntuneAssignments is your all-seeing crystal ball for Intune. It quickly tells you where and how a group is assigned, whether that’s a configuration profile, compliance policy, or app deployment, so you can stop second guessing and start decluttering.

No more “is this group safe to delete?” anxiety. Just answers

To simplify this process, I’ve developed a PowerShell script named Get-IntuneAssignments, which provides a streamlined approach to retrieving and exporting Intune assignments and filters.

What is Get-IntuneAssignments?

Get-IntuneAssignments is a PowerShell script that connects to Microsoft Graph to retrieve all Intune Configuration Profile assignments and filters, including Device Configuration, Compliance Policies, Security Baselines, and more. It offers IT administrators a comprehensive view of their Intune environment, facilitating better management and auditing of assignments. 

Key Features

• Retrieve All Assignments: Fetches all Intune Configuration Profile assignments and any filters being applied across your tenant.
• Group-Specific Queries: Allows filtering of assignments by specific Azure AD group names.
• Export to CSV: Provides the option to export retrieved assignments to a CSV file for reporting or analysis.
• Easy Installation: Available on the PowerShell Gallery for straightforward installation.

At the time of writing, the scripts targets the following Intune policies

• Device Configuration Profiles
• Device Management Configuration Policies
• Compliance Policies
• Security Baselines
• Administrative Templates
• App Protection Policies
• App Configuration Policies
• Windows Information Protection Policies
• Remediation Scripts
• Device Management Scripts
• Autopilot Profiles (v1)
  
  

Installation

To install the script from the PowerShell Gallery, run the following command:

Install-Script -Name Get-IntuneAssignments

The script requires PowerShell 7.1 or higher and utilizes the Microsoft Graph PowerShell SDK modules. If these modules are not already installed, the script will prompt to install them automatically

Usage Examples

Retrieve All Assignments

Get-IntuneAssignments

 

Export Assignments to CSV

Get-IntuneAssignments -OutputFile "C:\temp\assignments.csv"

Retrieve Assignments for a Specific Group

Get-IntuneAssignments -GroupName "Pilot Users"

Retrieve and Export Assignments for a Specific Group

Get-IntuneAssignments -GroupName "Pilot Users" -OutputFile "C:\temp\pilot_users_assignments.csv"

Why Use Get-IntuneAssignments?

This script addresses the challenge of identifying which Intune policies and profiles are assigned to specific Entra ID groups and specific filters. By providing a clear and concise output, it aids in auditing, compliance checks, and overall management of Intune assignments.

Get the Script

You can access the script and its source code on GitHub:
https://github.com/amirjs/Get-IntuneAssignments

Alternatively, install it directly from the PowerShell Gallery:
https://www.powershellgallery.com/packages/Get-IntuneAssignments