Intune: Programmatically Update GroupTag Information for Existing Autopilot Devices

Since Pandemic, Autopilot has taken main stage at various organizations as it enables organizations to procure devices from vendors and ship it directly to end user’s home. While the Device Configurations and Application Management can be done through Intune, lot many times, organizations want to deploy specific set of policies and applications to specific set of devices. This could be based on geography, project, department etc., This can be achieved by grouping the devices in Azure Active Directory and using targeting the policies and applications accordingly.

The challenge however is on grouping the device objects dynamically. This can be solved by specifying Group Tag for each device while uploading the device hardware hashes.

This aspect is detailed in this post and several other posts linked in the same blog.

You can ask your vendor to update the Group tag Information if they are uploading the hardware hashes to autopilot service. This may work 1) if your vendor agrees to do and 2) you have simple tagging requirement like country or location based.

For devices that you import the hardware hash by booting up the device, you can refer to this post and the PowerShell script – Get-WindowsAutopilotInfo.ps1 supports -GroupTag parameter where you can mention appropriate group tag for the device.

If your organization has bought several hundred autopilot devices, the hardware hashes are already uploaded and if the IT team wants to group them according to location, projects, geography, this is a manual task to identify each device under Autopilot Devices and update the Group Tag accordingly.

This blog post helps in automating the above-mentioned process through Graph API.

To automate the process, you need a PowerShell script which has capability to read devices list from CSV (based on device serial), authenticate with Azure AD and talks (post data) to Graph API endpoints for each device that you need to update the Group Tag.

Prepare CSV File:

Create a CSV File with SerialNumber and GroupTag mapping as per your organization needs. This can be project based, location based, country/geography based or combination like “Asia-India-GKLab”. Save it in local computer where you intend to run the script.

Register Azure AD Application for Authentication:

To authenticate with Graph API, we must register an Azure AD Application or use existing application with below permission and grant consent as Global Administrator.

Detailed documentation on how to register an Azure AD Application and assign permissions can be found in this post.

Once the Application is registered, capture the Tenant Id, Client Id and Client secret.

If you have chosen delegate permission, create a custom RBAC in Intune and add the users who will be executing the script to this role.

Download and Setup Script:

Download the script from here and configure as per below guidelines. Save the script.

Execution and Validating Results:

Once the script is configured with appropriate values, launch PowerShell as administrator and execute the script.

You will notice the results on screen as well as logged in a logfile for future reference.

You can validate the same in Endpoint Portal as well. Remember, the sync happens every 12 hours or you can initiate a manual sync.

Hope you enjoyed automating group tagging of your devices!

You may also like...

Leave a Reply

%d bloggers like this: