Connect-MgGraph -Scopes "DeviceManagementManagedDevices.ReadWrite.All"

# Export complete managed device inventory
Get-MgDeviceManagementManagedDevice -All -Property DeviceName,OperatingSystem,OSVersion,ComplianceState,LastSyncDateTime,ManagementAgent,JoinType,UserPrincipalName,Manufacturer,Model |
  Select-Object DeviceName,OperatingSystem,OSVersion,ComplianceState,LastSyncDateTime,ManagementAgent,UserPrincipalName |
  Export-Csv -Path "ManagedDevices.csv" -NoTypeInformation

# Find all non-compliant devices
Get-MgDeviceManagementManagedDevice -All -Filter "complianceState eq 'noncompliant'" |
  Select-Object DeviceName,UserPrincipalName,OperatingSystem,ComplianceState,LastSyncDateTime |
  Format-Table -AutoSize

# Trigger a policy sync on a specific device
$Device = Get-MgDeviceManagementManagedDevice -Filter "deviceName eq 'LAPTOP-001'" | Select-Object -First 1
Invoke-MgDeviceManagementManagedDeviceSyncDevice -ManagedDeviceId $Device.Id
Write-Host "Sync triggered for: $($Device.DeviceName)"

# Retire a device (removes corporate data only)
Invoke-MgDeviceManagementManagedDeviceRetire -ManagedDeviceId $Device.Id

# Full wipe (factory reset) — use with caution
Invoke-MgDeviceManagementManagedDeviceWipe -ManagedDeviceId $Device.Id -KeepEnrollmentData:$false -KeepUserData:$false

# Identify stale devices not synced in 30+ days
$Cutoff = (Get-Date).AddDays(-30).ToString("yyyy-MM-ddT00:00:00Z")
Get-MgDeviceManagementManagedDevice -All -Filter "lastSyncDateTime le $Cutoff" |
  Select-Object DeviceName,UserPrincipalName,LastSyncDateTime,OperatingSystem |
  Export-Csv -Path "StaleDevices.csv" -NoTypeInformation

Connect-MgGraph -Scopes "DeviceManagementServiceConfig.ReadWrite.All"

# Get all Autopilot-registered devices
Get-MgDeviceManagementWindowsAutopilotDeviceIdentity -All |
  Select-Object SerialNumber,Model,Manufacturer,GroupTag,EnrollmentState,AddressableUserName |
  Export-Csv -Path "AutopilotDevices.csv" -NoTypeInformation

# Get all Autopilot deployment profiles
Get-MgDeviceManagementWindowsAutopilotDeploymentProfile |
  Select-Object DisplayName,DeviceType,HybridAzureADJoinSkipConnectivityCheck |
  Format-Table -AutoSize

# Get enrollment restrictions (device limit and device type)
Get-MgDeviceManagementDeviceEnrollmentConfiguration |
  Select-Object DisplayName,@{N="Type";E={$_.OdataType}},Priority |
  Sort-Object Priority |
  Format-Table -AutoSize

# Import Autopilot devices from a hardware hash CSV
# CSV columns: Device Serial Number, Windows Product ID, Hardware Hash
$CSVPath = "C:\IT\AutopilotHashes.csv"
$ImportedDevices = Import-AutopilotCSV $CSVPath   # Requires WindowsAutopilotIntune module
Write-Host "Imported $($ImportedDevices.Count) devices to Autopilot"

Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All","DeviceManagementManagedDevices.Read.All"

# Get all compliance policies across all platforms
Get-MgDeviceManagementDeviceCompliancePolicy -All |
  Select-Object DisplayName,@{N="Platform";E={$_.OdataType -replace "#microsoft.graph.","" -replace "CompliancePolicy",""}} |
  Sort-Object Platform,DisplayName |
  Format-Table -AutoSize

# Per-policy compliance summary
$Report = @()
$Policies = Get-MgDeviceManagementDeviceCompliancePolicy -All
foreach ($Policy in $Policies) {
  $Summary = Get-MgDeviceManagementDeviceCompliancePolicyDeviceStateSummary -DeviceCompliancePolicyId $Policy.Id
  $Report += [PSCustomObject]@{
    Policy        = $Policy.DisplayName
    Compliant     = $Summary.CompliantDeviceCount
    NonCompliant  = $Summary.NonCompliantDeviceCount
    InGracePeriod = $Summary.InGracePeriodCount
    NotEvaluated  = $Summary.NotApplicableDeviceCount
    Error         = $Summary.ErrorDeviceCount
  }
}
$Report | Sort-Object NonCompliant -Descending | Format-Table -AutoSize
$Report | Export-Csv -Path "ComplianceSummary.csv" -NoTypeInformation

Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All"

# Get all legacy configuration profiles (Templates)
Get-MgDeviceManagementDeviceConfiguration -All |
  Select-Object DisplayName,@{N="Type";E={$_.OdataType -replace "#microsoft.graph.",""}},LastModifiedDateTime |
  Sort-Object Type,DisplayName |
  Format-Table -AutoSize

# Get all Settings Catalog policies (modern approach)
Get-MgDeviceManagementConfigurationPolicy -All |
  Select-Object Name,Description,Platforms,Technologies,SettingCount,LastModifiedDateTime |
  Sort-Object Name |
  Format-Table -AutoSize

# Get assignment status for a specific configuration profile
$ProfileId = "profile-guid-here"
Get-MgDeviceManagementDeviceConfigurationDeviceStatus -DeviceConfigurationId $ProfileId |
  Group-Object Status |
  Select-Object Name,Count |
  Format-Table -AutoSize

# Detect profiles with assignment conflicts
Get-MgDeviceManagementDeviceConfiguration -All | ForEach-Object {
  $Statuses = Get-MgDeviceManagementDeviceConfigurationDeviceStatus -DeviceConfigurationId $_.Id
  $Conflicts = $Statuses | Where-Object {$_.Status -eq "conflict"}
  if ($Conflicts) {
    Write-Host "CONFLICT: $($_.DisplayName) - $($Conflicts.Count) device(s)" -ForegroundColor Yellow
  }
}

Connect-MgGraph -Scopes "DeviceManagementApps.Read.All"

# Get all apps in Intune with type
Get-MgDeviceAppManagementMobileApp -All |
  Select-Object DisplayName,@{N="Type";E={$_.OdataType -replace "#microsoft.graph.",""}},IsFeatured,PublishedDate |
  Sort-Object Type,DisplayName |
  Format-Table -AutoSize

# Get apps with failed installations across devices
$AppId = "app-guid-here"
Get-MgDeviceAppManagementMobileAppDeviceStatus -MobileAppId $AppId |
  Where-Object {$_.InstallState -eq "failed"} |
  Select-Object DeviceName,UserPrincipalName,InstallState,InstallStateDetail,LastSyncDateTime |
  Format-Table -AutoSize

# Get all app assignments for a specific app
Get-MgDeviceAppManagementMobileAppAssignment -MobileAppId $AppId |
  Select-Object Intent,@{N="TargetGroup";E={$_.Target.GroupId}} |
  Format-Table -AutoSize

# Count apps by type
Get-MgDeviceAppManagementMobileApp -All |
  Group-Object @{E={$_.OdataType -replace "#microsoft.graph.",""}} |
  Select-Object Name,Count |
  Sort-Object Count -Descending |
  Format-Table -AutoSize

Connect-MgGraph -Scopes "DeviceManagementApps.ReadWrite.All"

# Get all App Protection Policies (MAM)
Get-MgDeviceAppManagementManagedAppPolicy -All |
  Select-Object DisplayName,@{N="Platform";E={$_.OdataType -replace "#microsoft.graph.",""}} |
  Format-Table -AutoSize

# Find all users with MAM-registered apps
$UserId = (Get-MgUser -Filter "UserPrincipalName eq 'user@contoso.com'").Id
Get-MgUserManagedAppRegistration -UserId $UserId -All |
  Select-Object AppIdentifier,DeviceName,DeviceType,CreatedDateTime,LastSyncDateTime |
  Format-Table -AutoSize

# Issue a MAM selective wipe — removes corporate data from all managed apps
$Registrations = Get-MgUserManagedAppRegistration -UserId $UserId -All
foreach ($Reg in $Registrations) {
  Invoke-MgWipeUserManagedAppRegistration -UserId $UserId -ManagedAppRegistrationId $Reg.Id
  Write-Host "Selective wipe issued for: $($Reg.AppIdentifier) on $($Reg.DeviceName)"
}

Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All","BitlockerKey.Read.All"

# Get BitLocker encryption state for all Windows devices
Get-MgDeviceManagementManagedDevice -All -Filter "operatingSystem eq 'Windows'" -Property DeviceName,UserPrincipalName,EncryptionState |
  Select-Object DeviceName,UserPrincipalName,EncryptionState |
  Sort-Object EncryptionState |
  Format-Table -AutoSize

# Count encrypted vs unencrypted Windows devices
Get-MgDeviceManagementManagedDevice -All -Filter "operatingSystem eq 'Windows'" -Property EncryptionState |
  Group-Object EncryptionState |
  Select-Object Name,Count |
  Format-Table -AutoSize

# Get all BitLocker recovery keys stored in Entra ID
Get-MgInformationProtectionBitlockerRecoveryKey -All |
  Select-Object Id,DeviceId,VolumeType,CreatedDateTime |
  Sort-Object CreatedDateTime -Descending |
  Format-Table -AutoSize

# Retrieve recovery key for a specific device
$DeviceEntraId = "entra-device-guid-here"
Get-MgInformationProtectionBitlockerRecoveryKey -Filter "deviceId eq '$DeviceEntraId'" |
  ForEach-Object {
    $Key = Get-MgInformationProtectionBitlockerRecoveryKey -BitlockerRecoveryKeyId $_.Id -Property Key
    Write-Host "Recovery Key: $($Key.Key)"
  }

Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All"

# Get all Windows Update for Business (WUfB) rings
Get-MgDeviceManagementDeviceConfiguration -All |
  Where-Object {$_.OdataType -like "*windowsUpdateForBusiness*"} |
  Select-Object DisplayName,LastModifiedDateTime |
  Format-Table -AutoSize

# Get feature update deployment profiles
Get-MgDeviceManagementWindowsFeatureUpdateProfile -All |
  Select-Object DisplayName,FeatureUpdateVersion,RolloutSettings |
  Format-Table -AutoSize

# Get update ring deployment status per ring
$Rings = Get-MgDeviceManagementDeviceConfiguration -All |
  Where-Object {$_.OdataType -like "*windowsUpdateForBusiness*"}

foreach ($Ring in $Rings) {
  Write-Host "`n=== $($Ring.DisplayName) ===" -ForegroundColor Cyan
  Get-MgDeviceManagementDeviceConfigurationDeviceStatus -DeviceConfigurationId $Ring.Id |
    Group-Object Status |
    Select-Object Name,Count |
    Format-Table -AutoSize
}

# Get quality update (expedited) policies
Get-MgDeviceManagementWindowsQualityUpdateProfile -All |
  Select-Object DisplayName,ReleaseDateDisplayName |
  Format-Table -AutoSize

Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All","DeviceManagementManagedDevices.Read.All"

# Request a device compliance export job (async)
$ExportBody = @{
  reportName = "DeviceCompliance"
  filter     = ""
  select     = @("DeviceName","UPN","OS","OSVersion","ComplianceState","LastContact","DeviceId")
  format     = "csv"
} | ConvertTo-Json

$ExportJob = Invoke-MgGraphRequest -Method POST `
  -Uri "https://graph.microsoft.com/beta/deviceManagement/reports/exportJobs" `
  -Body $ExportBody -ContentType "application/json"

Write-Host "Export Job ID: $($ExportJob.id) | Status: $($ExportJob.status)"

# Poll for job completion (retry every 15 seconds)
do {
  Start-Sleep -Seconds 15
  $JobStatus = Invoke-MgGraphRequest -Method GET `
    -Uri "https://graph.microsoft.com/beta/deviceManagement/reports/exportJobs/$($ExportJob.id)"
  Write-Host "Job status: $($JobStatus.status)"
} while ($JobStatus.status -ne "completed")

# Download the CSV from the generated URL
Invoke-WebRequest -Uri $JobStatus.url -OutFile "DeviceCompliance.zip"
Write-Host "Report downloaded to DeviceCompliance.zip"

# Get real-time non-compliant device list directly
Get-MgDeviceManagementManagedDevice -All -Filter "complianceState eq 'noncompliant'" -Property DeviceName,UserPrincipalName,OperatingSystem,ComplianceState,LastSyncDateTime |
  Export-Csv -Path "NonCompliantDevices.csv" -NoTypeInformation

Connect-MgGraph -Scopes "DeviceManagementRBAC.Read.All","DeviceManagementConfiguration.Read.All"

# Get all Intune role definitions (built-in and custom)
Get-MgDeviceManagementRoleDefinition -All |
  Select-Object DisplayName,IsBuiltIn,Description |
  Sort-Object IsBuiltIn -Descending,DisplayName |
  Format-Table -AutoSize

# Get all role assignments (who has what role with which scope)
Get-MgDeviceManagementRoleAssignment -All |
  Select-Object DisplayName,ScopeType,ScopeMembers |
  Format-Table -AutoSize

# Get Intune audit events for the past 7 days
$Since = (Get-Date).AddDays(-7).ToString("yyyy-MM-ddT00:00:00Z")
Get-MgDeviceManagementAuditEvent -Filter "activityDateTime ge $Since" -All |
  Select-Object DisplayName,ActivityType,@{N="Actor";E={$_.Actor.UserPrincipalName}},ActivityDateTime,ActivityResult |
  Sort-Object ActivityDateTime -Descending |
  Format-Table -AutoSize

# Export all audit events to CSV for compliance reporting
Get-MgDeviceManagementAuditEvent -Filter "activityDateTime ge $Since" -All |
  Select-Object DisplayName,ActivityType,@{N="Actor";E={$_.Actor.UserPrincipalName}},ActivityDateTime,ActivityResult,Category |
  Export-Csv -Path "IntuneAuditLog7Days.csv" -NoTypeInformation
Write-Host "Audit log exported."