Feature Request: Show deleted group name when displaying app assignments with Get-IntuneWin32AppAssignment

[obuolinis]

With the new soft-deleted groups functionality we can now see group name of a deleted group for a limited time and its status Soft-Deleted under Intune App Assignments. Currently Get-IntuneWin32AppAssignment just throws a warning WARNING: Request to https://graph.microsoft.com/v1.0/groups/<guid> failed with HTTP Status NotFound and description: when it encounters an assignment to a deleted group, so it would be great to have this implemented.

For the status, I'm not sure how Intune determines that, cause Graph doesn't return group status as such when querying app assignments. However, I noticed that active groups' assignment ids have a format guid_0_0, whereas deleted groups' assignment ids are guid_1_1, so maybe this is it. Oh, also the latter have empty settings property.

For the name of a deleted group you just query /directory/deletedItems/{object-id} as per this MS article

[obuolinis]

Aaaaargh, scrap all that i wrote earlier - i did some testing and apparently assignment objects themselves don't actually change whatsoever due to group deletion. Those 0/1 in the assignment id simply define intent (available/required) and group mode (include/exclude).

So the only feasible implementation seems to be catching the "not found" reply from the groups endpoint.

This is how i did it:

foreach ($Win32AppAssignment in $Win32AppAssignmentMatches) {
    try {
        # Retrieve group name from given group id
        $AzureADGroupResponse = Invoke-AzureADGraphRequest -Resource "groups/$($Win32AppAssignment.target.groupId)" -Method "GET"

        if ($null -eq $AzureADGroupResponse.id) {
            Write-Verbose -Message "Group with ID: $($Win32AppAssignment.target.groupId) could not be found, attempting to check if group is soft-deleted"
            # If group is soft-deleted, we need to use the deletedItems endpoint
            $AzureADGroupResponse = Invoke-AzureADGraphRequest -Resource "directory/deletedItems/$($Win32AppAssignment.target.groupId)" -Method "GET"
        }

        # Determine assignment group status
        if ($null -ne $AzureADGroupResponse.deletedDateTime) {
            $GroupStatus = "SoftDeleted"
        }
        else {
            $GroupStatus = "Active"
        }
...

Optionally upgrade the verbose message with $GroupStatus:

Write-Verbose -Message "Win32 app assignment '$($Win32AppAssignment.id)' for app '$($Win32MobileApp.displayName)' matched $GroupStatus group name: $($GroupName)"

Then update the hashtable with GroupStatus = $GroupStatus.