Skip to content

Commit 81fd693

Browse files
ugurkocdeclaude
ugurkocde
and
claude
committed
Release version 3.4.3 - Critical assignment accuracy fixes
Fixed critical issues affecting assignment visibility and accuracy: - Fixed multiple assignment processing - now handles ALL assignments instead of just first one (Fixes #79) - Resolved Settings Catalog policies not appearing in group assignment checks (Fixes #80) - Fixed Compare Groups feature to properly detect and mark excluded assignments with [EXCLUDED] tag (Fixes #44) Changes include: - Replaced all instances of $directAssignments[0].Reason with proper iteration through all assignments - Updated Compare Groups to check both inclusion and exclusion assignment types - Added [EXCLUDED] marking for excluded assignments in comparison view - Improved assignment processing logic throughout the script These fixes address critical data integrity issues that were causing incomplete or incorrect assignment information. Co-Authored-By: Claude <noreply@anthropic.com>
1 parent 29e8950 commit 81fd693

1 file changed

Lines changed: 151 additions & 34 deletions

File tree

‎IntuneAssignmentChecker.ps1‎

Lines changed: 151 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,20 @@
22
#Requires -Modules Microsoft.Graph.Authentication
33

44
<#PSScriptInfo
5-
.VERSION 3.4.2
5+
.VERSION 3.4.3
66
.GUID c6e25ec6-5787-45ef-95af-8abeb8a17daf
77
.AUTHOR ugurk
88
.PROJECTURI https://github.com/ugurkocde/IntuneAssignmentChecker
99
.DESCRIPTION
1010
This script enables IT administrators to efficiently analyze and audit Intune assignments. It checks assignments for specific users, groups, or devices, displays all policies and their assignments, identifies unassigned policies, detects empty groups in assignments, and searches for specific settings across policies.
1111
.RELEASENOTES
12+
Version 3.4.3:
13+
- Fixed critical assignment accuracy issues affecting group policy checks (Fixes #79, #80)
14+
- Resolved Settings Catalog policies not showing in group assignments (Fixes #80)
15+
- Fixed Compare Groups to properly detect and display excluded assignments with [EXCLUDED] tag (Fixes #44)
16+
- Improved assignment processing to handle ALL assignments instead of just first one
17+
- Enhanced exclusion detection in group comparison feature
18+
1219
Version 3.4.2:
1320
- Fixed Android policy detection - now properly identifies and displays Android platform policies (Fixes #86)
1421
- Fixed assignment accuracy - now shows ALL assigned groups instead of just the first one (Fixes #87)
@@ -2978,9 +2985,16 @@ do {
29782985
# For group queries, Get-IntuneAssignments will return only direct assignments/exclusions
29792986
$directAssignments = Get-IntuneAssignments -EntityType "deviceAppManagement/managedAppPolicies" -EntityId $policy.id -GroupId $groupId
29802987
if ($directAssignments.Count -gt 0) {
2981-
$assignmentReason = $directAssignments[0].Reason
2982-
if ($assignmentReason -eq "Direct Assignment" -or $assignmentReason -eq "Direct Exclusion") {
2983-
$policy | Add-Member -NotePropertyName 'AssignmentReason' -NotePropertyValue $assignmentReason -Force
2988+
# Process all assignments for this group
2989+
$assignmentReasons = @()
2990+
foreach ($assignment in $directAssignments) {
2991+
if ($assignment.Reason -eq "Direct Assignment" -or $assignment.Reason -eq "Direct Exclusion") {
2992+
$assignmentReasons += $assignment.Reason
2993+
}
2994+
}
2995+
2996+
if ($assignmentReasons.Count -gt 0) {
2997+
$policy | Add-Member -NotePropertyName 'AssignmentReason' -NotePropertyValue ($assignmentReasons -join "; ") -Force
29842998
$relevantPolicies.AppProtectionPolicies += $policy
29852999
}
29863000
}
@@ -2997,9 +3011,16 @@ do {
29973011
foreach ($policy in $appConfigPolicies) {
29983012
$directAssignments = Get-IntuneAssignments -EntityType "mobileAppConfigurations" -EntityId $policy.id -GroupId $groupId
29993013
if ($directAssignments.Count -gt 0) {
3000-
$assignmentReason = $directAssignments[0].Reason
3001-
if ($assignmentReason -eq "Direct Assignment" -or $assignmentReason -eq "Direct Exclusion") {
3002-
$policy | Add-Member -NotePropertyName 'AssignmentReason' -NotePropertyValue $assignmentReason -Force
3014+
# Process all assignments for this group
3015+
$assignmentReasons = @()
3016+
foreach ($assignment in $directAssignments) {
3017+
if ($assignment.Reason -eq "Direct Assignment" -or $assignment.Reason -eq "Direct Exclusion") {
3018+
$assignmentReasons += $assignment.Reason
3019+
}
3020+
}
3021+
3022+
if ($assignmentReasons.Count -gt 0) {
3023+
$policy | Add-Member -NotePropertyName 'AssignmentReason' -NotePropertyValue ($assignmentReasons -join "; ") -Force
30033024
$relevantPolicies.AppConfigurationPolicies += $policy
30043025
}
30053026
}
@@ -3035,9 +3056,18 @@ do {
30353056
if ($processedEsPolicyIds.Add($policy.id)) {
30363057
$directAssignments = Get-IntuneAssignments -EntityType "configurationPolicies" -EntityId $policy.id -GroupId $groupId
30373058
if ($directAssignments.Count -gt 0) {
3038-
$assignmentReason = $directAssignments[0].Reason
3039-
$policy | Add-Member -NotePropertyName 'AssignmentReason' -NotePropertyValue $assignmentReason -Force
3040-
$relevantPolicies[$esCategory.Key] += $policy
3059+
# Process all assignments for this group
3060+
$assignmentReasons = @()
3061+
foreach ($assignment in $directAssignments) {
3062+
if ($assignment.Reason -eq "Direct Assignment" -or $assignment.Reason -eq "Direct Exclusion") {
3063+
$assignmentReasons += $assignment.Reason
3064+
}
3065+
}
3066+
3067+
if ($assignmentReasons.Count -gt 0) {
3068+
$policy | Add-Member -NotePropertyName 'AssignmentReason' -NotePropertyValue ($assignmentReasons -join "; ") -Force
3069+
$relevantPolicies[$esCategory.Key] += $policy
3070+
}
30413071
}
30423072
}
30433073
}
@@ -3148,9 +3178,16 @@ do {
31483178
foreach ($script in $platformScripts) {
31493179
$directAssignments = Get-IntuneAssignments -EntityType "deviceManagementScripts" -EntityId $script.id -GroupId $groupId
31503180
if ($directAssignments.Count -gt 0) {
3151-
$assignmentReason = $directAssignments[0].Reason
3152-
if ($assignmentReason -eq "Direct Assignment" -or $assignmentReason -eq "Direct Exclusion") {
3153-
$script | Add-Member -NotePropertyName 'AssignmentReason' -NotePropertyValue $assignmentReason -Force
3181+
# Process all assignments for this group
3182+
$assignmentReasons = @()
3183+
foreach ($assignment in $directAssignments) {
3184+
if ($assignment.Reason -eq "Direct Assignment" -or $assignment.Reason -eq "Direct Exclusion") {
3185+
$assignmentReasons += $assignment.Reason
3186+
}
3187+
}
3188+
3189+
if ($assignmentReasons.Count -gt 0) {
3190+
$script | Add-Member -NotePropertyName 'AssignmentReason' -NotePropertyValue ($assignmentReasons -join "; ") -Force
31543191
$relevantPolicies.PlatformScripts += $script
31553192
}
31563193
}
@@ -3162,9 +3199,16 @@ do {
31623199
foreach ($script in $healthScripts) {
31633200
$directAssignments = Get-IntuneAssignments -EntityType "deviceHealthScripts" -EntityId $script.id -GroupId $groupId
31643201
if ($directAssignments.Count -gt 0) {
3165-
$assignmentReason = $directAssignments[0].Reason
3166-
if ($assignmentReason -eq "Direct Assignment" -or $assignmentReason -eq "Direct Exclusion") {
3167-
$script | Add-Member -NotePropertyName 'AssignmentReason' -NotePropertyValue $assignmentReason -Force
3202+
# Process all assignments for this group
3203+
$assignmentReasons = @()
3204+
foreach ($assignment in $directAssignments) {
3205+
if ($assignment.Reason -eq "Direct Assignment" -or $assignment.Reason -eq "Direct Exclusion") {
3206+
$assignmentReasons += $assignment.Reason
3207+
}
3208+
}
3209+
3210+
if ($assignmentReasons.Count -gt 0) {
3211+
$script | Add-Member -NotePropertyName 'AssignmentReason' -NotePropertyValue ($assignmentReasons -join "; ") -Force
31683212
$relevantPolicies.HealthScripts += $script
31693213
}
31703214
}
@@ -3176,9 +3220,16 @@ do {
31763220
foreach ($profile in $autoProfiles) {
31773221
$directAssignments = Get-IntuneAssignments -EntityType "windowsAutopilotDeploymentProfiles" -EntityId $profile.id -GroupId $groupId
31783222
if ($directAssignments.Count -gt 0) {
3179-
$assignmentReason = $directAssignments[0].Reason
3180-
if ($assignmentReason -eq "Direct Assignment" -or $assignmentReason -eq "Direct Exclusion") {
3181-
$profile | Add-Member -NotePropertyName 'AssignmentReason' -NotePropertyValue $assignmentReason -Force
3223+
# Process all assignments for this group
3224+
$assignmentReasons = @()
3225+
foreach ($assignment in $directAssignments) {
3226+
if ($assignment.Reason -eq "Direct Assignment" -or $assignment.Reason -eq "Direct Exclusion") {
3227+
$assignmentReasons += $assignment.Reason
3228+
}
3229+
}
3230+
3231+
if ($assignmentReasons.Count -gt 0) {
3232+
$profile | Add-Member -NotePropertyName 'AssignmentReason' -NotePropertyValue ($assignmentReasons -join "; ") -Force
31823233
$relevantPolicies.DeploymentProfiles += $profile
31833234
}
31843235
}
@@ -3191,9 +3242,16 @@ do {
31913242
foreach ($esp in $espProfiles) {
31923243
$directAssignments = Get-IntuneAssignments -EntityType "deviceEnrollmentConfigurations" -EntityId $esp.id -GroupId $groupId
31933244
if ($directAssignments.Count -gt 0) {
3194-
$assignmentReason = $directAssignments[0].Reason
3195-
if ($assignmentReason -eq "Direct Assignment" -or $assignmentReason -eq "Direct Exclusion") {
3196-
$esp | Add-Member -NotePropertyName 'AssignmentReason' -NotePropertyValue $assignmentReason -Force
3245+
# Process all assignments for this group
3246+
$assignmentReasons = @()
3247+
foreach ($assignment in $directAssignments) {
3248+
if ($assignment.Reason -eq "Direct Assignment" -or $assignment.Reason -eq "Direct Exclusion") {
3249+
$assignmentReasons += $assignment.Reason
3250+
}
3251+
}
3252+
3253+
if ($assignmentReasons.Count -gt 0) {
3254+
$esp | Add-Member -NotePropertyName 'AssignmentReason' -NotePropertyValue ($assignmentReasons -join "; ") -Force
31973255
$relevantPolicies.ESPProfiles += $esp
31983256
}
31993257
}
@@ -3206,9 +3264,16 @@ do {
32063264
foreach ($policy in $cloudPCProvisioningPolicies) {
32073265
$directAssignments = Get-IntuneAssignments -EntityType "virtualEndpoint/provisioningPolicies" -EntityId $policy.id -GroupId $groupId
32083266
if ($directAssignments.Count -gt 0) {
3209-
$assignmentReason = $directAssignments[0].Reason
3210-
if ($assignmentReason -eq "Direct Assignment" -or $assignmentReason -eq "Direct Exclusion") {
3211-
$policy | Add-Member -NotePropertyName 'AssignmentReason' -NotePropertyValue $assignmentReason -Force
3267+
# Process all assignments for this group
3268+
$assignmentReasons = @()
3269+
foreach ($assignment in $directAssignments) {
3270+
if ($assignment.Reason -eq "Direct Assignment" -or $assignment.Reason -eq "Direct Exclusion") {
3271+
$assignmentReasons += $assignment.Reason
3272+
}
3273+
}
3274+
3275+
if ($assignmentReasons.Count -gt 0) {
3276+
$policy | Add-Member -NotePropertyName 'AssignmentReason' -NotePropertyValue ($assignmentReasons -join "; ") -Force
32123277
$relevantPolicies.CloudPCProvisioningPolicies += $policy
32133278
}
32143279
}
@@ -3225,9 +3290,16 @@ do {
32253290
foreach ($setting in $cloudPCUserSettings) {
32263291
$directAssignments = Get-IntuneAssignments -EntityType "virtualEndpoint/userSettings" -EntityId $setting.id -GroupId $groupId
32273292
if ($directAssignments.Count -gt 0) {
3228-
$assignmentReason = $directAssignments[0].Reason
3229-
if ($assignmentReason -eq "Direct Assignment" -or $assignmentReason -eq "Direct Exclusion") {
3230-
$setting | Add-Member -NotePropertyName 'AssignmentReason' -NotePropertyValue $assignmentReason -Force
3293+
# Process all assignments for this group
3294+
$assignmentReasons = @()
3295+
foreach ($assignment in $directAssignments) {
3296+
if ($assignment.Reason -eq "Direct Assignment" -or $assignment.Reason -eq "Direct Exclusion") {
3297+
$assignmentReasons += $assignment.Reason
3298+
}
3299+
}
3300+
3301+
if ($assignmentReasons.Count -gt 0) {
3302+
$setting | Add-Member -NotePropertyName 'AssignmentReason' -NotePropertyValue ($assignmentReasons -join "; ") -Force
32313303
$relevantPolicies.CloudPCUserSettings += $setting
32323304
}
32333305
}
@@ -7160,8 +7232,23 @@ do {
71607232
$assignmentsUri = "$GraphEndpoint/beta/deviceManagement/deviceConfigurations('$configId')/assignments"
71617233
$assignmentResponse = Invoke-MgGraphRequest -Uri $assignmentsUri -Method Get
71627234

7163-
if ($assignmentResponse.value | Where-Object { $_.target.groupId -eq $groupId }) {
7164-
[void]$groupAssignments[$groupName].DeviceConfigs.Add($config.displayName)
7235+
# Check for both inclusion and exclusion assignments
7236+
$hasAssignment = $assignmentResponse.value | Where-Object {
7237+
$_.target.groupId -eq $groupId -and
7238+
($_.target.'@odata.type' -eq '#microsoft.graph.groupAssignmentTarget' -or
7239+
$_.target.'@odata.type' -eq '#microsoft.graph.exclusionGroupAssignmentTarget')
7240+
}
7241+
if ($hasAssignment) {
7242+
# Check if it's an exclusion
7243+
$isExclusion = $hasAssignment | Where-Object {
7244+
$_.target.'@odata.type' -eq '#microsoft.graph.exclusionGroupAssignmentTarget'
7245+
}
7246+
$displayName = if ($isExclusion) {
7247+
"$($config.displayName) [EXCLUDED]"
7248+
} else {
7249+
$config.displayName
7250+
}
7251+
[void]$groupAssignments[$groupName].DeviceConfigs.Add($displayName)
71657252
}
71667253
}
71677254
Write-Host "`rFetching Device Configuration $totalDeviceConfigs of $totalDeviceConfigs" -NoNewline
@@ -7177,8 +7264,23 @@ do {
71777264
$assignmentsUri = "$GraphEndpoint/beta/deviceManagement/configurationPolicies('$policyId')/assignments"
71787265
$assignmentResponse = Invoke-MgGraphRequest -Uri $assignmentsUri -Method Get
71797266

7180-
if ($assignmentResponse.value | Where-Object { $_.target.groupId -eq $groupId }) {
7181-
[void]$groupAssignments[$groupName].SettingsCatalog.Add($policy.name)
7267+
# Check for both inclusion and exclusion assignments
7268+
$hasAssignment = $assignmentResponse.value | Where-Object {
7269+
$_.target.groupId -eq $groupId -and
7270+
($_.target.'@odata.type' -eq '#microsoft.graph.groupAssignmentTarget' -or
7271+
$_.target.'@odata.type' -eq '#microsoft.graph.exclusionGroupAssignmentTarget')
7272+
}
7273+
if ($hasAssignment) {
7274+
# Check if it's an exclusion
7275+
$isExclusion = $hasAssignment | Where-Object {
7276+
$_.target.'@odata.type' -eq '#microsoft.graph.exclusionGroupAssignmentTarget'
7277+
}
7278+
$displayName = if ($isExclusion) {
7279+
"$($policy.name) [EXCLUDED]"
7280+
} else {
7281+
$policy.name
7282+
}
7283+
[void]$groupAssignments[$groupName].SettingsCatalog.Add($displayName)
71827284
}
71837285
}
71847286

@@ -7205,8 +7307,23 @@ do {
72057307
$assignmentsUri = "$GraphEndpoint/beta/deviceManagement/deviceCompliancePolicies('$policyId')/assignments"
72067308
$assignmentResponse = Invoke-MgGraphRequest -Uri $assignmentsUri -Method Get
72077309

7208-
if ($assignmentResponse.value | Where-Object { $_.target.groupId -eq $groupId }) {
7209-
[void]$groupAssignments[$groupName].CompliancePolicies.Add($policy.displayName)
7310+
# Check for both inclusion and exclusion assignments
7311+
$hasAssignment = $assignmentResponse.value | Where-Object {
7312+
$_.target.groupId -eq $groupId -and
7313+
($_.target.'@odata.type' -eq '#microsoft.graph.groupAssignmentTarget' -or
7314+
$_.target.'@odata.type' -eq '#microsoft.graph.exclusionGroupAssignmentTarget')
7315+
}
7316+
if ($hasAssignment) {
7317+
# Check if it's an exclusion
7318+
$isExclusion = $hasAssignment | Where-Object {
7319+
$_.target.'@odata.type' -eq '#microsoft.graph.exclusionGroupAssignmentTarget'
7320+
}
7321+
$displayName = if ($isExclusion) {
7322+
"$($policy.displayName) [EXCLUDED]"
7323+
} else {
7324+
$policy.displayName
7325+
}
7326+
[void]$groupAssignments[$groupName].CompliancePolicies.Add($displayName)
72107327
}
72117328
}
72127329

0 commit comments

Comments
 (0)