This repository contains the source code for the PowerShell module which provides support for the Intune API through Microsoft Graph.
This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.
When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.
This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.
Install-Module -Name Microsoft.Graph.Intune
Import-Module $sdkDir/Microsoft.Graph.Intune.psd1
An admin user must provide consent for this app to be used in their organization. This can be done with the following command:
Connect-MSGraph -AdminConsent
To authenticate with Microsoft Graph (this is not required when using CloudShell):
Connect-MSGraph
To authenticate with Microsoft Graph using a [PSCredential] object:
# 1. Create the PSCredential object
$adminUPN = Read-Host -Prompt "Enter UPN"
$adminPwd = Read-Host -AsSecureString -Prompt "Enter password for $adminUPN"
$creds = New-Object System.Management.Automation.PSCredential ($adminUPN, $adminPwd)
# 2. Log in with these credentials
Connect-MSGraph -PSCredential $creds
To authenticate in a non-standard environment:
# 1. Setup the environment
# For example, in a National Cloud environment, the following is required before logging in
Update-MSGraphEnvironment -AuthUrl 'https://login.microsoftonline.us/common' -GraphBaseUrl 'https://graph.microsoft.us' -GraphResourceId 'https://graph.microsoft.us' -SchemaVersion 'beta'
# 2. Log in
Connect-MSGraph
# 3. Use the cmdlets
# NOTE: If the schema version has been changed to something other than "v1.0" as in the above
# "Update-MSGraphEnvironment" command, only "Invoke-MSGraphRequest" should be used to make calls,
# because the standard cmdlets (e.g. "Get-IntuneMobileApp") have been generated based on the
# "v1.0" schema, and can produce unexpected results when used with other schema versions
Invoke-MSGraphRequest -HttpMethod GET -Url 'deviceAppManagement/mobileApps'
Get the full list of available cmdlets:
Get-Command -Module Microsoft.Graph.Intune
Get documentation on a particular cmdlet:
Get-Help <cmdlet name>
Use a UI to see the parameter sets more easily:
Show-Command <cmdlet name>
Get all Intune applications:
Get-IntuneMobileApp
Get all Intune device configurations:
Get-IntuneDeviceConfigurationPolicy
Get all Intune managed devices:
Get-IntuneManagedDevice
Get a filtered list of applications and select only the "displayName" and "publisher" properties:
# The filter string follows the same rules as specified in the OData v4.0 specification.
# Filter string construction rules: http://docs.oasis-open.org/odata/odata/v4.0/errata03/os/complete/abnf/odata-abnf-construction-rules.txt
Get-IntuneMobileApp -Select displayName, publisher -Filter "isof('microsoft.graph.webApp')"
Create a web application:
$bingWebApp = New-IntuneMobileApp -webApp -displayName 'Bing' -publisher 'Microsoft Corporation' -AppUrl 'https://www.bing.com'
Update the web application that we created in the 'Creating objects' section:
$bingWebApp | Update-IntuneMobileApp -webApp -displayName 'Bing Search'
Delete the web application that we created in the 'Creating objects' section:
$bingWebApp | Remove-IntuneMobileApp
Lock a managed device:
# Get a device to lock
$allDevices = Get-IntuneManagedDevice
$deviceToLock = $allDevices[0]
# Lock this device
$deviceToLock | Invoke-IntuneManagedDeviceRemoteLock
Format-Table
, Out-GridView
, ConvertTo-Csv
, ConvertTo-Json
, etc.Get-Help
Show-Command
Connect-MSGraph
Get-MSGraphMetadata
Get-MSGraphNextPage
and Get-MSGraphAllPages
Update-MSGraphEnvironment -Schema beta -AppId 00000000-0000-0000-0000-000000000000
Invoke-MSGraph
cmdletMSOnline
cmdlets before importing this Intune
module will cause errors. Please use the AzureAD
module instead, as the MSOnline
module is deprecated.
MSOnline
module, it should be imported AFTER the Intune
module. Note, however, that this is not officially supported.Dir -Recurse $sdkDir | Unblock-File
Invoke-MSGraphRequest
cmdlet should be used to make calls to Graph. This is because the difference in entities/properties between "beta" and "v1.0" (the schema that most cmdlets were generated from) can result in unexpected behavior.
Update-MSGraphEnvironment -SchemaVersion 'beta'