Export Intune devices NOT enrolled in any Group Memberships

Question

Looking for a PS script to export devices that are not associated with a Group Membership using MgGraph. It's easy enough to select a device in Intune, then select Group membership and see what groups they're in and not finding devices where Group membership = <null> is not.

Answer 1

@Joe Calabria, Thanks for posting in Q&A. From your description, I find you want to get the devices of which its group membership is null. If there's any misunderstanding, feel free to let us know.

Based on my testing, we can use the following script to get the information:

## Requires the Microsoft.Graph.Intune module
Install-Module -Name Microsoft.Graph.Intune
connect-msgraph

## Examples:
$Devices=(Get-IntuneManagedDevice).devicename
write-host "The device without any groupmembership:" 
Foreach ($Device in $Devices)
{

$GroupMembership = Get-DeviceGroupMembership -DeviceName $Device 

If ($GroupMembership -eq $null)
{
write-host $Device
}
    else 
    {
        Return    
    }
}


# Function
function Get-DeviceGroupMembership{
    [CmdletBinding(DefaultParameterSetName='Name')]
    Param(  
    [Parameter(Mandatory=$true,ParameterSetName='Name')]  
    [ValidateNotNullOrEmpty()]  
        [string]$DeviceName,
    [Parameter(Mandatory=$true,ParameterSetName='Id')]  
    [ValidateNotNullOrEmpty()] 
        [string]$AADDeviceId
    )

    $ProgressPreference = 'SilentlyContinue'
    # Get a user token for MS Graph
    $GraphToken = Connect-MSGraph -PassThru

    # Find the object id
    If ($DeviceName)
    {
        $URL = "https://graph.microsoft.com/v1.0/devices?`$filter=displayName eq '$DeviceName'&`$select=id"
    }
    If ($AADDeviceId)
    {
        $URL = "https://graph.microsoft.com/v1.0/devices?`$filter=deviceId eq '$AADDeviceID'&`$select=id"
    }
    $headers = @{'Authorization'="Bearer " + $GraphToken}
    $D_Response = Invoke-WebRequest -Uri $URL -Method GET -Headers $Headers -UseBasicParsing
    If ($D_Response.StatusCode -eq 200)
    {
        # Check for duplicates
        $DeviceId = ($D_Response.Content | ConvertFrom-Json).Value.id
        If ($DeviceId.Count -gt 1)
        {
            Write-Warning "Multiple devices found. Please pass a unique devicename or AAD device Id!"
            Return
        }
        else 
        {
            If ($DeviceId)
            {
                # Get the group membership
                $URL = "https://graph.microsoft.com/beta/devices/$DeviceId/memberOf?`$select=displayName,description,id,groupTypes,membershipRule,membershipRuleProcessingState"
                $G_Response = Invoke-WebRequest -Uri $URL -Method GET -Headers $Headers -UseBasicParsing
                If ($G_Response.StatusCode -eq 200)
                {
                    $Groups = ($G_Response.Content | ConvertFrom-Json).Value 
                }
            }

        }
    }
    else 
    {
        Return    
    }

    # If results found
    If ($Groups.Count -ge 1 -or $TransitiveGroups.Count -ge 1)
    {
        # Create a datatable to hold the groups
        $DataTable = [System.Data.DataTable]::New()
        $Columns = @()
        @(
            'Name'
            'Description'
            'Object Id'
            'Membership Type'
            'Direct or Transitive'
            'Membership Rule'
            'Membership Rule Processing State'
        ) | foreach {
            $Columns += [System.Data.DataColumn]::new("$_")
        }
        $DataTable.Columns.AddRange($Columns)

        # Add the groups
        foreach ($Group in $Groups)
        {
            If (($Group.groupTypes | Select -First 1) -eq "DynamicMembership")
            {$MembershipType = "Dynamic"}
            Else {$MembershipType = "Assigned"}
            [void]$DataTable.Rows.Add($Group.displayName,$Group.description,$Group.id,$MembershipType,"Direct",$Group.membershipRule,$Group.membershipRuleProcessingState)
        }

        # Add the transitive groups
        foreach ($TransitiveGroup in ($TransitiveGroups | where {$_.id -NotIn $Groups.id}))
        {
            If (($TransitiveGroup.groupTypes | Select -First 1) -eq "DynamicMembership")
            {$MembershipType = "Dynamic"}
            Else {$MembershipType = "Assigned"}
            [void]$DataTable.Rows.Add($TransitiveGroup.displayName,$TransitiveGroup.description,$TransitiveGroup.id,$MembershipType,"Transitive",$TransitiveGroup.membershipRule,$TransitiveGroup.membershipRuleProcessingState)
        }

        Return $DataTable
    }
}

Hope the above information can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Thank you for clarifying and prompt assistance. Good result finding that all our Intune devices were found without any Group memberships.