AzureAD - PowerShell - Determine if device has MDM enabled

Method_Dev 41 Reputation points
2020-04-07T16:26:42.39+00:00

Is there a good way to do that?

Currently I have:

<# Connect To O365 Start #>
Connect-AzureAD -Credential $credentials | Out-null
<# Connect To O365 End #>

$devices_List = Get-AzureADDevice -Filter "(DisplayName eq 'DESKTOP-DHGUVFV')" | select * #-All $true 
$report = $devices_List | % { 
                   $device = $_
                   $registeredUser = (Get-AzureADDeviceRegisteredOwner -ObjectId $device.ObjectId)
                   [PSCustomObject]@{
                   Device = $device
                   userInfo = $registeredUser
                   }

                  }

$report.Device

But it sometimes does not line up with what is shown through the GUI

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,102 questions
0 comments No comments
{count} vote

Accepted answer
  1. Jerome L 201 Reputation points
    2020-04-08T12:24:49.427+00:00

    Here you go:

    Get-MsolDevice -All -ReturnRegisteredOwners | Where-Object {$_.RegisteredOwners.Count -gt 0}|Select DisplayName,DeviceOsType,DeviceTrustType,RegisteredOwners
    

    https://support.office.com/en-us/article/get-details-about-devices-managed-by-mobile-device-management-mdm-for-office-365-5602963c-a1f2-4c21-afb9-f66cd7dca1f0

    If you still can't find what you are looking for, then it might be time to mess with Graph API

    https://smsagent.blog/2018/10/22/querying-for-devices-in-azure-ad-and-intune-with-powershell-and-microsoft-graph/


3 additional answers

Sort by: Most helpful
  1. saurabh sharma 76 Reputation points
    2020-04-07T23:19:45.943+00:00

    You can check for IsManaged property of Get-AzureADDevice cmdlet result. If the value of isManaged parameter is True then device is enrolled and if it is False then device is not enrolled. You can also check for Get-MsolDevice for the same.


  2. Jerome L 201 Reputation points
    2020-04-07T23:55:37.32+00:00
    Get-AzureADDevice -All $true | select DisplayName,IsManaged
    

  3. Axel 1 Reputation point
    2021-08-26T16:59:09.937+00:00

    The isManagedAttribute is not very reliable.
    What I found out:
    isManaged False —> no corresponding device in intune

    isManaged True —> Device MAY exist in Intune

    isManaged $null —> no corresponding device in Intune