AzureAD - PowerShell - Determine if device has MDM enabled

Question

AzureAD - PowerShell - Determine if device has MDM enabled

Method_Dev 41

Is there a good way to do that?

Currently I have:

<# Connect To O365 Start #>
Connect-AzureAD -Credential $credentials | Out-null
<# Connect To O365 End #>

$devices_List = Get-AzureADDevice -Filter "(DisplayName eq 'DESKTOP-DHGUVFV')" | select * #-All $true 
$report = $devices_List | % { 
                   $device = $_
                   $registeredUser = (Get-AzureADDeviceRegisteredOwner -ObjectId $device.ObjectId)
                   [PSCustomObject]@{
                   Device = $device
                   userInfo = $registeredUser
                   }

                  }

$report.Device

But it sometimes does not line up with what is shown through the GUI

Answer 1

Ĵerome L 196

Here you go:

Get-MsolDevice -All -ReturnRegisteredOwners | Where-Object {$_.RegisteredOwners.Count -gt 0}|Select DisplayName,DeviceOsType,DeviceTrustType,RegisteredOwners

https://support.office.com/en-us/article/get-details-about-devices-managed-by-mobile-device-management-mdm-for-office-365-5602963c-a1f2-4c21-afb9-f66cd7dca1f0

If you still can't find what you are looking for, then it might be time to mess with Graph API

https://smsagent.blog/2018/10/22/querying-for-devices-in-azure-ad-and-intune-with-powershell-and-microsoft-graph/

Method_Dev 41 Reputation points

2020-04-08T12:28:08.11+00:00

That is what I thought and ended up doing. Thanks for the time and help!

Answer 2

saurabh sharma 76

You can check for IsManaged property of Get-AzureADDevice cmdlet result. If the value of isManaged parameter is True then device is enrolled and if it is False then device is not enrolled. You can also check for Get-MsolDevice for the same.

Method_Dev 41 Reputation points

2020-04-08T00:18:23.477+00:00

If that is the case then why do I see this:

https://imgur.com/a/5rpItYG

Answer 3

Ĵerome L 196

Get-AzureADDevice -All $true | select DisplayName,IsManaged

Method_Dev 41 Reputation points

2020-04-08T10:38:59.047+00:00

If that is the case then why do I see this:

https://imgur.com/a/5rpItYG

Answer 4

Axel 1

The isManagedAttribute is not very reliable.
What I found out:
isManaged False —> no corresponding device in intune

isManaged True —> Device MAY exist in Intune

isManaged $null —> no corresponding device in Intune

Axel 1 Reputation point

2021-09-23T09:54:49.613+00:00

Just to outline my assumption with the isManaged True:

$devices = Get-AzureADDevice -All $true | Where-Object {$_.isManaged -eq $true}
$devices.Count --> nearly 35k devices

(Get-IntuneManagedDevice | Get-MSGraphAllPages).count --> 6300 devices

Can anyone explain?
Axel 1 Reputation point

2021-09-23T10:04:32.97+00:00

Could it be the case, that many of the AzureAD-Devices, which have isManaged -eq $true are stale devices?

So we may have 1 Intune Device matching e.g. 5 AzureADDevices? And four of those 5 are stale devices, but all of those four have isManaged $-eq $true?

AzureAD - PowerShell - Determine if device has MDM enabled

3 additional answers

Activity