Bulk Assigning Apps and Policies in Intune

by

Sometimes when working with an Intune environment, I find myself needing to assign all of the policies, apps etc. to a new Entra ID Group (new UAT group, changing from All Users etc.)

Currently, this is a VERY manual process, clicking on each in the web portal and then assigning, but thanks to PowerShell and Microsoft Graph (and a touch of JSON), now it’s possible.

Introducing the Bulk Assignment GUI Tool

As with all scripts, it is available on Github here and also on PowerShell Gallery

Install-Script -Name bulk-assign-intune

I’m not going to run through the whole code here, but to run through what it does:

First up it installs the Intune Graph PowerShell modules in the current user context

Then it will bring a prompt to connect to Entra ID and grab all of the Entra groups to populate the group drop-down

Once the GUI loads, you can pick what you want to assign and to which group.

On clicking Assign, it gets the ID of the Entra group, loops through everything in the selected categories and assign to the selected group.

For Windows, iOS and Android apps, it will assign the applications as Available to avoid having potentially hundreds of apps auto-installing!

For MacOS, Available isn’t an option so this will mark as required so be extra careful with these

Hope this is of some use, happy assigning!!

59 thoughts on “Bulk Assigning Apps and Policies in Intune”

  1. Excellent, thank you for that. Just what I needed. With a few tweaks, I was able to do everything I was after in this particular situation where I had lots of different stuff to assign to a few groups. Saved lots of time, thanks again! 🙂

    Reply

  2. Hi Andrew,
    Love the idea with the script. I’m looking for a way to bulk add a Group to the Uninstall intent of iOS VPP. The idea is that I could have one Entra Group that I use to remove any and all installed apps from an iOS device before changing that devices assignment and re-installing only needed apps for it’s new purpose.

    I tried modifying the script myself to add the Uninstall intent but it’s not working. I get a multiple of responses in the log.

    Sometimes the reported response is “Assigned IOS_Clear to [AppID]” except when I check the app in Intune the IOS_Clear group was not added to the Uninstall.

    Other times the response is “Application already has an assignment” which I presume is because it has a Group already in the Required or Available intent though I’m trying to add to the Uninstall intent.

    The last response I get sometimes is the “Method invocation failed because [System.Net.Http.HttpResponseMessage] does not contain a method named ‘GetResponseStream'” error.

    Reply

  3. Thank you for this. I ran this to add a test user group to all the apps and noticed: 1. all existing assignments were removed and replaced with the test group. 2. assignments were done for all the apps including the previously un-assigned ones. It would be nice to have an option to not replace existing assignments and not assign to apps that are already not-assigned. Cheers.

    Reply

  5. Sry – it catched the old file. It does work now – thank you 🙂
    For me it’s ok now – if it would notice existing assignments it has been perfect but there just a few.

    Reply

  6. Unfortunately not :/

    Assigning Adobe Acrobat Reader: Edit PDF
    Invoke-MgGraphRequest: C:\Scripts\bulk-assign-vpp-apps-only.ps1:171
    Line |
    171 | Invoke-MgGraphRequest -Uri $url -Method POST -Body $json -ContentType …
    | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    | POST https://graph.microsoft.com/beta/deviceAppManagement/mobileApps/2d497954-3541-4538-8d1b-f4877c41af54/assign
    | HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Vary: Accept-Encoding Strict-Transport-Security:
    | max-age=31536000 request-id: 604b1879-7f87-4a63-ad45-8c224f7b9bca client-request-id:
    | 65b1ab6d-f495-4498-a745-c0974078cebc x-ms-ags-diagnostic: {“ServerInfo”:{“DataCenter”:”Germany West
    | Central”,”Slice”:”E”,”Ring”:”5″,”ScaleUnit”:”005″,”RoleInstance”:”FR3PEPF000002DC”}} Date: Thu, 05 Oct 2023
    | 20:55:09 GMT Content-Type: application/json Content-Encoding: gzip
    | {“error”:{“code”:”BadRequest”,”message”:”{\r\n \”_version\”: 3,\r\n \”Message\”: \”IsRemovable setting is only
    | supported for Required intent. – Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 –
    | Activity ID: 65b1ab6d-f495-4498-a745-c0974078cebc – Url:
    | https://fef.msub03.manage.microsoft.com/AppLifecycle_2309/StatelessAppMetadataFEService/deviceAppManagement/mobileApps('2d497954-3541-4538-8d1b-f4877c41af54‘)/microsoft.management.services.api.assign?api-version=5023-08-07\”,\r\n \”CustomApiErrorPhrase\”: \”\”,\r\n \”RetryAfter\”: null,\r\n \”ErrorSourceService\”: \”\”,\r\n \”HttpHeaders\”: \”{}\”\r\n}”,”innerError”:{“date”:”2023-10-05T20:55:09″,”request-id”:”604b1879-7f87-4a63-ad45-8c224f7b9bca”,”client-request-id”:”65b1ab6d-f495-4498-a745-c0974078cebc”}}}

    Reply

  7. To mitigate the issue I removed and re-added the VPP Token from intune to get all assignments deleted again. I adjusted line 154 “intent”: “Required”, to “intent”: “Available”, but this throws errors.

    Reply

  10. It fetch up all the applications successfully and also notice when an assignment already exist but stucks always at line 944. In the beginning it shows a issue already at Line 1735. Unfortunately my coding skills to poor to troubleshoot :/

    Getting Applications
    InvalidOperation: C:\temp\scripts\bulk-assign-intune-vpp.ps1:1735
    Line |
    1735 | … if (($intents.intent.contains(“required”)) -or ($assignedgrou …
    | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    | You cannot call a method on a null-valued expression.
    InvalidOperation: C:\temp\scripts\bulk-assign-intune-vpp.ps1:944
    Line |
    944 | $errorResponse = $ex.Response.GetResponseStream()
    | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    | Method invocation failed because [System.Net.Http.HttpResponseMessage] does not contain a method named
    | ‘GetResponseStream’.
    Assigned All Users to Adobe Acrobat Reader: Edit PDF/cfd21bb9-1709-4d84-a7ef-2bf3e8dff0e6
    InvalidOperation: C:\temp\scripts\bulk-assign-intune-vpp.ps1:944
    Line |
    944 | $errorResponse = $ex.Response.GetResponseStream()
    | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    | Method invocation failed because [System.Net.Http.HttpResponseMessage] does not contain a method named
    | ‘GetResponseStream’.
    Assigned All Users to Rail Map Lite/a0215496-0945-4645-aefa-262ccea2c161
    Application already has an assignment
    InvalidOperation: C:\temp\scripts\bulk-assign-intune-vpp.ps1:944
    Line |
    944 | $errorResponse = $ex.Response.GetResponseStream()
    | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    | Method invocation failed because [System.Net.Http.HttpResponseMessage] does not contain a method named
    | ‘GetResponseStream’.

    Reply

  11. Thanks for the prompt answer – unfortunately it shows the same error:

    Line |
    944 | $errorResponse = $ex.Response.GetResponseStream()
    | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    | Method invocation failed because [System.Net.Http.HttpResponseMessage] does not contain a method named
    | ‘GetResponseStream’.

    Reply

    • Change line 931-934 from this:
      "target": {
      "@odata.type": "#microsoft.graph.groupAssignmentTarget",
      "groupId": "$TargetGroupId"
      },

      To this:

      "target": {
      "@odata.type": "#microsoft.graph.allLicensedUsersAssignmentTarget"
      },

      Reply

  14. I tried to use the “bulk-assign-intune-vpp.ps1” to assign apps to “All Users” as available.
    During processing it gives follwoing error:
    Line |
    945 | $errorResponse = $ex.Response.GetResponseStream()
    | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    | Method invocation failed because [System.Net.Http.HttpResponseMessage] does not contain a method named
    | ‘GetResponseStream’.

    Reply

  16. I could see that the assignment ID is just the groupid plus a numerical value for the assignment intent, so originally I tried to just set that but it wouldn’t work. At the moment I don’t see another way but to pull the existing assignments down.

    I sent you a message with the script. I’m sure there’s better ways to dynamically create json code, etc. It’s really more of a ‘how-to’ that I put together late at night.

    Reply

  17. Hey Andrew,

    Thanks for your efforts on this script. I needed exactly this to get some Apple VPP and Android Managed Google Play apps deployed in bulk.

    The only thing that I found was a problem was that the assign method would wipe any existing assignments for an app. I could see you put a failsafe on the VPP apps that it would simply not allow it. I’m not an elegant coder, but for Android and VPP I was able to add some code to pull down any existing assignments, then re-apply those assignments along with the new one so that everything existing remained there.

    Happy to share this with you.

    Thanks!

    Reply

  19. I really want to assign managed store apps and ONLY managed store apps en-masse across the selected device group, is this possible?

    Reply

  20. Since the latest update I just get stuck at

    Installing Microsoft Graph modules if required (current user scope)

    Reply

  21. not working i am getting an error when the script tries to assign the apps
    Getting Applications
    Method invocation failed because [System.Net.Http.HttpResponseMessage] does not contain a method named ‘GetResponseStream’.
    At C:\Users\YacovMor\OneDrive – Solutech\Scripts\Assign Bulk Intune.ps1:3144 char:9
    + $errorResponse = $ex.Response.GetResponseStream()
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : MethodNotFound

    Reply

  22. I just realized, the term I meant was “Managed Google Play store app”, not Android Enterprise app.

    When the script goes through those applications, it errors out, except for Web Apps.

    Reply

    • Ah, in that case, edit the script and find the add-applicationassignment function (should be around line 2998) and replace the JSON with this:
      {
      “mobileAppAssignments”: [
      {
      “@odata.type”: “#microsoft.graph.mobileAppAssignment”,
      “intent”: “Available”,
      “settings”: {
      “@odata.type”: “#microsoft.graph.androidManagedStoreAppAssignmentSettings”,
      “androidManagedStoreAppTrackIds”: [],
      “autoUpdateMode”: “default”
      },
      “target”: {
      “@odata.type”: “#microsoft.graph.allLicensedUsersAssignmentTarget”
      }
      }
      ]
      }

      Reply

  23. One more thing, is there not a way for this to apple to AE apps where we can just make them available? That can be done manually for “All Users”, otherwise we are looking at making all of the apps download automatically. With other MDMs this has created a huge issue with Google Services.

    If this won’t work, it definitely defeats the purpose of this script for me, but I may be going about this the wrong way. I’m at the very beginning with Intune.

    Reply

  25. I’m getting error responses when attempting to assign applications to any group on intune. Is there an issue with assigning Android Enterprise applications maybe? The script was able to bulk assign iOS apps.

    It did assign one app from managed google play, but it is a web app.

    I get the following error. I’m wondering if I made some weird rookie mistake.

    Method invocation failed because [System.Net.Http.HttpResponseMessage] does not contain a method named
    ‘GetResponseStream’.
    At C:\Users\matthew.bostic\Documents\PowerShell\Scripts\bulk-assign-intune.ps1:3113 char:9
    + $errorResponse = $ex.Response.GetResponseStream()
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : MethodNotFound

    Reply

  26. Very useful script, thanks.
    I assigned iOS apps but then realised they were user not device! So used your tip above to amend the script but now when running again to reassign correctly, I get “Method invocation failed because [System.Net.Http.HttpResponseMessage] does not contain a method named
    ‘GetResponseStream’.”
    which I think relates to where the app already has an assignment of that type e.g. “available”? or maybe where it’s trying to overwrite with group of the same name?
    Any thoughts on how I can resolve this?

    Reply

  27. Hello Andrew,

    when we assign our group to ios apps, they are stored as user license, but we need them to be as device license. Do you know what we need to adjust?

    Regards,
    Florian

    Reply

    • Hi Florian,

      If it’s VPP apps, you need to add settings into the JSON in the Add-ApplicationAssignment function (I would probably create another function for it):

      Function Add-ApplicationAssignmentVPPiOS() {
      <# .SYNOPSIS This function is used to add an application assignment using the Graph API REST interface .DESCRIPTION The function connects to the Graph API Interface and adds a application assignment .EXAMPLE Add-ApplicationAssignmentVPPiOS -ApplicationId $ApplicationId -TargetGroupId $TargetGroupId -InstallIntent $InstallIntent Adds an application assignment in Intune .NOTES NAME: Add-ApplicationAssignmentVPPiOS #>

      [cmdletbinding()]
      param
      (
      $ApplicationId,
      $TargetGroupId,
      $InstallIntent
      )
      $graphApiVersion = “Beta”
      $Resource = “deviceAppManagement/mobileApps/$ApplicationId/assign”
      try {

      if (!$ApplicationId) {
      write-host “No Application Id specified, specify a valid Application Id” -f Red
      break
      }
      if (!$TargetGroupId) {
      write-host “No Target Group Id specified, specify a valid Target Group Id” -f Red
      break
      }

      if (!$InstallIntent) {
      write-host “No Install Intent specified, specify a valid Install Intent – available, notApplicable, required, uninstall, availableWithoutEnrollment” -f Red
      break
      }
      $JSON = @”
      {
      “mobileAppAssignments”: [
      {
      “@odata.type”: “#microsoft.graph.mobileAppAssignment”,
      “settings”: {
      “@odata.type”: “#microsoft.graph.iosVppAppAssignmentSettings”,
      “isRemovable”: true,
      “uninstallOnDeviceRemoval”: false,
      “useDeviceLicensing”: true,
      “vpnConfigurationId”: null
      },
      “target”: {
      “@odata.type”: “#microsoft.graph.groupAssignmentTarget”,
      “groupId”: “$TargetGroupId”
      },
      “intent”: “$InstallIntent”
      }
      ]
      }
      “@
      $uri = “https://graph.microsoft.com/$graphApiVersion/$($Resource)”
      Invoke-MgGraphRequest -Uri $uri -Method Post -Body $JSON -ContentType “application/json”
      }
      catch {
      $ex = $_.Exception
      $errorResponse = $ex.Response.GetResponseStream()
      $reader = New-Object System.IO.StreamReader($errorResponse)
      $reader.BaseStream.Position = 0
      $reader.DiscardBufferedData()
      $responseBody = $reader.ReadToEnd();
      Write-Host “Response content:`n$responseBody” -f Red
      Write-Error “Request to $Uri failed with HTTP Status $($ex.Response.StatusCode) $($ex.Response.StatusDescription)”
      write-host
      break
      }
      }

      Then change this to use the new function:
      if ($ios.checked -eq $True) {
      ##Assign iOS apps

      foreach ($iosapp in $iosapps) {
      Add-ApplicationAssignment -ApplicationId $iosapp.id -TargetGroupId $intunegrp.Id -InstallIntent $assignmenttype
      Write-Host “Assigned $($intunegrp.DisplayName) to $($iosapp.displayName)/$($iosapp.id)” -ForegroundColor Green

      }
      Add-Type -AssemblyName PresentationCore, PresentationFramework
      $msgBody = “iOS Apps Assigned”
      [System.Windows.MessageBox]::Show($msgBody)
      }

      I hope this helps

      Reply

  29. Hi,

    now all groups are shown, thanks!
    Yes, maybe a free text field would be helpful.

    But now I get another error after press “Assign”

    Shell:
    Getting Applications
    No Install Intent specified, specify a valid Install Intent – available, notApplicable, required, uninstall, availableWithoutEnrollment

    Reply

  30. Thanks for quick response!

    No didnt show up 🙁 maybe its because Groups are limited to 99? We have over 1000 AD Groups.
    If i enter the group name manually it always says

    Get-MgGroup : Unsupported or invalid query filter clause specified for property ‘displayName’ of resource ‘Group’.
    […]
    No Target Group Id specified, specify a valid Target Group Id

    Reply

  31. Hi,

    nice tool!
    Unfortunately it doesnt show all Azure AD Groups?
    I have a Group name Structure “ABC-DEF-GHIJK (LMNO)” and it wont shop up.

    Reply

  33. Thanks for the tool but at this stage it’s no use for me and I work with Windows and IOS and not having the option to assign groups as REQUIRED is a setback. I never use AVAILABLE. A wish for this tool is to have a dropdown list to select the type of assignment.

    Reply

Leave a Comment