Automating Intune with PowerShell & Microsoft Graph

The Intune admin center is just a Graph client

Why the exam cares

The July 2026 blueprint added a whole skill area for automation, monitoring and reporting. The exam is no longer satisfied that you can configure Intune — it wants to know you can operate it at scale, and at scale means scripted.

The two PowerShell paths

Microsoft Graph PowerShell SDK vs raw REST

Feature	Microsoft Graph PowerShell SDK	Invoke-MgGraphRequest / REST
What it is	Purpose-built cmdlets (Get-MgDeviceManagementManagedDevice)	You call the API endpoint directly
Best for	Everyday tasks with a supported cmdlet	Beta endpoints or anything the SDK hasn't wrapped
Discoverability	Tab completion, Get-Help, typed objects	You must know the URL and payload shape
Install	Install-Module Microsoft.Graph	Ships inside the SDK — no extra module
Auth	Connect-MgGraph -Scopes ...	Reuses the same Connect-MgGraph session

Both paths authenticate the same way. The SDK is a convenience layer over the REST call — it is not a different permission model.

A minimal, honest example

# 1. Connect with only the scopes you need (least privilege)
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"

# 2. Use a purpose-built cmdlet
Get-MgDeviceManagementManagedDevice -All |
    Where-Object { $_.ComplianceState -ne 'compliant' } |
    Select-Object DeviceName, UserPrincipalName, ComplianceState

# 3. Or call the endpoint directly when no cmdlet exists yet
Invoke-MgGraphRequest -Method GET `
  -Uri "https://graph.microsoft.com/beta/deviceManagement/managedDevices?`$top=50"

💡 Exam tip: consent and scopes are the usual trap

A very common exam framing is “the script fails with Insufficient privileges”. The answer is almost never “make them Global Administrator”.

Work through it in this order:

1. Was the right scope requested? Connect-MgGraph -Scopes must include the permission the call needs — a .Read.All scope cannot create a policy.
2. Was admin consent granted? Application permissions, and many delegated ones, need an admin to consent once for the tenant.
3. Does the signed-in admin hold an Intune RBAC role that allows it? Graph permission and Intune role are both evaluated. Passing one does not bypass the other.

Least privilege is the expected answer. Global Administrator is the distractor.

Delegated vs application permissions

	Delegated	Application
Runs as	A signed-in user	The app itself, no user present
Typical use	An admin running a script interactively	Unattended automation, scheduled jobs, Azure Automation
Effective rights	Intersection of user rights and the granted scope	Exactly the granted app role
Exam signal	”an administrator runs the script"	"runs nightly with no user signed in”

If a question says scheduled, unattended, or service principal, it is pointing at application permissions.

Extending device compliance with PowerShell

Built-in compliance settings cover common ground — encryption, OS version, password rules. Custom compliance covers everything else.

The two required pieces

Piece	What it does	Gotcha
Discovery script (PowerShell)	Collects the facts and returns them as JSON	Must write JSON to stdout with -Compress; only one output object
JSON rules file	Declares expected value, operator, data type, and the user-facing message	SettingName must match the script’s key exactly, including case

# Discovery script — returns one compressed JSON object
$agent = Get-Service -Name 'ContosoAgent' -ErrorAction SilentlyContinue

$result = @{
    AgentInstalled = [bool]($null -ne $agent)
    AgentVersion   = if ($agent) { '4.2.1' } else { '0.0.0' }
}

return $result | ConvertTo-Json -Compress

⚠️ Where custom compliance goes wrong in real life

Three failures account for most support tickets, and all three are examinable:

• Key name mismatch. AgentInstalled in the script and agentInstalled in the JSON rules will never match. It is case-sensitive.
• The script writes more than one thing. A stray Write-Host, a warning, or a second return breaks JSON parsing, and the device reports an error rather than non-compliance.
• Script runs in the wrong context. Custom compliance scripts run as SYSTEM by default, and in the 32-bit PowerShell host by default. A registry key under HKCU, or a per-user install path, will not be visible because of the SYSTEM context. Separately, the 32-bit default means a read of HKLM\Software is silently redirected to HKLM\Software\WOW6432Node, so a 64-bit application can appear to be missing. Both behaviours are opt-out settings: set Run this script using the logged on credentials to Yes for user context, and Run script in 64 bit PowerShell Host to Yes for the 64-bit host.

Compliance is not the same as configuration: compliance reports a state, it does not fix it. If the question wants the issue fixed automatically, the answer is a remediation script, not custom compliance.

Compliance, remediation or configuration?

This distinction is heavily tested, and the wording of the question is the tell.

The question says…	The answer is	Because
”report which devices lack X”	Custom compliance	Reports state; can drive Conditional Access
”detect and automatically fix X”	Remediation (Scripts and remediations)	Detection + remediation script pair
”enforce this setting on the device”	Configuration profile	Sets and maintains the setting
”block access until it’s fixed”	Compliance + Conditional Access	Compliance is the signal; CA is the enforcement

Question

Which two artefacts does Windows custom compliance require?

Click or press Enter to reveal answer

Answer

A PowerShell discovery script that outputs a single compressed JSON object, and a JSON rules file defining expected values, data types, operators and the remediation message shown to the user.

Click to flip back

Question

A script must run nightly with no one signed in. Delegated or application permissions?

Click or press Enter to reveal answer

Answer

Application permissions. There is no signed-in user to delegate from, so the app authenticates as itself using permissions an administrator consented to.

Click to flip back

Question

Connect-MgGraph succeeds but a create call fails with Insufficient privileges. What should you check first?

Click or press Enter to reveal answer

Answer

Whether the requested -Scopes cover the write operation and whether admin consent was granted, plus the admin's Intune RBAC role. Escalating to Global Administrator is the distractor, not the fix.

Click to flip back

Question

Custom compliance detects a missing agent. What actually installs it?

Click or press Enter to reveal answer

Answer

Nothing. Compliance only reports state. Use a Remediation script package or an app deployment to fix the device.

Click to flip back

Question

In what context do Windows custom compliance scripts run by default?

Click or press Enter to reveal answer

Answer

As SYSTEM, and in the 32-bit PowerShell host. SYSTEM means per-user locations such as HKCU are invisible, and the 32-bit host means HKLM\Software reads are redirected to WOW6432Node. Both are opt-in settings you can change.

Click to flip back

Knowledge Check

An administrator needs a nightly unattended script that exports all non-compliant devices to a file share. Which permission type should the app registration use?

ADelegated permissions, because an administrator owns the scriptBApplication permissions, because no user is signed in at runtimeCDelegated permissions combined with the Intune Administrator roleDNo permissions are required if the script runs on a hybrid-joined server

Check Answer

Knowledge Check

A custom compliance policy always returns an error rather than a compliant or non-compliant result, yet the discovery script works correctly when run manually. What is the most likely cause?

AThe JSON rules file is missing a remediation messageBThe script emits additional output alongside the JSON, which breaks parsingCThe device is not registered in Microsoft Entra IDDCustom compliance requires the Intune Suite add-on

Check Answer