Microsoft Graph PowerShell SDK Admin Automation

Automate Intune device actions, query hardware hashes, manage device tags, and trigger remote syncs and wipes using the Microsoft.Graph PowerShell SDK.

Tags:#Microsoft Graph#PowerShell#Automation#Intune SDK#Scripting#MD-102

Overview

The Microsoft.Graph PowerShell SDK is Microsoft's official, modern management module for Microsoft Entra ID and Microsoft Intune. It replaces legacy modules (AzureAD, MSOnline) and provides direct, performant, token-authenticated access to the Microsoft Graph REST API (/v1.0 and /beta).

Administrators use Graph PowerShell to perform bulk operations, trigger remote device syncs, export inventory reports, and manage Autopilot device identities programmatically.

---

When to Use

Scenario	Recommendation	Technical Rationale
Bulk Device Actions (Sync / Restart / Wipe)	Graph PowerShell	Trigger actions across hundreds of machines simultaneously without manual portal clicking.
Autopilot Hardware Hash Automation	Graph PowerShell	Import, assign GroupTags, and verify profile assignments directly in automated CI/CD staging pipelines.
Export Custom Compliance Reports	Graph PowerShell	Query raw JSON device properties and export to CSV/PowerBI.

---

Prerequisites

PowerShell Module: Install Microsoft.Graph.Authentication and Microsoft.Graph.DeviceManagement.
Permissions / Scopes:
DeviceManagementManagedDevices.ReadWrite.All
DeviceManagementServiceConfig.ReadWrite.All
Role: Intune Administrator or Global Administrator.

---

Step-by-Step Implementation

Step 1: Install and Connect to Microsoft Graph

PowerShell

# Install only the required sub-modules (faster than full SDK)
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser -Force
Install-Module Microsoft.Graph.DeviceManagement -Scope CurrentUser -Force

# Authenticate with required scopes
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.ReadWrite.All", "DeviceManagementServiceConfig.ReadWrite.All"

Step 2: Trigger Bulk Remote Sync on All Windows Devices

PowerShell

# Query all Windows Intune-managed devices
$WinDevices = Get-MgDeviceManagementManagedDevice -Filter "operatingSystem eq 'Windows'"

# Trigger an immediate MDM policy check-in sync on each device
foreach ($dev in $WinDevices) {
    Write-Host "Triggering sync on device: $($dev.deviceName)..."
    Sync-MgDeviceManagementManagedDevice -ManagedDeviceId $dev.id
}

Step 3: Trigger Remote BitLocker Key Rotation

PowerShell

# Rotate BitLocker key on a specific compromised or decommissioned laptop
$TargetDevice = Get-MgDeviceManagementManagedDevice -Filter "deviceName eq 'CORP-LAPTOP-42'"
Rotate-MgDeviceManagementManagedDeviceBitLockerKey -ManagedDeviceId $TargetDevice.id

---

Useful Graph REST Endpoints

HTTP / REST

# Query all Autopilot Device Identities
GET https://graph.microsoft.com/beta/deviceManagement/windowsAutopilotDeviceIdentities

# Query Device Compliance Summary Count
GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?$select=deviceName,complianceState,operatingSystem

---

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

Key Exam Traps:

The deprecated AzureAD and MSOnline modules are no longer used; MD-102 questions strictly test Microsoft.Graph cmdlets.
Microsoft Graph endpoints for Autopilot devices and profiles are primarily available in the /beta schema.

PREVIOUS TOPIC5.4 Microsoft Store & Windows Package Manager (WinGet)NEXT TOPIC6.2 Intune Management Extension (IME) Log Diagnostics