PowerShell: Intune – Bulk Assign App Protection Policies by Group

.\Add-IntuneAppProtectionAssignment.ps1 -PolicyName "Corporate Data - iOS" -Platform iOS -GroupNames "SG-Sales-EMEA", "SG-Sales-APAC", "SG-Finance-Contractors"

.\Add-IntuneAppProtectionAssignment.ps1 -PolicyName "BYOD Baseline - Android" -Platform Android -GroupNames "SG-MAM-Pilot" -AsExclusion -WhatIf

.\Add-IntuneAppProtectionAssignment.ps1 -PolicyName "BYOD Baseline - Android" -Platform Android -GroupNames "SG-BYOD-All" -RemoveExisting

Resolved policy 'Corporate Data - iOS' (id: 3f2c9b4a-...)
Resolved group 'SG-Sales-EMEA' (id: 8a1d...)
Resolved group 'SG-Sales-APAC' (id: 5e77...)
Resolved group 'SG-Finance-Contractors' (id: c410...)
Existing assignments preserved: 2
New group targets added: 3 (include)
Assignment updated: 5 target(s) on 'Corporate Data - iOS'.

$uri = "https://graph.microsoft.com/v1.0/deviceAppManagement/iosManagedAppProtections/<policy-id>/assignments"
(Invoke-MgGraphRequest -Method GET -Uri $uri).value | ForEach-Object { $_.target }

<#
.SYNOPSIS
    Adds Entra ID groups to an Intune App Protection Policy assignment.
.DESCRIPTION
    Connects to Microsoft Graph, resolves an iOS or Android App Protection
    Policy by display name, resolves the target groups by display name, and
    calls the v1.0 assign action. The assign action takes the complete list of
    assignments, so the script reads the policy's current assignments first
    and merges the new group targets into them (unless -RemoveExisting is set).
    Groups can be added as included or excluded targets. Supports -WhatIf.
.PARAMETER PolicyName
    Display name of the App Protection Policy, exactly as it appears in Intune.
.PARAMETER Platform
    iOS or Android. Picks the iosManagedAppProtections or
    androidManagedAppProtections collection.
.PARAMETER GroupNames
    Display names of the Entra ID groups to add to the assignment.
.PARAMETER AsExclusion
    Adds the groups as excluded groups instead of included groups.
.PARAMETER RemoveExisting
    Replaces the assignment list instead of merging with what is already
    assigned.
.EXAMPLE
    .\Add-IntuneAppProtectionAssignment.ps1 -PolicyName "Corporate Data - iOS" -Platform iOS -GroupNames "SG-Sales-EMEA", "SG-Sales-APAC"
.EXAMPLE
    .\Add-IntuneAppProtectionAssignment.ps1 -PolicyName "BYOD Baseline - Android" -Platform Android -GroupNames "SG-MAM-Pilot" -AsExclusion -WhatIf
.NOTES
    Author  : Thomas Lasswell (https://www.techcolumnist.com)
    Version : 1.0 (2025-04-17)
    Requires: Microsoft.Graph.Authentication, Microsoft.Graph.Groups;
              DeviceManagementApps.ReadWrite.All and Group.Read.All.
.LINK
    https://learn.microsoft.com/en-us/graph/api/intune-mam-targetedmanagedappprotection-assign?view=graph-rest-1.0
#>

[CmdletBinding(SupportsShouldProcess = $true)]
param (
    [Parameter(Mandatory = $true)]
    [string]$PolicyName,

    [Parameter(Mandatory = $true)]
    [ValidateSet('iOS', 'Android')]
    [string]$Platform,

    [Parameter(Mandatory = $true)]
    [string[]]$GroupNames,

    [Parameter(Mandatory = $false)]
    [switch]$AsExclusion,

    [Parameter(Mandatory = $false)]
    [switch]$RemoveExisting
)

$ErrorActionPreference = 'Stop'
$graph = 'https://graph.microsoft.com/v1.0'

# Follow @odata.nextLink so large collections are read completely.
function Get-GraphCollection {
    param ([string]$Uri)
    $items = @()
    while ($Uri) {
        $page = Invoke-MgGraphRequest -Method GET -Uri $Uri
        $items += $page.value
        $Uri = $page.'@odata.nextLink'
    }
    return $items
}

if (-not (Get-MgContext)) {
    Connect-MgGraph -Scopes "DeviceManagementApps.ReadWrite.All", "Group.Read.All" -NoWelcome
}

$resource = if ($Platform -eq 'iOS') { 'iosManagedAppProtections' } else { 'androidManagedAppProtections' }

# Resolve the policy by display name (client-side match, exact and case-insensitive).
$policies = @(Get-GraphCollection -Uri "$graph/deviceAppManagement/$resource" |
    Where-Object { $_.displayName -eq $PolicyName })

if ($policies.Count -eq 0) {
    throw "No $Platform App Protection Policy found with display name '$PolicyName'."
}

if ($policies.Count -gt 1) {
    throw "Multiple $Platform App Protection Policies matched '$PolicyName'. Rename them so the display name is unique."
}

$policyId = $policies[0].id
Write-Host "Resolved policy '$PolicyName' (id: $policyId)"

# Resolve each target group to its object id. Single quotes are doubled for OData.
$targetType = if ($AsExclusion) { '#microsoft.graph.exclusionGroupAssignmentTarget' } else { '#microsoft.graph.groupAssignmentTarget' }

$groupTargets = foreach ($groupName in $GroupNames) {
    $escapedName = $groupName.Replace("'", "''")
    $group = @(Get-MgGroup -Filter "displayName eq '$escapedName'" -Property "id,displayName")

    if ($group.Count -eq 0) {
        throw "No Entra ID group found with display name '$groupName'."
    }

    if ($group.Count -gt 1) {
        throw "Multiple Entra ID groups matched '$groupName'. Use a unique display name."
    }

    Write-Host "Resolved group '$groupName' (id: $($group[0].Id))"

    @{
        target = @{
            '@odata.type' = $targetType
            groupId       = $group[0].Id
        }
    }
}

# Read the current assignment list so the assign call does not drop anyone.
$existingAssignments = @()

if (-not $RemoveExisting) {
    $current = Get-GraphCollection -Uri "$graph/deviceAppManagement/$resource/$policyId/assignments"
    $existingAssignments = @($current | ForEach-Object { @{ target = $_.target } })
    Write-Host "Existing assignments preserved: $($existingAssignments.Count)"
}

# De-duplicate on group id so re-running the script is safe.
$existingGroupIds = @($existingAssignments |
    Where-Object { $_.target.ContainsKey('groupId') } |
    ForEach-Object { $_.target.groupId })

$newTargets = @($groupTargets | Where-Object { $_.target.groupId -notin $existingGroupIds })
$finalAssignments = @($existingAssignments) + $newTargets

$mode = if ($AsExclusion) { 'exclude' } else { 'include' }
Write-Host "New group targets added: $($newTargets.Count) ($mode)"

if ($newTargets.Count -eq 0 -and -not $RemoveExisting) {
    Write-Host "Nothing to change."
    return
}

$body = @{ assignments = $finalAssignments } | ConvertTo-Json -Depth 10

if ($PSCmdlet.ShouldProcess($PolicyName, "Assign $($finalAssignments.Count) target(s)")) {
    Invoke-MgGraphRequest -Method POST -Uri "$graph/deviceAppManagement/managedAppPolicies/$policyId/assign" -Body $body -ContentType "application/json"
    Write-Host "Assignment updated: $($finalAssignments.Count) target(s) on '$PolicyName'."
}