With over 15 years of experience as a system administrator, I have a passion for automating workflows using PowerShell. I believe in sharing my creations with t
If you invoke some Azure or Graph Api call and see an error similar to this one (RoleAssignmentRequestAcrsValidationFailed) 👇, you should read this post 🙂. The error code RoleAssignmentRequestAcrsValidationFailed, followed by the failed claim clai...
If you are using Azure Local (HCI), you might find the following PowerShell script AzureLocalVMImageUpdater.ps1 useful. What is it good for? The code replaces the Windows VM images in the specified Azure Local cluster(s) with the latest compatible ve...
Problem It happens that the hardware hash of your Autopilot device gets changed. Thanks to the replacement of the motherboard or some other issue. This can lead to future problems when your users need to reinstall the operating system, but the Autopi...
Introduction & Problem Statement Picture this: You're tasked with auditing 200 virtual machines across multiple Azure subscriptions. Your PowerShell script needs to check VM status, retrieve configurations, and gather diagnostic information. Using th...
Keeping a secure, version-controlled backup of your Intune-managed device data, including BitLocker, LAPS, and FileVault keys, is a best practice for any modern IT team. In this post, I’ll guide you through an Azure DevOps pipeline that automates the...
Graph Api batching is a great way to improve the performance of your Graph API-related scripts dramatically. It enables parallel execution of up to 20 Graph API calls, which is fantastic, but there is one tiny little problem. You have to write your o...
I've released a new PowerShell function called Compare-IntuneSecurityBaseline in my IntuneStuff module. This function allows you to easily identify the differences in settings between two Intune Security baselines. For instance, when Microsoft introd...
You should carefully consider whether you allow your employees to use free GitHub Copilot. This way they can potentially leak some sensitive company data and nobody wants that 🙂 Below is a short PowerShell script to identify the usage of the free G...
It happened to us several times that Azure showed company devices as non-compliant, but Intune showed them as compliant. And this wasn’t fixed over time. This is quite a problem in case, you require device compliance in your Azure Conditional policie...
In this post, I will show you how to easily convert official Microsoft Windows Security Baselines into Azure ARC Guest Configuration (DSC) packages. So you can easily deploy them to your ARC-managed clients or any DSC-managed client. In general, you ...
Today, I’ll guide you through setting up an automation system that notifies your users about vulnerable software detected on their devices. This information will be sourced from the Microsoft Defender API. In this post, I’ll demonstrate how to create...
In case you are using Microsoft Defender you are familiar with the security.microsoft.com portal. You also probably know that Microsoft also offers API for this security solution. Today I will show you some of my PowerShell commands (M365DefenderStuf...
You may have heard about a new (currently in preview) feature called Runtime Environment. The main features are: You can have multiple custom runtime environments that can be used across numerous Runbooks (a.k.a. one runtime in multiple runbooks) T...
With the introduction of the Workload Identity Federation feature (currently in preview but functioning well), we can leverage the identity associated with our Pipeline for authentication with Microsoft Graph and other Azure services, eliminating the...
Continue reading if you want to have the ability to run PowerShell code (similar to Invoke-Command) against your Windows Intune-managed hybrid and cloud-only clients in a nearly real-time fashion and at the same time get the code results back 😎 💡 ...
In my previous article, I've shown you, how to get the permissions required to run selected PowerShell code. Today I will focus on getting Microsoft Graph PowerShell SDK modules. The official Find-MgGraphCommand function, which retrieves the parent m...
Now that Microsoft Graph API is the main management tool for most of the Microsoft Cloud services, more and more admins will need to be able to work effectively with it. Graph API can be quite hard to understand, mainly the scope/permission part of i...
Because Azure Runbooks are invoked in temporary environments, you cannot save the Runbook results for later use in the local files. Which is one of the drawbacks compared to on-premises Schedules Tasks. But what if you need some output persistence? F...
Today I will show you how to make the process of updating apps in your company as easy as possible 😎. We will use: WinGet to update the applications Winget-AutoUpdate tool to be more specific Intune to distribute Winget-AutoUpdate tool Custom A...
I like the idea of Autopatch ring groups where you have one "root" group, whose members are distributed across several "ring" groups based on a given percentage proportion. And because I needed the same thing for my gradual applications update automa...