How to find what a group is assigned in Microsoft Intune

Before you start

Use an account that can read Intune policies and apps. Microsoft names Read Only Operator as a role that can view existing policies and reports and can't make any changes. The tenant needs an active Intune licence. The PowerShell example requests DeviceManagementConfiguration.Read.All, DeviceManagementApps.Read.All and GroupMember.Read.All, the last to find the group by name; your organisation may require administrator consent.

Settings catalog policies and an app's isAssigned property are only in Microsoft Graph's beta, so the example uses the beta modules throughout. The assignments are read live. The examples read and export and change nothing.

Option 1

Find what a group is assigned with PowerShell

Install the modules once, then connect and read each kind of object with its assignments. Replace Contoso Laptops with your group's name.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Beta.Groups -Scope CurrentUser
Install-Module Microsoft.Graph.Beta.DeviceManagement -Scope CurrentUser
Install-Module Microsoft.Graph.Beta.Devices.CorporateManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
$groupName = 'Contoso Laptops'
$scopes = 'DeviceManagementConfiguration.Read.All', 'DeviceManagementApps.Read.All',
    'GroupMember.Read.All'
Connect-MgGraph -Scopes $scopes -NoWelcome
try {
    $group = @(Get-MgBetaGroup -Filter "displayName eq '$groupName'")
    if ($group.Count -ne 1) { throw "Found $($group.Count) groups named $groupName." }
    $rows = [System.Collections.Generic.List[object]]::new()
    # Adds a row for each of an object's assignments that names the group.
    function Add-GroupRow ($Kind, $Name, $Assignments) {
        foreach ($assignment in $Assignments) {
            $target = $assignment.Target.AdditionalProperties
            if ($target.groupId -ne $group[0].Id) { continue }
            $mode = if ($target.'@odata.type' -like '*exclusion*') { 'Exclude' } else { 'Include' }
            $rows.Add([pscustomobject]@{ Kind = $Kind; Name = $Name; Mode = $mode
                Intent = $assignment.Intent })
        }
    }
    $expand = @{ All = $true; ExpandProperty = 'Assignments' }
    foreach ($policy in Get-MgBetaDeviceManagementConfigurationPolicy @expand) {
        Add-GroupRow 'Settings catalog' $policy.Name $policy.Assignments
    }
    foreach ($config in Get-MgBetaDeviceManagementDeviceConfiguration @expand) {
        Add-GroupRow 'Configuration profile' $config.DisplayName $config.Assignments
    }
    foreach ($policy in Get-MgBetaDeviceManagementDeviceCompliancePolicy @expand) {
        Add-GroupRow 'Compliance policy' $policy.DisplayName $policy.Assignments
    }
    foreach ($app in Get-MgBetaDeviceAppManagementMobileApp -All | Where-Object IsAssigned) {
        $assignments = Get-MgBetaDeviceAppManagementMobileAppAssignment -MobileAppId $app.Id -All
        Add-GroupRow 'App' $app.DisplayName $assignments
    }
    if ($rows.Count -eq 0) {
        Write-Output "Nothing of these kinds names $groupName."
    } else {
        $rows | Sort-Object Kind, Name |
            Export-Csv -Path './group-assignments.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($rows.Count) assignments name $groupName."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The CSV has 1 row for each assignment, with whether it includes or excludes the group and, for an app, its intent, such as required or available. The script reads 4 lists; scripts, app protection and app configuration policies, enrolment profiles and update policies are lists of their own that it leaves out. It also leaves out All users and All devices, which reach the group's members whatever their groups.

Option 2

Check assignments in the admin centre

1. Sign in to the Microsoft Intune admin centre for the correct tenant.
2. Go to Troubleshooting + support > Troubleshoot, choose Select user and pick a member of the group.
3. Read the Groups tab for the person's groups, then Policy and Applications for what reaches them.
4. For 1 policy's groups, go to Devices > Manage devices > Configuration, select the Policies tab, select the policy and read Assignments. Leave it without editing.

This suits a question about 1 person or 1 policy. The troubleshooting pane shows what reaches a member through all their groups, not what the group itself is assigned, so for the group use PowerShell or a report.

Common questions

Why does a member get a policy the group isn't assigned?

Through another group they're in, or through All users or All devices. The troubleshooting pane lists the person's groups, direct and nested, beside what reaches them.

Why is a policy I know about missing from the CSV?

Check its kind first. The script reads settings catalog policies, older configuration profiles, compliance policies and apps; scripts, app protection policies and the rest are separate lists in Microsoft Graph.

How do I find objects assigned to no one?

That's the reverse question, with its own list. See how to find unassigned profiles and apps in Microsoft Intune.