A Windows PowerShell GUI wizard that bulk-adds or removes Microsoft Intune assignments and role scope tags across Win32 apps and Windows configuration profiles, without ever replacing what is already on an object.
Every operation is targeted. Adding an assignment leaves every existing assignment in place. Removing one takes out only the group you chose and keeps the rest, including All Devices, All Users, and Configuration Manager collection targets the tool cannot itself create. Scope tags are only ever added to the tags an object already has. Nothing is cleared wholesale, and no operation touches an assignment or a tag you did not ask for.
Intune configuration profiles have no additive assignment API. All four Windows
profile types expose only a bulk /assign action, and that action replaces the
entire assignment set with whatever you post. Do it by hand and it is easy to
wipe every existing group off a profile. This wizard runs the read-merge-write
for you: it reads the current assignments, merges in your change, and writes the
whole set back, so the existing targets survive.
Choose what to work with (Win32 apps, Windows configuration profiles, or both) and what to change (assignments, scope tags, or both), then authenticate to Microsoft Graph. Tenant ID and Client ID are optional. Permissions are checked on connect, and tabs that cannot affect the chosen change are removed from the wizard.
Search Entra ID for the target group, choose Include or Exclude, choose Add or Remove, and optionally apply a Windows assignment filter. Filters already on existing assignments are not modified. (Group names and IDs are redacted in this screenshot.)
Optionally select one or more role scope tags to apply to every selected object.
Tags you do not select are never touched, and an object's last remaining tag is
never removed. The built-in Default tag is ID 0.
Search apps and configuration profiles by display-name prefix, narrow the loaded results with a free-text filter and a type filter, and multi-select one or more objects. Selections are kept across filter changes, so you can use several filters in turn to build up one selection. On a Remove run this tab instead lists the objects the change applies to, pre-selected.
Review the run, optionally use Preview Impact (read-only) to confirm the current state before you commit, then Finish. (Tenant ID is redacted in this screenshot.)
Two independent choices are made on the Connect tab:
- Work with: Win32 apps, Windows configuration profiles, or both.
- Change: assignments only, scope tags only, or both.
Choosing scope tags only removes the Assignment tab, moves Add/Remove to the Scope Tags tab, and never reads or writes assignments. Choosing assignments only removes the Scope Tags tab. The Summary always states which halves are in play.
Apps are limited to win32LobApp and win32CatalogApp. Configuration profiles
are limited to Windows platforms across four object types:
| Object type | Covers |
|---|---|
configurationPolicies |
Settings catalog and templates |
deviceConfigurations |
Legacy device configuration profiles |
groupPolicyConfigurations |
ADMX / administrative templates |
deviceCompliancePolicies |
Compliance policies |
Assignment filters are limited to the windows10AndLater platform.
- Apps expose a real assignments collection, so an app assignment is a
single additive POST to
.../mobileApps/{id}/assignments. Nothing else on the app is touched. - Configuration profiles expose only a bulk
/assignaction that replaces the whole set, so each profile goes through a read-merge-write cycle: GET the current assignments, merge the new target in (de-duplicated), POST the merged set back to/assign. If the GET fails for a profile, the POST is not attempted for it. This is what prevents the classic accident of wiping every existing group off a profile. - Scope tags (
roleScopeTagIds) are a full array on the object, so they are also read-merge-write: GET the object, union the existing tag IDs with the selected ones, then PATCH the union back. Tags are only ever added.
- Windows, with Windows PowerShell 5.1 or PowerShell 7. The interface is WinForms, so it runs on Windows only.
- The
Microsoft.Graph.Authenticationmodule (2.x). That is the only Graph module needed. The script usesInvoke-MgGraphRequestagainst the existingConnect-MgGraphsession and does not depend on the typedMicrosoft.Graph.Beta.*sub-modules or the assembly version-skew crashes they can cause.
Install the module if you do not have it:
Install-Module Microsoft.Graph.Authentication -Scope CurrentUserThe wizard authenticates with Connect-MgGraph (delegated) and requests these
scopes:
| Scope | Used for |
|---|---|
DeviceManagementApps.ReadWrite.All |
Apps and app assignments |
DeviceManagementConfiguration.ReadWrite.All |
Profiles, assignments, and scope tag IDs |
DeviceManagementRBAC.Read.All |
Read the scope tag list |
Group.Read.All |
Search target groups |
On connect the tool also reads your effective Intune permissions and warns if your role does not cover the object types you chose. You still need an Intune role that can modify those objects; the Graph scopes alone do not grant it.
-
Download
Update-IntuneAssignment_GUI_Wizard.ps1. -
Run it from a Windows PowerShell or PowerShell 7 session:
.\Update-IntuneAssignment_GUI_Wizard.ps1 -
On the Connect tab, pick what to work with and what to change, then Authenticate. Leave Tenant ID and Client ID blank to use the built-in Microsoft Graph PowerShell app against your home tenant, or supply your own.
-
Work through the tabs and review on Summary. Preview Impact is read-only, so run it first if you want to confirm the current state before committing.
Both fields on the Connect tab are optional:
- Leave Client ID blank to use the built-in Microsoft Graph PowerShell app.
To use your own app registration, supply its Client ID; it must be a public
client with a redirect URI of
http://localhost. - Leave Tenant ID blank to sign in against the account's home tenant. Supply it when the account is a guest in more than one tenant.
Graph exposes no way to ask which objects target a given group, so removing a
group means reading every supported object's assignments to find the matches.
On a large tenant this is the longest unattended wait in the tool, and the
wizard tells you before it starts. Removing scope tags does not survey, because
roleScopeTagIds comes back on the object list itself.
Every session is written to Update-IntuneAssignment.log in the Windows logs
folder. Tab moves, the selected mode and change scope, the group and its
assignment settings, the scope tags and their direction, the object selection,
and the per-request results of each batched read are all recorded, so a run can
be reconstructed from the log alone.
This script is provided as is, without warranty of any kind. It writes to Intune assignments and scope tags. Test it against a small selection, and use Preview Impact, before running it broadly in production.
John Marcum (PJM), @PJ_Marcum