Get App Assignment Conflicts

<#
.TITLE
    Get App Assignment Conflicts

.SYNOPSIS
    Detects conflicting Intune app assignments: required versus uninstall, and groups that are both included and excluded.

.DESCRIPTION
    This script analyzes every Intune app's assignments and reports conflicts that
    produce unpredictable install behavior: the same app targeted with required and
    uninstall intent, the same group both included and excluded on one app, and the
    same group receiving the app with different intents. Group names are resolved so
    the report is directly actionable. These conflicts commonly appear after mergers
    of app deployments or copy-pasted assignment changes and are hard to spot in the
    portal.

.TAGS
    Apps,Reporting

.MINROLE
    Intune Administrator

.PERMISSIONS
    DeviceManagementApps.Read.All,Group.Read.All

.AUTHOR
    Ugur Koc

.VERSION
    1.2

.CHANGELOG
    1.2 - Added Azure Automation contract validation, portal-safe boolean parameters, beta Graph endpoints, and terminating paging errors
    1.1 - Azure Automation now records script progress, outcomes, and summaries in job history
    1.0 - Initial release

.LASTUPDATE
    2026-07-30

.EXAMPLE
    .\get-app-assignment-conflicts.ps1
    Reports all app assignment conflicts in the console

.EXAMPLE
    .\get-app-assignment-conflicts.ps1 -ExportToCsv "true"
    Exports the conflict report to a timestamped CSV file

.NOTES
    - Requires Microsoft.Graph.Authentication module
    - Required + available for the same group is reported as informational, not a conflict (required wins by design)
    - Nested group membership is not evaluated; only direct assignment targets are compared
    - Uses beta Graph endpoints for the app assignment surface
    - Local interactive sign-in uses the MgGraphCommunity module to avoid the Graph SDK's mandatory WAM broker on Windows
#>

[CmdletBinding()]
param(
    [Parameter(Mandatory = $false, HelpMessage = "Export results to CSV")]
    [ValidateSet("true", "false", "1", "0", '$true', '$false')]
    [string]$ExportToCsv,

    [Parameter(Mandatory = $false, HelpMessage = "Output path for exports")]
    [string]$OutputPath = ".",

    [Parameter(Mandatory = $false, HelpMessage = "Force module installation without prompting")]
    [ValidateSet("true", "false", "1", "0", '$true', '$false')]
    [string]$ForceModuleInstall
)

# Normalize the local module-install override for Azure Automation parameter binding.
$forceModuleInstallRaw = [string]$ForceModuleInstall
Remove-Variable -Name ForceModuleInstall
if ([string]::IsNullOrWhiteSpace($forceModuleInstallRaw)) {
    $ForceModuleInstall = $false
}
elseif ($forceModuleInstallRaw.Trim().ToLowerInvariant() -in @("true", "1", '$true')) {
    $ForceModuleInstall = $true
}
elseif ($forceModuleInstallRaw.Trim().ToLowerInvariant() -in @("false", "0", '$false')) {
    $ForceModuleInstall = $false
}
else {
    throw "Parameter 'ForceModuleInstall' accepts only true, false, 1, 0, $true, or $false."
}

# Azure Automation supplies portal parameter values as strings. Normalize the
# public boolean parameters once so local and runbook execution use real booleans.
foreach ($runbookBooleanParameter in @('ExportToCsv')) {
    $runbookBooleanRaw = [string](Get-Variable -Name $runbookBooleanParameter -ValueOnly)
    Remove-Variable -Name $runbookBooleanParameter

    if ([string]::IsNullOrWhiteSpace($runbookBooleanRaw)) {
        Set-Variable -Name $runbookBooleanParameter -Value $false
        continue
    }

    switch ($runbookBooleanRaw.Trim().ToLowerInvariant()) {
        { $_ -in @("true", "1", '$true') } {
            Set-Variable -Name $runbookBooleanParameter -Value $true
        }
        { $_ -in @("false", "0", '$false') } {
            Set-Variable -Name $runbookBooleanParameter -Value $false
        }
        default {
            throw "Parameter '$runbookBooleanParameter' accepts only true, false, 1, 0, $true, or $false."
        }
    }
}

# ============================================================================
# ENVIRONMENT DETECTION AND SETUP
# ============================================================================

function Initialize-RequiredModule {
    param(
        [string[]]$ModuleNames,
        [bool]$IsAutomationEnvironment,
        [bool]$ForceInstall = $false
    )

    foreach ($ModuleName in $ModuleNames) {
        Write-Verbose "Checking module: $ModuleName"

        $module = Get-Module -ListAvailable -Name $ModuleName | Select-Object -First 1

        if (-not $module) {
            if ($IsAutomationEnvironment) {
                throw "Module '$ModuleName' is not available in Azure Automation"
            }
            else {
                Write-Information "Module '$ModuleName' not found. Installing..." -InformationAction Continue

                if (-not $ForceInstall) {
                    $response = Read-Host "Install module '$ModuleName'? (Y/N)"
                    if ($response -notmatch '^[Yy]') {
                        throw "Module '$ModuleName' is required but installation was declined."
                    }
                }

                try {
                    $isAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")
                    $scope = if ($isAdmin) { "AllUsers" } else { "CurrentUser" }

                    Install-Module -Name $ModuleName -Scope $scope -Force -AllowClobber -Repository PSGallery
                    Write-Information "✓ Successfully installed '$ModuleName'" -InformationAction Continue
                }
                catch {
                    throw "Failed to install module '$ModuleName': $($_.Exception.Message)"
                }
            }
        }

        Import-Module -Name $ModuleName -Force -ErrorAction Stop
    }
}

# Detect execution environment
$IsAzureAutomation = $null -ne $PSPrivateMetadata.JobId.Guid

# Initialize required modules
$RequiredModules = @("Microsoft.Graph.Authentication")

# MgGraphCommunity gives WAM-free interactive sign-in for local runs
if (-not $IsAzureAutomation) {
    $RequiredModules += "MgGraphCommunity"
}

try {
    Initialize-RequiredModule -ModuleNames $RequiredModules -IsAutomationEnvironment $IsAzureAutomation -ForceInstall $ForceModuleInstall
    Write-Verbose "✓ All required modules are available"
}
catch {
    Write-Error "Module initialization failed: $_"
    exit 1
}

# ============================================================================
# AUTHENTICATION
# ============================================================================

try {
    if ($IsAzureAutomation) {
        Write-Output "Connecting to Microsoft Graph using Managed Identity..."
        Connect-MgGraph -Identity -NoWelcome -ErrorAction Stop
    }
    else {
        Write-Output "Connecting to Microsoft Graph..."
        $Scopes = @(
            "DeviceManagementApps.Read.All",
            "Group.Read.All"
        )
        Connect-MgGraphCommunity -Scopes $Scopes -NoWelcome -ErrorAction Stop
    }
    Write-Output "✓ Successfully connected to Microsoft Graph"
}
catch {
    Write-Error "Failed to connect to Microsoft Graph: $($_.Exception.Message)"
    exit 1
}

# ============================================================================
# HELPER FUNCTIONS
# ============================================================================

function Get-MgGraphAllPage {
    param(
        [string]$Uri,
        [int]$DelayMs = 100
    )

    $allResults = @()
    $nextLink = $Uri

    do {
        try {
            if ($allResults.Count -gt 0) {
                Start-Sleep -Milliseconds $DelayMs
            }

            $response = Invoke-MgGraphRequest -Uri $nextLink -Method GET

            if ($null -ne $response.value) {
                $allResults += $response.value
            }
            else {
                $allResults += $response
            }

            $nextLink = $response.'@odata.nextLink'
        }
        catch {
            if ($_.Exception.Message -like "*429*") {
                Write-Information "Rate limit hit, waiting 60 seconds..." -InformationAction Continue
                Start-Sleep -Seconds 60
                continue
            }
            throw "Error fetching data: $($_.Exception.Message)"
        }
    } while ($nextLink)

    return $allResults
}

$script:GroupNameCache = @{}

function Resolve-GroupName {
    param([string]$GroupId)

    if (-not $GroupId) { return "" }
    if ($script:GroupNameCache.ContainsKey($GroupId)) { return $script:GroupNameCache[$GroupId] }

    $name = $GroupId
    try {
        $group = Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/beta/groups/${GroupId}?`$select=displayName" -Method GET
        if ($group.displayName) { $name = $group.displayName }
    }
    catch {
        Write-Verbose "Could not resolve group ${GroupId}: $($_.Exception.Message)"
    }

    $script:GroupNameCache[$GroupId] = $name
    return $name
}

function Get-TargetKey {
    param([object]$Target)

    # Normalize every assignment target to a comparable key
    switch -Wildcard ([string]$Target.'@odata.type') {
        "*allDevicesAssignmentTarget" { return "AllDevices" }
        "*allLicensedUsersAssignmentTarget" { return "AllUsers" }
        default { return [string]$Target.groupId }
    }
}

# ============================================================================
# MAIN SCRIPT LOGIC
# ============================================================================

try {
    Write-Output "Retrieving apps with assignments..."
    $apps = Get-MgGraphAllPage -Uri "https://graph.microsoft.com/beta/deviceAppManagement/mobileApps?`$expand=assignments"

    $assignedApps = @($apps | Where-Object { @($_.assignments).Count -gt 0 })
    Write-Output "✓ Found $($assignedApps.Count) apps with assignments (of $(@($apps).Count) total)"

    [System.Collections.Generic.List[Object]]$conflicts = @()

    foreach ($app in $assignedApps) {
        $assignments = @($app.assignments)

        # Build per-target views of intent and include/exclude
        $includedTargets = @{}
        $excludedTargets = @{}
        $intents = [System.Collections.Generic.HashSet[string]]::new()

        foreach ($assignment in $assignments) {
            $target = $assignment.target
            $targetKey = Get-TargetKey -Target $target
            if (-not $targetKey) { continue }

            $intent = [string]$assignment.intent
            $null = $intents.Add($intent)

            if ([string]$target.'@odata.type' -like "*exclusionGroupAssignmentTarget") {
                $excludedTargets[$targetKey] = $intent
            }
            else {
                if (-not $includedTargets.ContainsKey($targetKey)) {
                    $includedTargets[$targetKey] = [System.Collections.Generic.List[string]]::new()
                }
                $includedTargets[$targetKey].Add($intent)
            }
        }

        $appType = ([string]$app.'@odata.type') -replace "#microsoft.graph.", ""

        # Conflict 1: required and uninstall on the same app
        if ($intents.Contains("required") -and $intents.Contains("uninstall")) {
            $conflicts.Add([PSCustomObject]@{
                    AppName      = $app.displayName
                    AppType      = $appType
                    ConflictType = "RequiredAndUninstall"
                    Details      = "App is deployed with intent 'required' and 'uninstall' at the same time - install outcome depends on target overlap"
                    Group        = ""
                    AppId        = $app.id
                })
        }

        # Conflict 2: same group both included and excluded
        foreach ($targetKey in $includedTargets.Keys) {
            if ($excludedTargets.ContainsKey($targetKey)) {
                $groupName = Resolve-GroupName -GroupId $targetKey
                $conflicts.Add([PSCustomObject]@{
                        AppName      = $app.displayName
                        AppType      = $appType
                        ConflictType = "IncludedAndExcluded"
                        Details      = "Group is both an include target ($($includedTargets[$targetKey] -join ', ')) and an exclude target"
                        Group        = $groupName
                        AppId        = $app.id
                    })
            }
        }

        # Conflict 3: same group targeted with multiple different intents
        foreach ($targetKey in $includedTargets.Keys) {
            $groupIntents = @($includedTargets[$targetKey] | Select-Object -Unique)
            if ($groupIntents.Count -gt 1) {
                $groupName = Resolve-GroupName -GroupId $targetKey
                $severity = if ($groupIntents -contains "uninstall") { "MixedIntentWithUninstall" } else { "MixedIntent" }
                $conflicts.Add([PSCustomObject]@{
                        AppName      = $app.displayName
                        AppType      = $appType
                        ConflictType = $severity
                        Details      = "Same target has intents: $($groupIntents -join ', ')"
                        Group        = $groupName
                        AppId        = $app.id
                    })
            }
        }
    }

    # ----- Display results -----
    Write-Output "`nAPP ASSIGNMENT CONFLICT REPORT"
    Write-Output ("=" * 50)
    Write-Output "Generated: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
    Write-Output ("=" * 50)

    if ($conflicts.Count -eq 0) {
        Write-Output "`nNo assignment conflicts found."
    }
    else {
        foreach ($conflictGroup in ($conflicts | Group-Object -Property ConflictType | Sort-Object Name)) {
            Write-Output "`n[$($conflictGroup.Name)] $($conflictGroup.Count) finding(s)"
            foreach ($row in ($conflictGroup.Group | Sort-Object AppName)) {
                $line = "  $($row.AppName)"
                if ($row.Group) { $line += " | group: $($row.Group)" }
                Write-Output $line
                Write-Output "    $($row.Details)"
            }
        }
    }

    # Summary
    Write-Output "`n"
    Write-Output ("=" * 50)
    Write-Output "Summary: $($assignedApps.Count) assigned apps analyzed, $($conflicts.Count) conflicts found"
    Write-Output ("=" * 50)

    # Export to CSV if requested
    if ($ExportToCsv) {
        $timestamp = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"
        $csvPath = Join-Path $OutputPath "App_Assignment_Conflicts_$timestamp.csv"
        $conflicts | Export-Csv -Path $csvPath -NoTypeInformation -Encoding UTF8
        Write-Output "✓ CSV report saved: $csvPath"
    }
}
catch {
    Write-Error "Script execution failed: $($_.Exception.Message)"
    exit 1
}
finally {
    try {
        $null = Disconnect-MgGraph
        Write-Output "✓ Disconnected from Microsoft Graph"
    }
    catch {
        Write-Verbose "Graph disconnection completed"
    }
}