marco/Intune-Manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 11 Wiki Activity

Setup-Skript: DeviceManagementServiceConfig.Read.All bei -IncludeDeviceActions

Browse Source 
Der Autopilot-Status im Geräte-Detail (Profil-Zuweisung / letzter Kontakt)
braucht DeviceManagementServiceConfig.Read.All. Das Flag -IncludeDeviceActions
fügt den Scope jetzt hinzu (Read/Write und Read-Only). Ist ohnehin Offboarding
aktiv, wird die ReadWrite-Variante bevorzugt und die Read-Variante entfernt.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
marco
2026-09-16 11:41:10 +02:00
co-authored by Claude Opus 4.8
parent c10d0b3830
commit 87fd496ca0
1 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/Setup-AppRegistration.ps1
+14 -3
View File
@@ -33,7 +33,9 @@
.PARAMETER IncludeDeviceActions
Nimmt zusaetzlich die Berechtigungen fuer den Geraete-Tab auf
(Read + ReadWrite + PrivilegedOperations = Sync/Reboot/Lock/Wipe/Retire).
(Read + ReadWrite + PrivilegedOperations = Sync/Reboot/Lock/Wipe/Retire)
sowie DeviceManagementServiceConfig.Read.All fuer den Autopilot-Status
im Detail-Panel.
.PARAMETER GrantAdminConsent
Erteilt direkt tenantweiten Admin-Consent fuer die gesetzten Scopes.
@@ -78,12 +80,16 @@ $perms = if ($ReadOnly) {
'DeviceManagementApps.ReadWrite.All','DeviceManagementConfiguration.ReadWrite.All','offline_access')
}
if ($IncludeDeviceActions) {
# DeviceManagementServiceConfig.Read.All: Autopilot-Status im Geraete-Detail
# (Profil-Zuweisung / letzter Kontakt) — ansonsten bleibt das Feld leer.
$perms += if ($ReadOnly) {
@('DeviceManagementManagedDevices.Read.All')
@('DeviceManagementManagedDevices.Read.All',
'DeviceManagementServiceConfig.Read.All')
} else {
@('DeviceManagementManagedDevices.Read.All',
'DeviceManagementManagedDevices.ReadWrite.All',
'DeviceManagementManagedDevices.PrivilegedOperations.All')
'DeviceManagementManagedDevices.PrivilegedOperations.All',
'DeviceManagementServiceConfig.Read.All')
}
}
if ($IncludeOffboarding) {
@@ -99,6 +105,11 @@ if ($IncludeOffboarding) {
)
}
$perms = $perms | Select-Object -Unique
# ServiceConfig: ReadWrite (Offboarding) schliesst Read (Autopilot-Anzeige) ein
# -> die Read-Variante nicht zusaetzlich anfordern.
if ($perms -contains 'DeviceManagementServiceConfig.ReadWrite.All') {
$perms = @($perms | Where-Object { $_ -ne 'DeviceManagementServiceConfig.Read.All' })
}
# --- Verbinden ----------------------------------------------------------------
Write-Host "[1/6] Mit Microsoft Graph verbinden (Admin noetig)..." -ForegroundColor Cyan