时间戳

首页 > 解决方案 > Azure Active Directory: How to check device membership?

azure-active-directory - Azure Active Directory: How to check device membership?

问题描述

I'm trying to find a way to display all groups that an Intune device is a member of. I cannot find this function for the sake of my life. I don't see this fucntion under the Intune blade, nor the Azure Active Directory one. Is there any other way to see group memberships of a device?

PS: devices are managed via Intune and Azure AD only joined.

Tried to find the information via Microsoft and Powershell.

Get-AzureADDeviceMembership doesn't exist

I expect an output to display groups that an AAD device is a member of.

标签： azure-active-directoryintune

解决方案

我遇到了同样的问题，我很惊讶 Get-AzureADDeviceMembership cmdlet 不存在。

我将此用作解决方法：

Get-AzureADGroup -All 1 | ? {"COMPUTER_DISPLAY_NAME" -in (Get-AzureADGroupMember -ObjectId $_.ObjectId).DisplayName}

它可以工作，但速度非常慢。所以我还做了一个函数，将组及其成员缓存在一个全局变量中。此函数从第二次运行立即运行，因为所有内容都已缓存。功能：

function Get-AzureADDeviceMembership{
    [CmdletBinding()]
    Param(
        [string]$ComputerDisplayname,
        [switch]$UseCache
    )
    if(-not $Global:AzureAdGroupsWithMembers -or -not $UseCache){
        write-host "refreshing cache"
        $Global:AzureAdGroupsWithMembers = Get-AzureADGroup -All 1 | % {
            $members = Get-AzureADGroupMember -ObjectId $_.ObjectId
            $_ | Add-Member -MemberType NoteProperty -Name Members -Value $members
            $_
        }
    }
    $Global:AzureAdGroupsWithMembers | % {
        if($ComputerDisplayname -in ($_.Members | select -ExpandProperty DisplayName)){
            $_
        }
    } | select -Unique
}

使用功能：

Connect-AzureAD    
Get-AzureADDeviceMembership -ComputerDisplayname "COMPUTER_DISPLAY_NAME" -UseCache

推荐阅读