README out of sync: stale auto-update claim and Register-IntuneAssignmentCheckerApp.ps1 permissions/output drift post-v4.0 #124

Activity

1. ugurkocde

   self-assigned this

   on Apr 15, 2026
2. ugurkocde

   added

   bot:docs-sync

   on Apr 15, 2026
3. ugurkocde commented on Apr 16, 2026

   

   ugurkocde

   on Apr 16, 2026 – with Claude

   OwnerAuthor

   More actions

   Great write-up — all three items are confirmed. Here's a concrete fix plan with the exact changes needed.

   ---

   Fix 1: README auto-update bullet (line 106)

   Replace the stale claim with what the code actually does.

   README.md:106

   -- 🔄 Built-in auto-update functionality
   +- 🔄 Version check against PowerShell Gallery on connect

   The version-check logic lives in Module/IntuneAssignmentChecker/Public/Connect-IntuneAssignmentChecker.ps1:41-58 — it calls Find-Module against PSGallery and prints an Update-Module hint. No self-update path exists since v4.0.

   ---

   Fix 2: Align Register-IntuneAssignmentCheckerApp.ps1 permissions with Connect-IntuneAssignmentChecker.ps1

   The source of truth for required permissions is Connect-IntuneAssignmentChecker.ps1:68-78 (9 permissions). The registration script at lines 45-53 currently grants only 7, and includes one (DeviceManagementServiceConfig.Read.All) that isn't validated at connect time.

   Register-IntuneAssignmentCheckerApp.ps1:45-53 — replace the $permissions array with:

   $permissions = @(
       @{ id = "df021288-bdef-4463-88db-98f22de89214"; displayName = "User.Read.All" },
       @{ id = "5b567255-7703-4780-807c-7be8301ae99b"; displayName = "Group.Read.All" },
       @{ id = "7438b122-aefc-4978-80ed-43db9fcc7715"; displayName = "Device.Read.All" },
       @{ id = "7a6ee1e7-141e-4cec-ae74-d9db155731ff"; displayName = "DeviceManagementApps.Read.All" },
       @{ id = "dc377aa6-52d8-4e23-b271-2a7ae04cedf3"; displayName = "DeviceManagementConfiguration.Read.All" },
       @{ id = "2f51be20-0bb4-4fed-bf7b-db946066c75e"; displayName = "DeviceManagementManagedDevices.Read.All" },
       @{ id = "06a5fe6d-c49d-46a7-b082-56b1b14103c7"; displayName = "DeviceManagementServiceConfig.Read.All" },
       @{ id = "2a0ccd42-f355-4813-b1a0-b15e53f5b02b"; displayName = "DeviceManagementScripts.Read.All" },
       @{ id = "a9e09520-8ed4-4cde-838e-4fdea192c227"; displayName = "CloudPC.Read.All" },
       @{ id = "49f0cc30-024c-4c62-8aa5-1218d6904bc0"; displayName = "DeviceManagementRBAC.Read.All" }
   )

   This adds the 3 missing permissions (DeviceManagementScripts.Read.All, CloudPC.Read.All, DeviceManagementRBAC.Read.All) and keeps DeviceManagementServiceConfig.Read.All since it's already present and may be useful. The permission GUIDs above are the well-known Microsoft Graph application permission IDs — verify against your tenant if needed.

   ---

   Fix 3: Update the v3-era "next steps" output (lines 125-128)

   Register-IntuneAssignmentCheckerApp.ps1:125-128 — replace with:

   Write-Host "`n----------------------------" -ForegroundColor Cyan
   Write-Host "You can now connect using:" -ForegroundColor Cyan
   Write-Host "Connect-IntuneAssignmentChecker -AppId `"$appId`" -TenantId `"$tenantId`" -CertificateThumbprint `"$certificateThumbprint`"" -ForegroundColor Yellow
   Write-Host "IntuneAssignmentChecker   # launches the interactive menu" -ForegroundColor Yellow
   Write-Host "----------------------------"

   This matches the module entry point used everywhere else in the README (lines 197-205, 308-309).

   ---

   Generated by Claude Code
4. ugurkocde commented on Apr 29, 2026

   

   ugurkocde

   on Apr 29, 2026 – with Claude

   OwnerAuthor

   More actions

   New drift from v4.2 (commit 1224bb6). Five items, all distinct from the three reported above.

   4. Missing Get-IntuneUserDeviceAssignment from cmdlet reference table

   The new cmdlet is exported in IntuneAssignmentChecker.psd1:16 and wired to menu option 16 in Invoke-IntuneAssignmentChecker.ps1:268-275, but the README cmdlet table (README.md:320-340) does not list it.

   Add a row:

   | `Get-IntuneUserDeviceAssignment` | Show all effective policies for a user on a specific device (What-If) |
   

   5. Missing menu option 16 from interactive menu documentation

   Show-Menu.ps1:43 displays option 16 ("What-If: All Policies for a User on a Specific Device"), but the README's interactive menu section ends at option 15 (README.md:451-455). A new subsection is needed under "Advanced Options":

   16. **What-If: User on Device**
       - Preview all policies and apps that would apply to a specific user on a specific device
       - Shows whether each assignment comes from the user side, device side, or both
       - Useful for validating Autopilot scenarios without reprovisioning
   

   6. Missing -AccessToken parameter from Connect parameter table

   Connect-IntuneAssignmentChecker.ps1:16-17 added a new [SecureString]$AccessToken parameter in v4.2. The README's "Common parameters on Connect-IntuneAssignmentChecker" table (README.md:350-359) does not include it.

   Add a row:

   | `-AccessToken`           | Pre-fetched Microsoft Graph access token (SecureString)    |
   

   7. Missing bearer-token authentication option from Authentication Options section

   The README documents three auth options (README.md:128-245): Certificate, Client Secret, and Interactive. v4.2 added a fourth path -- pre-fetched access token via -AccessToken [SecureString] -- for managed identities, federated credentials, and parent-script token reuse. This should be documented as a new option, for example:

   ### Option 4: Pre-fetched Access Token (Managed Identity, Azure Functions, etc.)
   
   If you already have a Microsoft Graph access token (e.g. from a managed identity
   or a parent script that called `Connect-MgGraph`), pass it directly:
   
       $token = (Get-AzAccessToken -ResourceUrl "https://graph.microsoft.com").Token |
                ConvertTo-SecureString -AsPlainText -Force
       Connect-IntuneAssignmentChecker -AccessToken $token
   

   8. Stale descriptions for options 12 and 13

   v4.2 extended Test-IntuneGroupMembership and Test-IntuneGroupRemoval to accept a device in addition to a user (Test-IntuneGroupMembership.ps1:7-8, Test-IntuneGroupRemoval.ps1:7-8). The README descriptions still say "user" only:

   • README.md:435-438 -- Option 12: "Preview what policies and apps a user would receive if added to a group" should mention "user and/or device".
   • README.md:440-443 -- Option 13: "Preview what policies and apps a user would lose if removed from a group" should mention "user and/or device".
   • README.md:307-308 -- Cmdlet examples for Test-IntuneGroupMembership and Test-IntuneGroupRemoval only show -UserPrincipalNames. Add a -DeviceNames example.
   • README.md:335-336 -- Cmdlet table descriptions: "Simulate adding a user to a group" and "Simulate removing a user from a group" should say "user and/or device".

   ---

   Generated by Claude Code
5. ugurkocde

   added a commit that references this issue on Jul 3, 2026

   v4.3: Excluded apps in group checks, shared category-scan engine, doc…

   ...

   b787805
6. ugurkocde commented on Jul 3, 2026

   

   ugurkocde

   on Jul 3, 2026

   OwnerAuthor

   More actions

   All items fixed in v4.3.0 (PR #127):

   • The auto-update feature bullet now describes the actual behavior: a PSGallery version check on connect with an Update-Module hint.
   • Register-IntuneAssignmentCheckerApp.ps1 grants the full permission set validated by Connect-IntuneAssignmentChecker, so app registrations created by the script no longer trip the missing-permissions warning. The permission GUIDs were verified against the Microsoft Graph service principal appRoles; note that two GUIDs suggested earlier in this thread (DeviceManagementScripts.Read.All and DeviceManagementRBAC.Read.All) were incorrect and the verified values are used instead.
   • The script's next-steps output now shows the module workflow (Connect-IntuneAssignmentChecker plus the IntuneAssignmentChecker menu alias) instead of the removed v3 script.
   • The v4.2 drift items are covered as well: -AccessToken is in the parameter table with a dedicated auth option section, options 12 and 13 say user and/or device with -DeviceNames examples, and the cmdlet table matches.
   • The script also uses a cross-platform temp path now and removes its temporary client secret if the certificate upload fails.
7. ugurkocde

   closed this as completedon Jul 3, 2026