Discovering group assignments in Intune using PowerShell

Intro

It's been a while!

My personal life has been quite busy with house decorating and kittens to be able to blog properly but I figured with some spare time I would bless the internet with my own personal take on an Intune Assignment Checker.

Kitten helping me write this:

Some colleagues of mine were having issues locating which groups pointed to specific inclusions and exclusions on a number of policies.

The script

Currently just a v1 of the script, I've included the ability for User Auth and Application Auth using Client Secret however Certificate can be easily added later.

It requires the following Graph Permissions:

- DeviceManagementConfiguration.Read.All
- DeviceManagementScripts.Read.All
- DeviceManagementApps.Read.All #This will be needed later when App assignments are added :)
- Groups.Read.All

The PowerShell Script itself can be seen below, please feel free to recommend any features or additions :)

There are areas that can be hardcoded such as your Client ID or Tenant ID.

$LogPath = "/Users/connor/Documents" # Feel free to hard code this :)
if(-not(Test-Path -Path $LogPath)){
    Write-Host("$LogPath does not exist. Do you want the path to be created or do you want to specify a different path?") -ForegroundColor Yellow
    $PathChoice = Read-Host("(Y for Creation/N for Different Path)")
    if($PathChoice.ToLower() -eq 'y'){
        try {
            New-Item -Path $LogPath -ItemType Directory -Force -Confirm:$false
            Write-Host("$LogPath has been created, logging can commence")
        }
        catch {
            Write-Host("Failed to create $LogPath") -ForegroundColor Red
        }
    }elseif($PathChoice.ToLower() -eq 'n'){
        $LogPath = Read-Host("Please provide a new path: ")
    }else{
        Write-Host("Incorrect option chosen, please restart the script.") -ForegroundColor Red
        Exit 1
    }
}
# Function for logging
function Write-Log {
    param(
        [string]$Message,
        [string]$Level = "INFO"
    )
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $logdate = Get-Date -Format "yyyy_MM_dd"
    $entry = "[$Timestamp][$Level] $Message"

    Add-Content -Path "$LogPath\$logdate`_intunegroupchecker.log" -Value $entry
    write-host($entry)
}

# Start by connecting to Microsoft.Graph
function Start-GraphModules{
    # Verify Module Installation
    $ModulesInstalled = Get-InstalledModule | Select-Object Name

    if($ModulesInstalled.Name -like "*Authentication*"){

        if($ModulesInstalled.Name -like "*DeviceManagement*"){
            Write-Host("Modules installed successfully.") -ForegroundColor Green
        }
        
        else{
            Write-Host("DeviceManagement Module is missing.") -ForegroundColor Magenta
            # Install missing modules
            try {
                Install-Module -Name Microsoft.Graph.DeviceManagement -Force -Confirm:$false
                Write-Host("Module Installed") -ForegroundColor Green
            }
            catch {
                Write-Host("Failed to install DeviceManagement Module: $($_.ErrorDetails.Message)") -ForegroundColor Red
                return 1
            }
        }
    }
    
    else{
        Write-Host("Authentication Module is missing.") -ForegroundColor Magenta
        # Install missing modules
        try {
            Install-Module -Name Microsoft.Graph.Authentication -Force -Confirm:$false
            Write-Host("Module Installed") -ForegroundColor Green
        }
        catch {
            Write-Host("Failed to install Authentication Module: $($_.ErrorDetails.Message)") -ForegroundColor Red
            return 1
        }

        if($ModulesInstalled.Name -like "*DeviceManagement*"){
            Write-Host("Modules installed successfully.") -ForegroundColor Green
        }else{
            Write-Host("DeviceManagement Module is missing.") -ForegroundColor Magenta
            # Install missing modules
            try {
                Install-Module -Name Microsoft.Graph.DeviceManagement -Force -Confirm:$false
                Write-Host("Module Installed") -ForegroundColor Green
            }
            catch {
                Write-Host("Failed to install DeviceManagement Module: $($_.ErrorDetails.Message)") -ForegroundColor Red
                return 1
            }
        }
    }
    # Verify modules have been imported
    Write-Host("Module installation verified, importing if necessary.") -ForegroundColor Yellow

    $ModulesLoaded = Get-Module | Select-Object Name

        if($ModulesLoaded.Name -like "*Authentication*"){
            if($ModulesLoaded.Name -like "*DeviceManagement*"){
                Write-Host("Modules installed successfully.") -ForegroundColor Green
            }
            else{
                Write-Host("DeviceManagement Module is missing.") -ForegroundColor Magenta
                try {
                    Import-Module -Name Microsoft.Graph.DeviceManagement -Force
                    Write-Host("Module Installed") -ForegroundColor Green
                }
                catch {
                    Write-Host("Failed to install DeviceManagement Module: $($_.ErrorDetails.Message)") -ForegroundColor Red
                    return 1
                }
        }
    }
    
    else{
        Write-Host("Authentication Module is missing.") -ForegroundColor Magenta

        try {
            Import-Module -Name Microsoft.Graph.Authentication -Force
            Write-Host("Module Installed") -ForegroundColor Green
        }
        catch {
            Write-Host("Failed to install Authentication Module: $($_.ErrorDetails.Message)") -ForegroundColor Red
            return 1
        }

        if($ModulesLoaded.Name -like "*DeviceManagement*"){
            Write-Host("Modules installed successfully.") -ForegroundColor Green
        }else{
            Write-Host("DeviceManagement Module is missing.") -ForegroundColor Magenta

            try {
                Import-Module -Name Microsoft.Graph.DeviceManagement -Force
                Write-Host("Module Installed") -ForegroundColor Green
            }
            catch {
                Write-Host("Failed to install DeviceManagement Module: $($_.ErrorDetails.Message)") -ForegroundColor Red
                return 1
            }
        }
    }
}

# Graph Pagination function to help with '@odata.nextLink'
function Invoke-GraphPagedRequest {
    param(
        [string]$Uri
    )

    $Results = @()

    do {
        $Response = Invoke-MgGraphRequest -Uri $Uri

        $Results += $Response.value

        $Uri = $Response.'@odata.nextLink'

    } while ($Uri)

    return $Results
}

# Main function for Script. Collects the necessary results and then exports to CSV at a path and name of user's specification.a
function Start-GroupChecker{
    param(
        [string]$GroupID
    )
    $GroupName = (Get-MgGroup -GroupId $GroupID).DisplayName
    $Results = @()
    $Results += Get-DeviceConfigPolicies -GroupID $GroupID
    $Results += Get-DeviceCompliancePolicies -GroupID $GroupID
    $Results += Get-SettingsCatalogs -GroupID $GroupID
    $Results += Get-GroupPolicyConfig -GroupID $GroupID
    $Results += Get-EndpointSecurityPolicies -GroupID $GroupID
    $Results += Get-RemediationScripts -GroupID $GroupID
    $Results += Get-PlatformScripts -GroupID $GroupID
    $Results += Get-AutopilotDeploymentPolicies -GroupID $GroupID
    $Results += Get-ESP -GroupID $GroupID
    $Results = $Results | Sort-Object PolicyType, PolicyId, AssignmentType, GroupId, AssignmentId -Unique
    # Export details
    $ExportPath = Read-Host("Please specify a path for your export (end with a \): ")
    if(-not($ExportPath -match '\\$')){
        $ExportPath = Join-Path -Path $ExportPath -ChildPath "\"
    }
    
    $ExportName = Read-Host("Please specify a name for your CSV export: (end with a .csv)")
    if($ExportName -notlike "*.csv"){
        $ExportName = "$ExportName.csv"
    }
    
    $ExportPath = Join-Path -Path $ExportPath -ChildPath $ExportName
    # Try exporting to the path.
    try {
        $Results | Export-Csv -Path $ExportPath -NoClobber -NoTypeInformation
        Write-Log("Exported the results for the group {$GroupName} -> $ExportPath")
    }
    catch {
        Write-Log("Failed to export CSV file for {$GroupName} Error -> $($_.ErrorDetails)")
    }
    
}

# Functions to retrieve assignments
## Get Device Configuration Policies

function Get-DeviceConfigPolicies{
    param(
        [string]$GroupID
    )
    Write-Log("Starting Config policy comparison")
    $ConfigMatches = @()

    $ConfigResponse = Invoke-GraphPagedRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations"

    foreach($Policy in $ConfigResponse){
        $Assignments = Invoke-GraphPagedRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations/$($Policy.id)/assignments"

        foreach($Assignment in $Assignments){
            
            switch ($Assignment.Target.'@odata.type') {
                '#microsoft.graph.groupAssignmentTarget'{
                    if($Assignment.Target.groupId -ne $GroupID){
                        continue
                    }
                    $Type = 'Include'

                    $Match = [PSCustomObject]@{
                        PolicyName = $Policy.displayName
                        PolicyId = $Policy.Id
                        PolicyType = 'Device Configuration'
                        AssignmentType = $Type
                        GroupId = $Assignment.Target.GroupId
                        AssignmentId = $Assignment.Id
                    }

                    $ConfigMatches += $Match
                }
                '#microsoft.graph.exclusionGroupAssignmentTarget'{
                    if($Assignment.Target.groupId -ne $GroupID){
                        continue
                    }
                    $Type = 'Exclude'

                    $Match = [PSCustomObject]@{
                        PolicyName = $Policy.displayName
                        PolicyId = $Policy.Id
                        PolicyType = 'Device Configuration'
                        AssignmentType = $Type
                        GroupId = $Assignment.Target.GroupId
                        AssignmentId = $Assignment.Id
                    }

                    $ConfigMatches += $Match
                }
            }

        }
    }
    Write-Log("There are {$($ConfigMatches.count)} matches.")
    return $ConfigMatches
}

# Get Device Compliance Policies

function Get-DeviceCompliancePolicies{
    param(
        [string]$GroupID
    )
    Write-log("Starting compliance policy comparison.")
    $ComplianceMatches = @()

    $ComplianceResponse = Invoke-GraphPagedRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies"

        foreach($Policy in $ComplianceResponse){

        $Assignments = Invoke-GraphPagedRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies/$($Policy.Id)/assignments"

        foreach($Assignment in $Assignments){
            
            switch ($Assignment.Target.'@odata.type') {
                '#microsoft.graph.groupAssignmentTarget'{
                    if($Assignment.Target.groupId -ne $GroupID){
                        continue
                    }
                    $Type = 'Include'

                    $Match = [PSCustomObject]@{
                        PolicyName = $Policy.displayName
                        PolicyId = $Policy.Id
                        PolicyType = 'Device Compliance'
                        AssignmentType = $Type
                        GroupId = $Assignment.Target.GroupId
                        AssignmentId = $Assignment.Id
                    }

                    $ComplianceMatches += $Match
                }
                '#microsoft.graph.exclusionGroupAssignmentTarget'{
                    if($Assignment.Target.groupId -ne $GroupID){
                        continue
                    }
                    $Type = 'Exclude'

                    $Match = [PSCustomObject]@{
                        PolicyName = $Policy.displayName
                        PolicyId = $Policy.Id
                        PolicyType = 'Device Compliance'
                        AssignmentType = $Type
                        GroupId = $Assignment.Target.GroupId
                        AssignmentId = $Assignment.Id
                    }

                    $ComplianceMatches += $Match
                }
            }

        }
    }
    Write-Log("There are {$($ComplianceMatches.count)} matches.")

    return $ComplianceMatches
}

# Get Settings Catalogs

function Get-SettingsCatalogs{
    param(
        [string]$GroupID
    )
    Write-Log("Starting Settings Catalog policy comparison")
    $CatalogMatches = @()

    $CatalogResponse = Invoke-GraphPagedRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies"

    foreach($Policy in $CatalogResponse){
        $Assignments = Invoke-GraphPagedRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies/$($Policy.id)/assignments"

        foreach($Assignment in $Assignments){
            
            switch ($Assignment.Target.'@odata.type') {
                '#microsoft.graph.groupAssignmentTarget'{
                    if($Assignment.Target.groupId -ne $GroupID){
                        continue
                    }
                    $Type = 'Include'

                    $Match = [PSCustomObject]@{
                        PolicyName = $Policy.name
                        PolicyId = $Policy.Id
                        PolicyType = 'Settings Catalog'
                        AssignmentType = $Type
                        GroupId = $Assignment.Target.GroupId
                        AssignmentId = $Assignment.Id
                    }

                    $CatalogMatches += $Match
                }
                '#microsoft.graph.exclusionGroupAssignmentTarget'{
                    if($Assignment.Target.groupId -ne $GroupID){
                        continue
                    }
                    $Type = 'Exclude'

                    $Match = [PSCustomObject]@{
                        PolicyName = $Policy.name
                        PolicyId = $Policy.Id
                        PolicyType = 'Settings Catalog'
                        AssignmentType = $Type
                        GroupId = $Assignment.Target.GroupId
                        AssignmentId = $Assignment.Id
                    }

                    $CatalogMatches += $Match
                }
            }

        }
    }
    Write-Log("There are {$($CatalogMatches.count)} matches.")
    return $CatalogMatches
}

# Get Group Policy Matches 

function Get-GroupPolicyConfig{
    param(
        [string]$GroupID
    )
    Write-Log("Starting Group policy comparison")
    $GPMatches = @()

    $GPResponse = Invoke-GraphPagedRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations"

    foreach($Policy in $GPResponse){
        $Assignments = Invoke-GraphPagedRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/$($Policy.id)/assignments"

        foreach($Assignment in $Assignments){
            
            switch ($Assignment.Target.'@odata.type') {
                '#microsoft.graph.groupAssignmentTarget'{
                    if($Assignment.Target.groupId -ne $GroupID){
                        continue
                    }
                    $Type = 'Include'

                    $Match = [PSCustomObject]@{
                        PolicyName = $Policy.displayName
                        PolicyId = $Policy.Id
                        PolicyType = 'Group Policy'
                        AssignmentType = $Type
                        GroupId = $Assignment.Target.GroupId
                        AssignmentId = $Assignment.Id
                    }

                    $GPMatches += $Match
                }
                '#microsoft.graph.exclusionGroupAssignmentTarget'{
                    if($Assignment.Target.groupId -ne $GroupID){
                        continue
                    }
                    $Type = 'Exclude'

                    $Match = [PSCustomObject]@{
                        PolicyName = $Policy.displayName
                        PolicyId = $Policy.Id
                        PolicyType = 'Group Policy'
                        AssignmentType = $Type
                        GroupId = $Assignment.Target.GroupId
                        AssignmentId = $Assignment.Id
                    }

                    $GPMatches += $Match
                }
            }

        }
    }
    Write-Log("There are {$($GPMatches.count)} matches.")
    return $GPMatches
}

# Get Endpoint Security Policies

function Get-EndpointSecurityPolicies{
    param(
        [string]$GroupID
    )
    Write-Log("Starting Endpoint Security policy comparison")
    $EndpointMatches  = @()

    $EndpointResponse = Invoke-GraphPagedRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/intents"

    foreach($Policy in $EndpointResponse){
        $Assignments = Invoke-GraphPagedRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/intents/$($Policy.id)/assignments"

        foreach($Assignment in $Assignments){
            
            switch ($Assignment.Target.'@odata.type') {
                '#microsoft.graph.groupAssignmentTarget'{
                    if($Assignment.Target.groupId -ne $GroupID){
                        continue
                    }
                    $Type = 'Include'

                    $Match = [PSCustomObject]@{
                        PolicyName = $Policy.displayName
                        PolicyId = $Policy.Id
                        PolicyType = 'Endpoint Security'
                        AssignmentType = $Type
                        GroupId = $Assignment.Target.GroupId
                        AssignmentId = $Assignment.Id
                    }

                    $EndpointMatches += $Match
                }
                '#microsoft.graph.exclusionGroupAssignmentTarget'{
                    if($Assignment.Target.groupId -ne $GroupID){
                        continue
                    }
                    $Type = 'Exclude'

                    $Match = [PSCustomObject]@{
                        PolicyName = $Policy.displayName
                        PolicyId = $Policy.Id
                        PolicyType = 'Endpoint Security'
                        AssignmentType = $Type
                        GroupId = $Assignment.Target.GroupId
                        AssignmentId = $Assignment.Id
                    }

                    $EndpointMatches += $Match
                }
            }

        }
    }
    Write-Log("There are {$($EndpointMatches.count)} matches.")
    return $EndpointMatches
}

# Get Remediation Scripts

function Get-RemediationScripts{
    param(
        [string]$GroupID
    )
    Write-Log("Starting Remediation Script comparison")
    $RemediationMatches  = @()

    $RemediationResponse = Invoke-GraphPagedRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/intents"

    foreach($Policy in $RemediationResponse){
        $Assignments = Invoke-GraphPagedRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/intents/$($Policy.id)/assignments"

        foreach($Assignment in $Assignments){
            
            switch ($Assignment.Target.'@odata.type') {
                '#microsoft.graph.groupAssignmentTarget'{
                    if($Assignment.Target.groupId -ne $GroupID){
                        continue
                    }
                    $Type = 'Include'

                    $Match = [PSCustomObject]@{
                        PolicyName = $Policy.displayName
                        PolicyId = $Policy.Id
                        PolicyType = 'Remediation Script'
                        AssignmentType = $Type
                        GroupId = $Assignment.Target.GroupId
                        AssignmentId = $Assignment.Id
                    }

                    $RemediationMatches += $Match
                }
                '#microsoft.graph.exclusionGroupAssignmentTarget'{
                    if($Assignment.Target.groupId -ne $GroupID){
                        continue
                    }
                    $Type = 'Exclude'

                    $Match = [PSCustomObject]@{
                        PolicyName = $Policy.displayName
                        PolicyId = $Policy.Id
                        PolicyType = 'Remediation Script'
                        AssignmentType = $Type
                        GroupId = $Assignment.Target.GroupId
                        AssignmentId = $Assignment.Id
                    }

                    $RemediationMatches += $Match
                }
            }

        }
    }
    Write-Log("There are {$($RemediationMatches.count)} matches.")
    return $RemediationMatches
}

# Get Platform Scripts

function Get-PlatformScripts{
    param(
        [string]$GroupID
    )
    Write-Log("Starting Platform Script comparison")
    $PlatformMatches  = @()

    $PlatformResponse = Invoke-GraphPagedRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceManagementScripts"

    foreach($Policy in $PlatformResponse){
        $Assignments = Invoke-GraphPagedRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceManagementScripts/$($Policy.id)/assignments"

        foreach($Assignment in $Assignments){
            
            switch ($Assignment.Target.'@odata.type') {
                '#microsoft.graph.groupAssignmentTarget'{
                    if($Assignment.Target.groupId -ne $GroupID){
                        continue
                    }
                    $Type = 'Include'

                    $Match = [PSCustomObject]@{
                        PolicyName = $Policy.displayName
                        PolicyId = $Policy.Id
                        PolicyType = 'Platform Script'
                        AssignmentType = $Type
                        GroupId = $Assignment.Target.GroupId
                        AssignmentId = $Assignment.Id
                    }

                    $PlatformMatches += $Match
                }
                '#microsoft.graph.exclusionGroupAssignmentTarget'{
                    if($Assignment.Target.groupId -ne $GroupID){
                        continue
                    }
                    $Type = 'Exclude'

                    $Match = [PSCustomObject]@{
                        PolicyName = $Policy.displayName
                        PolicyId = $Policy.Id
                        PolicyType = 'Platform Script'
                        AssignmentType = $Type
                        GroupId = $Assignment.Target.GroupId
                        AssignmentId = $Assignment.Id
                    }

                    $PlatformMatches += $Match
                }
            }

        }
    }
    Write-Log("There are {$($PlatformMatches.count)} matches.")
    return $PlatformMatches
}

# Get Autopilot Deployment Profiles

function Get-AutopilotDeploymentPolicies{
    param(
        [string]$GroupID
    )
    Write-Log("Starting Autopilot Deployment Policy comparison")
    $AutopilotMatches  = @()

    $AutopilotResponse = Invoke-GraphPagedRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/windowsAutopilotDeploymentProfiles"

    foreach($Policy in $AutopilotResponse){
        $Assignments = Invoke-GraphPagedRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/windowsAutopilotDeploymentProfiles/$($Policy.id)/assignments"

        foreach($Assignment in $Assignments){
            
            switch ($Assignment.Target.'@odata.type') {
                '#microsoft.graph.groupAssignmentTarget'{
                    if($Assignment.Target.groupId -ne $GroupID){
                        continue
                    }
                    $Type = 'Include'

                    $Match = [PSCustomObject]@{
                        PolicyName = $Policy.displayName
                        PolicyId = $Policy.Id
                        PolicyType = 'Autopilot Profile'
                        AssignmentType = $Type
                        GroupId = $Assignment.Target.GroupId
                        AssignmentId = $Assignment.Id
                    }

                    $AutopilotMatches += $Match
                }
                '#microsoft.graph.exclusionGroupAssignmentTarget'{
                    if($Assignment.Target.groupId -ne $GroupID){
                        continue
                    }
                    $Type = 'Exclude'

                    $Match = [PSCustomObject]@{
                        PolicyName = $Policy.displayName
                        PolicyId = $Policy.Id
                        PolicyType = 'Autopilot Profile'
                        AssignmentType = $Type
                        GroupId = $Assignment.Target.GroupId
                        AssignmentId = $Assignment.Id
                    }

                    $AutopilotMatches += $Match
                }
            }

        }
    }
    Write-Log("There are {$($AutopilotMatches.count)} matches.")
    return $AutopilotMatches
}


# Get Enrollment Status Page Policies

function Get-ESP{
    param(
        [string]$GroupID
    )
    Write-Log("Starting Enrollment Status Page comparison")
    $ESPMatches  = @()

    $ESPResponse = Invoke-GraphPagedRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations"

    foreach($Policy in $ESPResponse){
        $Assignments = Invoke-GraphPagedRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations/$($Policy.id)/assignments"

        foreach($Assignment in $Assignments){
            
            switch ($Assignment.Target.'@odata.type') {
                '#microsoft.graph.groupAssignmentTarget'{
                    if($Assignment.Target.groupId -ne $GroupID){
                        continue
                    }
                    $Type = 'Include'

                    $Match = [PSCustomObject]@{
                        PolicyName = $Policy.displayName
                        PolicyId = $Policy.Id
                        PolicyType = 'Enrollment Status Page'
                        AssignmentType = $Type
                        GroupId = $Assignment.Target.GroupId
                        AssignmentId = $Assignment.Id
                    }

                    $ESPMatches += $Match
                }
                '#microsoft.graph.exclusionGroupAssignmentTarget'{
                    if($Assignment.Target.groupId -ne $GroupID){
                        continue
                    }
                    $Type = 'Exclude'

                    $Match = [PSCustomObject]@{
                        PolicyName = $Policy.displayName
                        PolicyId = $Policy.Id
                        PolicyType = 'Enrollment Status Page'
                        AssignmentType = $Type
                        GroupId = $Assignment.Target.GroupId
                        AssignmentId = $Assignment.Id
                    }

                    $ESPMatches += $Match
                }
            }

        }
    }
    Write-Log("There are {$($ESPMatches.count)} matches.")
    return $ESPMatches
}

Write-Host(@"
Welcome to Intune Group Checker v0.1.

This program will allow you to search for group assignments on the following Intune areas:
    - Configuration Policies
    - Compliance Policies
    - Autopilot Policy
    - ESP
    - Applications
    - Security Policy

Please ensure you have the necessary authorisation to read these areas. The following Microsoft Graph permissions are required:
    - DeviceManagementConfiguration.Read.All
    - Groups.Read.All

Also please ensure you have downloaded the latest Microsoft Graph Powershell module (use Install-Module Microsoft.Graph).
"@) -ForegroundColor Yellow

Write-Host("Do you want to connect with your Account or an Application?") -ForegroundColor Blue
$ConnectionChoice = Read-Host("Please enter either Account or App: (account/app)")

if($ConnectionChoice.ToLower() -eq 'account'){
    Write-Host("Attempting to connect to Microsoft Graph using an account authentication.")
    Connect-MgGraph 
}elseif($ConnectionChoice.ToLower() -eq 'app'){
    $ClientID = Read-Host("Please enter your Client ID: ") # Feel free to hard code this :)
    $TenantID = Read-Host("Please enter your Tenant ID: ") # Feel free to hard code this :)
    $ClientSecret = Read-Host("Please enter your Client Secret: ")
    $SecureSecret = ConvertTo-SecureString -String $ClientSecret -AsPlainText -Force
    $SecretParams = @{
        TypeName = 'System.Management.Automation.PSCredential'
        ArgumentList = $ClientID, $SecureSecret
    }
    $Secret = New-Object @SecretParams

    Write-Host("Attempting to connect to Microsoft Graph using application authentication.")

    Connect-MgGraph -TenantId $TenantID -ClientSecretCredential $Secret

}else{
    Write-Host("An incorrect option was chosen, exiting the script.") -ForegroundColor Red
}
# Connect to Microsoft Graph with the scopes.

# Get the search choice and then gather ID if necessary with Group ID function. Start the main part of the script.
$SearchChoice = Read-Host("Are you providing a group name or ID?: (name/id)")

if($SearchChoice.ToLower() -eq "name"){
    Write-Host("Group Name has been chosen.")
    $GroupName = Read-Host("Please enter the full group name as seen in Entra: ")
    $Group = Get-MgGroup -Filter "DisplayName eq '$GroupName'"
    $GroupID = $Group.Id
    Start-GroupChecker -GroupID $GroupID
}

elseif($SearchChoice.ToLower() -eq "id"){
    Write-Host("Group ID has been chosen.")
    $GroupID = Read-Host("Please enter the group ID as seen in Entra: ")
    Start-GroupChecker -GroupID $GroupID
}

Disconnect-MgGraph