V2 – Get a Daily Device Report via Email or Teams with Logic Apps (Step by Step)

I have already written a blog about how to send a message using Logic apps to generate a regular device report. After a presentation about automation with Intune and Graph I got good feedback if I can do a variant with Co Managed devices. So I decided to write a V2 of this blog and also update the authentication with Managed Identity. If you are interested in more blogs around the topic of logic apps, let me know and I will be happy to do a deep dive on logic apps.

1. What are the prerequisites?
2. How to Create a Logic App?
3. How to grant the necessary permissions to the logic app?
4. How to create the Logic App?
5. Send status via Email

What are the prerequisites?

The prerequisites are not really high. You only need permissions to create resources in an Azure subscription and to grant API permissions to a managed identity.

How to Create a Logic App?

• Open the Azure Portal
• Search for Logic apps

• Click + Add

• Select the Subscription
• Select or create a Resource Group
• Enter an unique name of the logic app
• Select a region
• Select no for log analytics unless you want to activate this
• Select Consumption as plan type
• Select Disabled for Zone redundancy
• Click Review + create

• Add tags if you want and click Review + create
• Click Create

How to grant the necessary permissions to the logic app?

• First of all you have to make sure that the managed identity of your logic app is activated

• Open an Azure PowerShell or a PowerShell local on your device

• Execute the following code (Insert the ID of your managed identity):

Install-Module Microsoft.Graph -Scope CurrentUser

Connect-MgGraph -Scopes Application.Read.All, AppRoleAssignment.ReadWrite.All, RoleManagement.ReadWrite.Directory

$managedIdentityId = "Managed Identity Object ID"
$roleName = "DeviceManagementManagedDevices.Read.All"

$msgraph = Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'"
$role = $Msgraph.AppRoles| Where-Object {$_.Value -eq $roleName} 

New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $managedIdentityId -PrincipalId $managedIdentityId -ResourceId $msgraph.Id -AppRoleId $role.Id
 
Disconnect-MgGraph

• Do the same also for DeviceManagementConfiguration.Read.All

How to create the Logic App?

• We want to build our flow with a Recurrence trigger. For this select recurrence.

• Set the schedule to once a day.

• Add a HTTP Action
• Fill in the following attributes:
  • Method: GET
  • URI: https://graph.microsoft.com/v1.0/deviceManagement/managedDeviceOverview

• Click add new Parameter and select Authentication
• Select Authentication Type as Managed Identity
• Enter https://graph.microsoft.com as audience

• Run the first test

• Check the body if you can see device data

• Add a Parse JSON Action
• Select Body as Content and add the following content as Schema:

{
    "type": "object",
    "properties": {
        "@@odata.context": {
            "type": "string"
        },
        "id": {
            "type": "string"
        },
        "enrolledDeviceCount": {
            "type": "integer"
        },
        "mdmEnrolledCount": {
            "type": "integer"
        },
        "dualEnrolledDeviceCount": {
            "type": "integer"
        },
        "deviceOperatingSystemSummary": {
            "type": "object",
            "properties": {
                "androidCount": {
                    "type": "integer"
                },
                "iosCount": {
                    "type": "integer"
                },
                "macOSCount": {
                    "type": "integer"
                },
                "windowsMobileCount": {
                    "type": "integer"
                },
                "windowsCount": {
                    "type": "integer"
                },
                "unknownCount": {
                    "type": "integer"
                },
                "androidDedicatedCount": {
                    "type": "integer"
                },
                "androidDeviceAdminCount": {
                    "type": "integer"
                },
                "androidFullyManagedCount": {
                    "type": "integer"
                },
                "androidWorkProfileCount": {
                    "type": "integer"
                },
                "androidCorporateWorkProfileCount": {
                    "type": "integer"
                },
                "configMgrDeviceCount": {
                    "type": "integer"
                }
            }
        },
        "deviceExchangeAccessStateSummary": {
            "type": "object",
            "properties": {
                "allowedDeviceCount": {
                    "type": "integer"
                },
                "blockedDeviceCount": {
                    "type": "integer"
                },
                "quarantinedDeviceCount": {
                    "type": "integer"
                },
                "unknownDeviceCount": {
                    "type": "integer"
                },
                "unavailableDeviceCount": {
                    "type": "integer"
                }
            }
        }
    }
}

• To also get the compliance state we do basically the same in a second branch:

• Add a HTTP Action
• Fill in the following attributes:
  • Method: GET
  • URI: https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicyDeviceStateSummary
• Click add new Parameter and select Authentication
• Select Authentication Type as Managed Identity
• Enter https://graph.microsoft.com as audience

• Add again a Parse JSON block and add the following content

{
    "type": "object",
    "properties": {
        "@@odata.context": {
            "type": "string"
        },
        "inGracePeriodCount": {
            "type": "integer"
        },
        "configManagerCount": {
            "type": "integer"
        },
        "id": {
            "type": "string"
        },
        "unknownDeviceCount": {
            "type": "integer"
        },
        "notApplicableDeviceCount": {
            "type": "integer"
        },
        "compliantDeviceCount": {
            "type": "integer"
        },
        "remediatedDeviceCount": {
            "type": "integer"
        },
        "nonCompliantDeviceCount": {
            "type": "integer"
        },
        "errorDeviceCount": {
            "type": "integer"
        },
        "conflictDeviceCount": {
            "type": "integer"
        }
    }
}

Send status via Email

• Add an Outlook Send an Email (V2) action
• Sign in with an account
• Add the Receiver in the To column
• Add an Subject
• If you want to add a date to the subject add the following expression:

string(utcNow('yyyyMMdd'))

• Add the following in the Body column. (You can modify the text as you want)

Dear MDM Team,

attached your daily report:
- Total devices: @{body('Parse_JSON')?['properties']?['enrolledDeviceCount']}
- Mdm enrolled: @{body('Parse_JSON')?['properties']?['mdmEnrolledCount']}
- Hybrid enrolled: @{body('Parse_JSON')?['properties']?['dualEnrolledDeviceCount']}
- ConfigManDevices: @{body('Parse_JSON')?['deviceOperatingSystemSummary']?['configMgrDeviceCount']}

Per device group:
- Windows: @{body('Parse_JSON')?['properties']?['deviceOperatingSystemSummary']?['properties']?['windowsCount']}
- Android: @{body('Parse_JSON')?['properties']?['deviceOperatingSystemSummary']?['properties']?['androidCount']}
- iOS: @{body('Parse_JSON')?['properties']?['deviceOperatingSystemSummary']?['properties']?['iosCount']}
- MacOS: @{body('Parse_JSON')?['properties']?['deviceOperatingSystemSummary']?['properties']?['macOSCount']}

Compliance:
- Compliant devices: @{body('Parse_JSON_2')?['compliantDeviceCount']}
- Uncompliant devices: @{body('Parse_JSON_2')?['nonCompliantDeviceCount']}

Best regards and have a nice day without troubles
Your logic app

• Now we can make a test run to check if everything works

• Check you inbox