I have already written a blog about how to send a message using Logic apps to generate a regular device report. After a presentation about automation with Intune and Graph I got the good feedback if I can do a variant with Co Managed devices. So I decided to write a V2 of this blog and also update the authentication with Managed Identity. If you are interested in more blogs around the topic of logic apps, let me know and I will be happy to do a deep dive on logic apps.

1. What are the prerequisites?
2. How to Create an Logic App?
3. How to grant the necessary permissions to the logic app?
4. How to create the Logic App?
5. Send status via Email

What are the prerequisites?

The prerequisites are not really high. You only need permissions to create ressources in a azure subscription and to grant API permissions to an managed identity.

How to Create an Logic App?

• Open the Azure Portal
• Search for Logic apps

• Click + Add

• Select the Subscription
• Select or create a Resource Group
• Enter an unique name of the logic app
• Select a region
• Select no for log analytics unless you want to activate this
• Select Consumption as plan type
• Select Disabled for Zone redundancy
• Click Review + create

• Add tags if you want and click Review + create
• Click Create

How to grant the necessary permissions to the logic app?

• First of all you have to make sure that the managed identity of your logic app is activated

• Open a Azure PowerShell or a PowerShell local on your device

• Execute the following code (Insert the ID of your managed identity):

Install-Module Microsoft.Graph -Scope CurrentUser

Connect-MgGraph -Scopes Application.Read.All, AppRoleAssignment.ReadWrite.All, RoleManagement.ReadWrite.Directory

$managedIdentityId = "Managed Identity Object ID"
$roleName = "DeviceManagementManagedDevices.Read.All"

$msgraph = Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'"
$role = $Msgraph.AppRoles| Where-Object {$_.Value -eq $roleName} 

New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $managedIdentityId -PrincipalId $managedIdentityId -ResourceId $msgraph.Id -AppRoleId $role.Id
 
Disconnect-MgGraph

• Do the same also for DeviceManagementConfiguration.Read.All

How to create the Logic App?

• We want to build out flow with an Recurrence trigger. For this select recurrence.

• Set the schedule to once a day.

• Add a HTTP Action
• Fillin the following Attributes:
  • Method: GET
  • URI: https://graph.microsoft.com/v1.0/deviceManagement/managedDeviceOverview

• Click add new Parameter and select Authentication
• Select Authentication Type as Managed Identity
• Enter https://graph.microsoft.com as audience

• Run the first test

• Check the body if you can see device data

• Add a Parse JSON Action
• Select Body as Content and add the following content as Schema:

{
    "type": "object",
    "properties": {
        "@@odata.context": {
            "type": "string"
        },
        "id": {
            "type": "string"
        },
        "enrolledDeviceCount": {
            "type": "integer"
        },
        "mdmEnrolledCount": {
            "type": "integer"
        },
        "dualEnrolledDeviceCount": {
            "type": "integer"
        },
        "deviceOperatingSystemSummary": {
            "type": "object",
            "properties": {
                "androidCount": {
                    "type": "integer"
                },
                "iosCount": {
                    "type": "integer"
                },
                "macOSCount": {
                    "type": "integer"
                },
                "windowsMobileCount": {
                    "type": "integer"
                },
                "windowsCount": {
                    "type": "integer"
                },
                "unknownCount": {
                    "type": "integer"
                },
                "androidDedicatedCount": {
                    "type": "integer"
                },
                "androidDeviceAdminCount": {
                    "type": "integer"
                },
                "androidFullyManagedCount": {
                    "type": "integer"
                },
                "androidWorkProfileCount": {
                    "type": "integer"
                },
                "androidCorporateWorkProfileCount": {
                    "type": "integer"
                },
                "configMgrDeviceCount": {
                    "type": "integer"
                }
            }
        },
        "deviceExchangeAccessStateSummary": {
            "type": "object",
            "properties": {
                "allowedDeviceCount": {
                    "type": "integer"
                },
                "blockedDeviceCount": {
                    "type": "integer"
                },
                "quarantinedDeviceCount": {
                    "type": "integer"
                },
                "unknownDeviceCount": {
                    "type": "integer"
                },
                "unavailableDeviceCount": {
                    "type": "integer"
                }
            }
        }
    }
}

• To also get the compliance state we do basically the same in a second branch:

• Add a HTTP Action
• Fillin the following Attributes:
  • Method: GET
  • URI: https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicyDeviceStateSummary
• Click add new Parameter and select Authentication
• Select Authentication Type as Managed Identity
• Enter https://graph.microsoft.com as audience

• Add again an parse json block and add the following content

{
    "type": "object",
    "properties": {
        "@@odata.context": {
            "type": "string"
        },
        "inGracePeriodCount": {
            "type": "integer"
        },
        "configManagerCount": {
            "type": "integer"
        },
        "id": {
            "type": "string"
        },
        "unknownDeviceCount": {
            "type": "integer"
        },
        "notApplicableDeviceCount": {
            "type": "integer"
        },
        "compliantDeviceCount": {
            "type": "integer"
        },
        "remediatedDeviceCount": {
            "type": "integer"
        },
        "nonCompliantDeviceCount": {
            "type": "integer"
        },
        "errorDeviceCount": {
            "type": "integer"
        },
        "conflictDeviceCount": {
            "type": "integer"
        }
    }
}

Send status via Email

• Add an Outlook Send an Email (V2) action
• Sing in with an account
• Add the Reciver in the To column
• Add an Subject
• If you want to add an date to the subject add the following expression:

string(utcNow('yyyyMMdd'))

• Add the following in the Body column. (You can modify the text as you want)

Dear MDM Team,

attached your daily report:
- Total devices: @{body('Parse_JSON')?['properties']?['enrolledDeviceCount']}
- Mdm enrolled: @{body('Parse_JSON')?['properties']?['mdmEnrolledCount']}
- Hybrid enrolled: @{body('Parse_JSON')?['properties']?['dualEnrolledDeviceCount']}
- ConfigManDevices: @{body('Parse_JSON')?['deviceOperatingSystemSummary']?['configMgrDeviceCount']}

Per device group:
- Windows: @{body('Parse_JSON')?['properties']?['deviceOperatingSystemSummary']?['properties']?['windowsCount']}
- Android: @{body('Parse_JSON')?['properties']?['deviceOperatingSystemSummary']?['properties']?['androidCount']}
- iOS: @{body('Parse_JSON')?['properties']?['deviceOperatingSystemSummary']?['properties']?['iosCount']}
- MacOS: @{body('Parse_JSON')?['properties']?['deviceOperatingSystemSummary']?['properties']?['macOSCount']}

Compliance:
- Compliant devices: @{body('Parse_JSON_2')?['compliantDeviceCount']}
- Uncompliant devices: @{body('Parse_JSON_2')?['nonCompliantDeviceCount']}

Best regards and have a nice day without troubles
Your logic app

• Now we can make an test run to check if everything works

• Check you inbox