Convert Intune Device Groups to User Groups via Graph API

I currently attend at the MMS Fort Lauderdale conference, where an attendee asked a good question: Is it possible to convert device groups to user groups, and vice versa? The answer is both yes and no. While there’s no out-of-the-box functionality in Intune to turn device groups to user groups directly, it is possible by leveraging the Microsoft Graph API.

Why convert device groups to user groups?

There are plenty of real-world scenarios where you need to convert device groups to user groups. Maybe an app or policy was originally assigned to devices, but now you want to target the people who own them, or the other way around. Because Intune has no native button for this, the practical path is to read the membership of one group and project it onto the other type, which is exactly what the script below does.

A concrete example: you rolled out a line-of-business app to a device group during a hardware refresh, and now compliance wants the same app reported per user for licensing. Instead of rebuilding the assignment by hand, you read the device membership, resolve each device’s registered owner, and create a matching user group. The reverse is just as common when a user-targeted Conditional Access exclusion needs a device-based equivalent.

A few years ago, I developed a tool called Intune Tool Box, which was my first attempt at creating a community tool to fill some gaps not addressed by Intune’s native features. This tool included the functionality to convert device groups to user groups, but it’s no longer maintained. I refactored the code to accomplish this task, and here is the result:

Prerequisites and Graph permissions

Before you run anything, make sure the Microsoft Graph PowerShell module is installed and that the signed-in account can consent to the delegated scopes the script requests. You need Group.ReadWrite.All to create the new group and add members, plus User.Read.All, Device.Read.All and Directory.Read.All so the script can resolve the relationship between devices and their registered owners. If your tenant requires admin consent, an Intune or Global Administrator has to approve those scopes once before the conversion will work for everyone else.

# Install the Microsoft Graph PowerShell module if not already installed
# Install-Module Microsoft.Graph -Scope CurrentUser

Import-Module Microsoft.Graph

# Connect to Microsoft Graph with the required scopes
Connect-MgGraph -Scopes "Group.ReadWrite.All", "User.Read.All", "Device.Read.All", "Directory.Read.All"

# Function to convert a group and include associated devices or users
function Convert-Group {
    param (
        [Parameter(Mandatory = $true)]
        [string]$SourceGroupId,
        [Parameter(Mandatory = $true)]
        [ValidateSet("User", "Device")]
        [string]$TargetMembershipType,
        [Parameter(Mandatory = $false)]
        [string]$NewGroupName
    )

    # Get the source group
    $sourceGroup = Get-MgGroup -GroupId $SourceGroupId

    # Get all members of the source group
    $members = Get-MgGroupMember -GroupId $SourceGroupId -All

    # Initialize an array to hold the target members
    $targetMembers = @()

    if ($TargetMembershipType -eq "User") {
        # For each device, get the assigned user
        foreach ($member in $members) {
            if ($member.'@odata.type' -eq '#microsoft.graph.device') {
                $deviceId = $member.Id
                # Get the registered user of the device
                $device = Get-MgDevice -DeviceId $deviceId -ExpandProperty registeredOwners
                $assignedUsers = $device.RegisteredOwners | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.user' }
                foreach ($user in $assignedUsers) {
                    if (-not $targetMembers.Contains($user.Id)) {
                        $targetMembers += $user.Id
                    }
                }
            }
        }
    } elseif ($TargetMembershipType -eq "Device") {
        # For each user, get all devices assigned to them
        foreach ($member in $members) {
            if ($member.'@odata.type' -eq '#microsoft.graph.user') {
                $userId = $member.Id
                # Get devices registered to the user
                $userDevices = Get-MgUserRegisteredDevice -UserId $userId -All
                foreach ($device in $userDevices) {
                    if (-not $targetMembers.Contains($device.Id)) {
                        $targetMembers += $device.Id
                    }
                }
            }
        }
    }

    # Set the new group name
    if (-not $NewGroupName) {
        $NewGroupName = "$($sourceGroup.DisplayName) - Converted to $TargetMembershipType Group"
    }

    # Create a new security group
    $newGroupParams = @{
        DisplayName     = $NewGroupName
        MailEnabled     = $false
        MailNickname    = $NewGroupName -replace ' ', ''
        SecurityEnabled = $true
        GroupTypes      = @()
    }

    $newGroup = New-MgGroup @newGroupParams

    # Add members to the new group
    foreach ($memberId in $targetMembers) {
        try {
            New-MgGroupMemberByRef -GroupId $newGroup.Id -DirectoryObjectId $memberId
        } catch {
            Write-Warning "Failed to add member with ID $memberId to the group."
        }
    }

    Write-Host "New group created with ID: $($newGroup.Id)"
}

# Example usage:
# Convert a device group to a user group
Convert-Group -SourceGroupId "<SourceGroupId>" -TargetMembershipType "User"

# Convert a user group to a device group
# Convert-Group -SourceGroupId "<SourceGroupId>" -TargetMembershipType "Device"

How the script works

The logic is deliberately simple so you can adapt it. It reads every member of the source group, checks the object type, and then walks the device-to-owner relationship in the direction you asked for. When converting to a user group, it expands each device’s registeredOwners and collects the users; when converting to a device group, it looks up each user’s registered devices instead. Duplicate members are filtered out before a fresh security group is created and populated.

Because it always creates a new group rather than editing the original, the source membership stays untouched, so a bad run never breaks an existing assignment. That makes it safe to iterate: run it, review the result in the Entra portal, and delete the new group if something looks off.

Common pitfalls

The most frequent surprise is empty output: if your devices have no registered owner in Entra ID, there is simply no user to project to, so the resulting group will be empty. Hybrid-joined devices and shared kiosk devices are typical offenders here. The second pitfall is dynamic groups, the script copies a static snapshot of membership, so a converted group will not stay in sync with a dynamic source. Finally, always test against a small group first and confirm the membership in the Entra admin center before you point any real assignment at the new group.

To summarize, while Intune has no native option to convert device groups to user groups, the Microsoft Graph PowerShell SDK makes it straightforward. Adjust the scopes and group names to fit your tenant, test against a small group first, and you will be able to move membership between device groups to user groups whenever a deployment scenario demands it.