Microsoft Graph API Automation (Case Study)
Replacing manual endpoint administration with automation against the Microsoft Graph API — PowerShell and Python for compliance reporting, provisioning, access reviews, and offboarding across a 1,000+ device Intune and Entra ID estate.
The problem
A large share of endpoint administration is the same handful of tasks repeated: pull a compliance export for a meeting, assign a policy to a new group, review who has access to what, provision a starter, deprovision a leaver. Done by hand in the admin center, each one is a few minutes of clicking — and collectively they’re hours a week that scale linearly with headcount, with a mistake rate that scales too. Offboarding in particular is a place where a missed step is a security finding: a device that never got wiped, an account that kept a license, access that was revoked in one system but not another.
Approach
- Inventory the repetitive work. Two weeks of noting every task that was “open the portal and do the same thing again.” The list clustered into reporting, bulk assignment, access review, and lifecycle (on/offboarding).
- Authenticate once, properly. An Entra ID app registration with least-privilege application permissions for the Graph endpoints in scope, certificate-based auth, and the client running as a scheduled job — no interactive tokens, no secrets in scripts.
- Build reporting first. The lowest-risk, highest-frequency win: scheduled PowerShell that queries device compliance, encryption state, and patch level via Graph and writes a clean export — the same data the compliance program and leadership ask for, produced automatically.
- Then bulk operations. Idempotent scripts for policy and group assignment that check current state before acting, log every change, and can be re-run safely.
- Then lifecycle. An offboarding routine that runs a defined sequence — device wipe command, Jamf and Intune unenrollment, Entra ID and Okta access revocation, license reclaim, group cleanup — and reports what it did, so the manual checklist became a script with an audit trail.
What I built
- Compliance and inventory exports — scheduled Graph queries producing device compliance, encryption-with-valid-key, patch state, and app-compliance reports on a fixed cadence.
- Bulk policy and group assignment — idempotent PowerShell for the repetitive Intune assignment work, safe to re-run.
- Automated access reviews — periodic exports of group membership and app assignment for the security team’s review, diffed against the previous run.
- Onboarding and offboarding routines — a defined, logged sequence across Entra ID, Intune, Jamf, Okta, and licensing, replacing a multi-system manual checklist.
- Combined with Jamf Pro API scripting for the Apple side, so both platforms are administered the same way.
Results
- Roughly 40% less manual provisioning and administrative time — the recurring reporting and assignment work moved to scheduled jobs.
- Offboarding became consistent and auditable — every leaver goes through the same sequence, and there’s a log proving it happened.
- Compliance reporting is produced on a schedule rather than assembled before each audit or meeting.
- Access reviews became a routine diff instead of a manual data pull, so drift is caught between formal reviews.
What I’d tell someone starting this
Start with reporting — it’s read-only, it’s the most frequent ask, and it builds the Graph fluency you need for the riskier automation. Use an app registration with least-privilege application permissions and certificate auth from day one; retrofitting that later is painful. Make every write operation idempotent and logged. And treat offboarding as the flagship: it’s the routine where automation most directly closes a security gap, and a script with an audit trail is worth far more than a checklist nobody can prove was followed.
Related reading: Managing Macs with Microsoft Intune · Device-based Conditional Access in Entra ID