Automation Workbench & Script Library

Production scripts targeting Microsoft Graph API, Proactive Remediations, and tenant fleet maintenance.

01 // Automated Non-Compliant Endpoint Synchronization

Pulls non-compliant devices and triggers immediate MDM policy check-ins

Sync-NonCompliantDevices.ps1

# Authenticate with Certificate Thumbprint
Connect-MgGraph -ClientId $AppId -TenantId $TenantId -CertificateThumbprint $Thumbprint

# Query devices currently in non-compliant state
$Devices = Get-MgDeviceManagementManagedDevice -Filter "complianceState eq 'noncompliant'"

foreach ($Device in $Devices) {
    Sync-MgDeviceManagementManagedDevice -ManagedDeviceId $Device.Id
    Write-Output "[SYNC] Forced policy synchronization for: $($Device.DeviceName)"
}

02 // Stale Device Cleanup Pipeline

Identifies and disables devices inactive for more than 90 days

Disable-StaleEndpoints.ps1

$CutoffDate = (Get-Date).AddDays(-90).ToString("yyyy-MM-ddTHH:mm:ssZ")
$StaleDevices = Get-MgDevice -Filter "approximateLastSignInDateTime le $CutoffDate"

foreach ($Device in $StaleDevices) {
    Update-MgDevice -DeviceId $Device.Id -AccountEnabled:$false
    Write-Output "[DISABLED] Stale device disabled: $($Device.DisplayName)"
}