How to Automate Intune Configuration Profile Assignments Based on Device Labels via Graph API

Onboarding devices and assigning user groups are two common actions that MSPs and enterprise IT teams look to automate to improve workflow. At scale, this is typically configured via RMM or Intune configuration profiles, which use device labels via Graph API. Explore our guide to get started.

Looking for a visual guide to enhance your understanding? Watch our video: How to Automate Intune Configuration Profile Assignments Based on Device Labels via Graph API.

Steps for setting Intune configuration profile assignments via Graph API

Use the table to choose and quickly navigate to your preferred activation steps.

📌 Prerequisites:

• Microsoft Intune licenses
• Microsoft Entra ID Premium (for dynamic groups and Intune policies)
• Registered application with Graph API permissions:
  • ReadWrite.All(For Settings Catalog policies)
  • ReadWrite.All (For standard configuration profiles)
  • Read.All (Required to read Intune device categories)
  • ReadWrite.All (To manage assignment groups)
• PowerShell 7+ with Microsoft.Graph module
• Optional: Local registry access for tagging
• Optional: NinjaOne or RMM platform for endpoint metadata and script execution

💡 Tip: Check out the Things to look out for section for tips on managing potential risks.

Step 1: Apply local registry-based device labels (Optional)

In this example, a simple registry key on each device is created with values like Label=Finance and AssignedProfile=None.

1. Use Search 🔎 to open Terminal → PowerShell → Run as administrator.
2. Tag endpoints with role or environment metadata:

Set-ItemProperty -Path “HKLM:\SOFTWARE\Org\DeviceLabels” -Name “Label” -Value “Finance”

Set-ItemProperty -Path “HKLM:\SOFTWARE\Org\DeviceLabels” -Name “AssignedProfile” -Value “None”

This step can be used with Intune or alongside it as you transition. It creates a simple registry key on each device, which also serves as metadata.

You may run reg query HKLM\SOFTWARE\Org\DeviceLabels in CMD or PowerShell for validation. These labels can guide which Intune profile should be assigned by an external script logic.

Step 2: Connect to Microsoft Graph and query devices by label

These scripts tag devices by a label (e.g., DeviceCategory -eq “Finance”) or via extension attributes, like Entra ID extension properties.

1. Use Search 🔎 to open Terminal → PowerShell → Run as administrator.
2. Connect to Graph:

Connect-MgGraph -Scopes “DeviceManagementManagedDevices.Read.All”, “Group.ReadWrite.All”

3. Then, query devices by category:

$devices = Get-MgManagedDevice | Where-Object { $_.DeviceCategory -eq “Finance” }

If you’re using extension attributes, adjust the query to match those instead. Intune and Entra ID are best used to target enrolled devices.

⚠️ Technical Note: Ensure your automation targets the ManagedDevice endpoint rather than the standard Entra ID Device endpoint. Intune-specific attributes, such as DeviceCategory, do not exist on default Entra ID objects. Querying the wrong endpoint will result in an empty dataset.

Step 3: Create or find configuration profiles and assign them by group

The next objective is to ensure there’s a target group for the label (e.g., “Finance Devices”).

1. Use Search 🔎 to open Terminal → PowerShell → Run as administrator.
2. Run Get-MgDeviceManagementDeviceConfiguration to list existing configuration profiles.
3. Then, find or create an assignment group for the target label:

$group = Get-MgGroup | Where-Object { $_.DisplayName -eq “Finance Devices” }

Or create a new group:

$group = New-MgGroup -DisplayName “Finance Devices” -MailEnabled:$false `

-MailNickname “FinanceGroup” -SecurityEnabled:$true

4. With the group created, you can add devices to the group and assign a configuration profile.

• • Add devices: 

Add-MgGroupMember -GroupId $group.Id -DirectoryObjectId $device.Id

• • Assign configuration profile:

New-MgDeviceManagementDeviceConfigurationAssignment `

-DeviceConfigurationId $configProfile.Id `

-Target @{groupId = $group.Id}

🧠 Structural Requirement: When assigning a configuration profile via the Graph API, the system requires an explicit @odata.type structural wrapper. The script must explicitly define the target as a #microsoft.graph.groupAssignmentTarget and pass the Group ID inside that specific payload structure, rather than applying it directly to the profile object.

💡 Note: Additionally, you can use dynamic membership if your label is stored in a group-queryable attribute (e.g., extension attribute). Otherwise, you automate the tagging via RMM.

Step 4: Automate the workflow (Label → Group → Profile)

This step is all for setting hands-off management once the label sources and target profiles have been duly identified and queried. Here’s a sample script using the previous labels and profiles:

$label = “Finance”

$devices = Get-MgDevice | Where-Object { $_.DeviceCategory -eq $label }foreach ($device in $devices) {

$group = Get-MgGroup | Where-Object { $_.DisplayName -eq “$label Devices” }if (-not $group) {

$group = New-MgGroup -DisplayName “$label Devices” -MailEnabled:$false `

-MailNickname “$labelGroup” -SecurityEnabled:$true}Add-MgGroupMember -GroupId $group.Id -DirectoryObjectId $device.IdNew-MgDeviceManagementDeviceConfigurationAssignment `

-DeviceConfigurationId $configProfile.Id `

-Target @{groupId = $group.Id}}

In managed and enterprise environments, this script must be run on a recurring basis to pick up new endpoints that need to be organized.

Step 5: Store assignment status for audit in the registry

To close, update the registry to track which profile has been applied. You can run the following script via PowerShell:

Set-ItemProperty -Path “HKLM:\SOFTWARE\Org\DeviceLabels” -Name “AssignedProfile” -Value “Finance_Profile”

Set-ItemProperty -Path “HKLM:\SOFTWARE\Org\DeviceLabels” -Name “LastSynced” -Value (Get-Date).ToString(“u”)

This action creates a local audit trail for support teams. This data can also be collected by an RMM or exported to CSV for central reporting.

💡 Note: This script may run or fail without displaying any confirmation or prompt. To confirm if changes have been applied successfully, check the corresponding registry keys or system settings.

⚠️ Things to look out for when automating Intune profile assignments

Below are common risks, their possible consequences, and some practical ways to reverse or prevent issues.

Some of the earlier challenges in automating profile assignments via Intune happen in transitions. So, it’s best to do due diligence to ensure labels and groupings don’t conflict or get duplicated.

Also, the scripts may need to be run staggered in large environments, unless you’re running them via an RMM that fits the scale of the operation.

Use NinjaOne to enhance Intune workflows

Many Intune workflows can be layered with automation policies, reporting, and both scalable and granular IT management offered by NinjaOne RMM®.

• Deploying scripts that tag devices in the registry
• Triggering external Graph scripts via automation policies
• Reporting on device metadata (label, role, location) to guide assignments
• Tagging devices without proper configuration profiles for remediation
• Alerting when devices drift from expected Intune policy assignments

With NinjaOne, MSPs can streamline Intune policy governance while maintaining multi-client scalability and reporting.

Best practices for automating profile assignment in Intune

Enabling Intune configuration profile assignment automation with Graph API is an effective way to promote policy enforcement and streamline device onboarding across your network.

But as your organization grows, consider pairing Intune and Graph API with an RMM NinjaOne, which offers automation and remediation capabilities at scale. This proactive approach provides a complete framework for hands-off, audit-ready, and scalable endpoint management.

Related topics:

• How to Register Azure Devices into Intune
• Microsoft Azure Pros & Cons: Active Directory
• How to Deploy Applications Using Microsoft Intune Admin Center
• How to Add a Corporate Device to Intune Device Management
• How to Add a BYOD Device to Intune Device Management