Solution AddUsersToGroupInstalledApps

Add users to groups by installed app

Solution Code: AddUsersToGroupInstalledApps

Description

This Solution reads the app inventory discovered by Microsoft Intune and, for every App name you specify, adds the users who have a matching app installed to the Entra ID group you paired that app with.

The pairs of Group ID and App name are supplied as a text file, so a single run can keep any number of groups in sync with any number of apps.

Requirements

API	Delegated	Application
Microsoft Graph	DeviceManagementManagedDevices.Read.All Group.Read.All GroupMember.ReadWrite.All	DeviceManagementManagedDevices.Read.All Group.Read.All GroupMember.ReadWrite.All
RBAC	Global Reader* Groups Administrator**	NA

*Global Reader, Intune Administrator or another admin role that can read Intune managed devices and discovered apps.

**Any admin role that can add members to the target groups. Not needed when running in Report Mode.

Report

One row per user that has a matching app installed but is not yet a member of the paired group. Users that are already members are not listed; they are counted in the Summary table.

Column Title	Description
GroupId	Object ID of the target Entra ID group
GroupName	Display name of the target group
AppNameFilter	The App name from the file that produced this row
MatchedAppName	Full name of the discovered app that matched
MatchedAppVersion	Version of the discovered app that matched
DeviceName	Name of the device the app was discovered on
UserId	Object ID of the user
UserPrincipalName	UPN of the user
EmailAddress	Email address of the user
Status	To be added in Report Mode, Added in Action Mode, Skipped - deleted user when the device's user no longer exists, Error when the user could not be added, No match when no discovered app matched the App name
Remarks	Remarks/errors captured while building the row

Summary

Column Title	Description
GroupId	Object ID of the target Entra ID group
GroupName	Display name of the target group
AppNameFilter	The App name from the file
MatchingApps	Number of discovered apps whose name matched
DevicesWithApp	Number of distinct devices a matching app is installed on
DevicesWithoutUser	How many of those devices have no primary user, and so cannot be attributed to anybody
DevicesNotFound	How many of those devices are no longer in the managed device inventory
UsersWithApp	Number of distinct users with a matching app installed
AlreadyMembers	How many of those users were already members of the group
DeletedUsers	How many were skipped because the user has been deleted
UsersAdded	How many users were added (or would be added, in Report Mode)
Errors	Number of failures while processing this pair

DevicesWithApp = DevicesWithoutUser + DevicesNotFound + the devices behind UsersWithApp (several devices can belong to the same user, so the last group is usually larger than UsersWithApp).

Parameters

Report Mode

File with the list of Group IDs and App names

Parameter	Type	Definition
Select file	Required	A simple text file with one GroupId,AppName pair per line.

The Group ID is the Object ID of the target Entra ID group, and the App name is matched against the name of the discovered app. Empty lines and lines starting with # are ignored, so the file can be commented:

# GroupId,AppNameFilter
20d4a812-9c63-4665-853f-6a382e1d30af,7-zip
8c104f5b-00e4-40c2-a441-39ecfed70329,notepad++

Only the first comma on a line separates the two values, so an App name is allowed to contain commas. The match is case-insensitive and matches any part of the app name.

How this Solution works

1. Retrieves every managed device in the tenant, once per run, to be able to look up the primary user of a device (see Notes).
2. For each GroupId,AppName pair in the file:
   • Resolves the group and its transitive membership, so users that are members through a nested group are correctly recognised as already being members.
   • Asks Intune for the discovered apps that could match, then selects the ones whose name actually contains the App name (see Notes).
   • Retrieves the devices each of those apps is installed on, and looks up the primary user of each device. A user is collected once, even when the app is installed on several of their devices or in several versions.
   • Adds each collected user that is not already a member of the group.
3. Writes one row per missing user to the Report table and the per-pair counters to the Summary table.

A group named by more than one pair is only resolved once per run, and a user added for one pair is not attempted again for another pair on the same group.

Notes

The app inventory comes from Intune Discovered apps, which reports apps per device. A user is reached through the primary user of the device, so an app installed on a device with no primary user assigned cannot be attributed to anybody and does not add anyone to a group. Those devices are counted in the Summary table's DevicesWithoutUser column, so the numbers always account for themselves.