AddCurrentDeviceToAutopilot.ps1

<#PSScriptInfo
.VERSION 2.5
.GUID ec909599-b3ae-48fa-a331-72c40493d267
.AUTHOR Piotr Gardy
.COMPANYNAME
.COPYRIGHT
.TAGS Windows AutoPilot
.LICENSEURI
.PROJECTURI
.ICONURI
.EXTERNALMODULEDEPENDENCIES 
.REQUIREDSCRIPTS
.EXTERNALSCRIPTDEPENDENCIES
.RELEASENOTES
Version 2.5: Using Beta modules (and /Beta endpoint) for DeviceManagementWindowsAutopilotDeviceIdentity commandlets
Version 2.4: Fixing errors after Microsoft.Graph modules have been upgraded to 2.0
Version 2.3: Bugfixing after testing 2.0 version
Version 2.0: Migrated to new Powershell module (Microsoft.Graph.Authentication + Microsoft.Graph.DeviceManagement.Enrolment) p;us more functionalities
Version 1.0: Original published version
#>

<# 

.SYNOPSIS
 A sample script to register current device into Windows Autopilot. It waits till profile is applied then restarts

.DESCRIPTION 
 A sample script to register current device into Windows Autopilot. It waits till profile is applied then restarts
 If you want to provide feedback or contribute, please use Github website: https://github.com/pgardy/AddCurrentDeviceToAutopilot


.PARAMETER Scopes
Scopes to be used. By default script only asks what it needs, which is : DeviceManagementServiceConfig.ReadWrite.All, User.Read

.PARAMETER GroupTag
(Optional) Grouptag value

.PARAMETER AssignedUserPrincipalName
(Optional) Assigned UserPrincipalNam

.PARAMETER UseLegacyAppId
(Optional) In case that new Powershell Module AzureAD is not approved yet by Global Administrator, you can try to use AppId for legacy module. That would require a login to AzureAD by retyping Device Code

.PARAMETER UseDeviceAuth
(Optional) If you want to perform AAD Login from another computer, use this option and retype Device Code as intructed

.PARAMETER DeviceHashFilePath
Path where to save and use hardware hash data. By default it is: c:\windows\temp\DeviceHardwareData.txt

.PARAMETER DoRestart
Specify if you want to restart a device when import was finished. $true by default


.EXAMPLE
.\AddCurrentDeviceToAutopilot.ps1 -GroupTag Test123 -DoRestart $false
Assing GroupTag for this device and do not restart when import is finished

.EXAMPLE
.\AddCurrentDeviceToAutopilot.ps1 -GroupTag Test123 -UseLegacyAppId
Use "Microsoft Intune PowerShell" (legacy Azure AD Enterprise Applications App id) . Might be helpfull if new, correct, module hasn't been aproved by Global Administrator yet
 #>


#Let's define parameters
[CmdletBinding()]
Param(
    [Parameter(Mandatory = $false,
        HelpMessage = "Scopes to be used. By default script only asks what it needs, which is : DeviceManagementServiceConfig.ReadWrite.All, User.Read")]
    [string]$Scopes = "DeviceManagementServiceConfig.ReadWrite.All, User.Read",
    
    [Parameter(Mandatory = $false,
        HelpMessage = "(Optional) Grouptag value")]
    [String]$GroupTag = "",

    [Parameter(Mandatory = $false,
        HelpMessage = "(Optional) Assigned UserPrincipalName")]
    [String]$AssignedUserPrincipalName = "",

    [Parameter(Mandatory = $false,
        HelpMessage = "(Optional) In case that new Powershell Module AzureAD is not approved yet by Global Administrator, you can try to use AppId for legacy module. That would require a login to AzureAD by retyping Device Code")]
    [switch]$UseLegacyAppId,
    
    [Parameter(Mandatory = $false,
        HelpMessage = "(Optional) If you want to perform AAD Login from another computer, use this option and retype Device Code as intructed")]
    [switch]$UseDeviceAuth ,

    [Parameter(Mandatory = $false,
        HelpMessage = "Specify if you want to restart a device when import was finished. `$true by default")]
    [bool]$DoRestart = $true ,

    [Parameter(Mandatory = $false,
        HelpMessage = "Path where to save and use hardware hash data. By default it is: c:\windows\temp\DeviceHardwareData.txt")]
    [string]$DeviceHashFilePath = "c:\windows\temp\DeviceHardwareData.txt"
    
)

##### Main Part #################

Write-host "Checking and installing, missing, modules"
#Installing modules
$InstalledModules = Get-Module -ListAvailable -Name Microsoft.Graph.Authentication, Microsoft.Graph.Beta.DeviceManagement.Enrollment
if ($InstalledModules.Name -inotcontains "Microsoft.Graph.Authentication") { Install-Module Microsoft.Graph.Authentication -Scope CurrentUser -Force }
if ($InstalledModules.Name -inotcontains "Microsoft.Graph.Beta.DeviceManagement.Enrollment") { Install-Module Microsoft.Graph.Beta.DeviceManagement.Enrollment -Scope CurrentUser -Force }

#Importing modules
Import-Module Microsoft.Graph.Authentication
Import-Module Microsoft.Graph.Beta.DeviceManagement.Enrollment


Write-host "Initiating authentication to AAD"
#connecting to AzureAD
if ($PSBoundParameters.ContainsKey('UseLegacyAppId')) {
    Connect-MgGraph -Scopes $scopes -ClientId d1ddf0e4-d672-4dae-b554-9d5bdfd93547 -UseDeviceAuthentication     
}
else {
    if ($PSBoundParameters.ContainsKey('UseDeviceAuth')) {
        Connect-MgGraph -Scopes $scopes -UseDeviceAuthentication
    }
    else {
        Connect-MgGraph -Scopes $scopes 
    }
}

#Get Hardware Hash
if ( !(Test-Path $DeviceHashFilePath)  ) {
    $hwid = (Get-WMIObject -Namespace root/cimv2/mdm/dmmap -Class MDM_DevDetail_Ext01 -Filter "InstanceID='Ext' AND ParentID='./DevDetail'").DeviceHardwareData
    $content = [System.Convert]::FromBase64String($hwid  )
    Set-Content -Path $DeviceHashFilePath  -Value $Content -Encoding Byte
}

#Get SerialNumber
$ser = (Get-WmiObject win32_bios).SerialNumber


#check id device is already present in the tenant
$dev = Get-MgBetaDeviceManagementWindowsAutopilotDeviceIdentity -Filter "contains(serialNumber,'$($ser)')" -ErrorAction SilentlyContinue
if ($null -eq $dev) {
    #building importing command
    Write-host "$((get-date).ToLongTimeString()) : Adding device to Autopilot"
    $expr = "New-MgBetaDeviceManagementImportedWindowsAutopilotDeviceIdentity -SerialNumber ""$($ser)"" -HardwareIdentifierInputFile ""$($DeviceHashFilePath)"" " 
    if ($GroupTag -ne "") {
        $expr += " -GroupTag ""$($GroupTag)"""
    }
    if ($AssignedUserPrincipalName -ne "") {
        $expr += " -AssignedUserPrincipalName ""$($AssignedUserPrincipalName)"""
    }
    #invoking import of the device
    Invoke-Expression $expr
    write-host "Added device to Autopilot"
}
else {
    Write-host "$((get-date).ToLongTimeString()) : Device already exists in Autopilot"
    break;
}

try { Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/$($GraphVersion)/deviceManagement/windowsAutopilotSettings/sync" -Method POST -ErrorAction SilentlyContinue | out-null } catch {}

do {
    
    Start-Sleep -Seconds 30
    $dev = Get-MgBetaDeviceManagementWindowsAutopilotDeviceIdentity -Filter "contains(serialNumber,'$($ser)')" -ErrorAction SilentlyContinue
    if ($null -ne $dev) {
        Write-host "$((get-date).ToLongTimeString()) : $($dev.deploymentProfileAssignmentStatus)"
        if (($dev.DeploymentProfileAssignmentStatus -ine "notAssigned") -and ($dev.DeploymentProfileAssignmentStatus -ine "pending") ) {
            $isok = $true
        }
    }
    else {
        Write-host "$((get-date).ToLongTimeString()) : Not available in Autopilot service yet"
    }
} while (!$isok)
write-host
if ($isok) {
    if ($DoRestart) {
        Write-Host "Now you can proceed with Autopilot. Restarting in 30 seconds" -ForegroundColor Green
        Start-Sleep -Seconds 30
        Restart-Computer -Force
    }

}
else {
    Write-Error "Something was wrong while adding device to Autopilot"
}