Add device vào Pilot Group và xóa Intune device hàng loạt bằng Graph API

##########################
# Add devices (Entra Object ID or Device ID) to Entra cloud group
# Group: Cloud Assign Group
##########################

$GetDevices = Import-Csv "C:\Temp\DevicesToAdd.csv" # Column: EntraID, Device Name
$serverUrl  = "https://graph.microsoft.com"
$userToken  = (Get-Content -Path 'C:\Temp\IntuneToken.txt' -Raw).Trim() -replace '^Bearer\s+', ''
$groupName  = "VN.Group.CongTam"
$Headers    = @{ 'Authorization' = "******" }

#region Helper - Graph call with retry on throttling (429/503)
function Invoke-Graph {
    param([string]$Uri, [string]$Method = 'GET', [string]$Body)
    for ($i = 1; $i -le 5; $i++) {
        try {
            $Params = @{ Uri = $Uri; Headers = $Headers; Method = $Method; ContentType = "application/json" }
            if ($Body) { $Params.Body = $Body }
            return Invoke-RestMethod @Params -ErrorAction Stop
        }
        catch {
            $code = $_.Exception.Response.StatusCode.value__
            if ($code -in 429, 503 -and $i -lt 5) { Start-Sleep -Seconds ($i * 5) } else { throw }
        }
    }
}
#endregion

Start-Transcript "C:\Temp\EntraAddToGroup.txt" -Force

#region 1. Resolve group ID
$group = (Invoke-Graph -Uri "$serverUrl/v1.0/groups?`$filter=displayName eq '$groupName'&`$select=id,groupTypes").value
if (-not $group -or $group.Count -ne 1) { Write-Host "Group '$groupName' not found or duplicated." -ForegroundColor Red; Stop-Transcript; return }
if ($group.groupTypes -contains 'DynamicMembership') { Write-Host "Group is Dynamic - cannot add members." -ForegroundColor Red; Stop-Transcript; return }
$groupId = $group.id
Write-Host "Group: $groupName ($groupId)" -ForegroundColor Cyan
#endregion

#region 2. Load existing device members
$existing = New-Object 'System.Collections.Generic.HashSet[string]'
$uri = "$serverUrl/v1.0/groups/$groupId/members/microsoft.graph.device?`$select=id&`$top=999"
while ($uri) {
    $resp = Invoke-Graph -Uri $uri
    $resp.value | ForEach-Object { [void]$existing.Add($_.id) }
    $uri = $resp.'@odata.nextLink'
}
Write-Host "Existing device members: $($existing.Count)" -ForegroundColor Cyan
#endregion

#region 3. Process each device
$Result = foreach ($Device in $GetDevices) {
    $inputId = "$($Device.EntraID)".Trim()
    $entra = $null; $idType = ""; $status = ""
    Write-Host "Processing $($Device.'Device Name') - EntraID: $inputId" -ForegroundColor Yellow
    try {
        # 3.1 Try as Object ID
        try {
            $entra  = Invoke-Graph -Uri "$serverUrl/v1.0/devices/$($inputId)?`$select=id,deviceId,displayName,operatingSystem"
            $idType = "ObjectId"
        } catch {
            # 3.2 Fallback: treat as Device ID
            $entra = (Invoke-Graph -Uri "$serverUrl/v1.0/devices?`$filter=deviceId eq '$inputId'&`$select=id,deviceId,displayName,operatingSystem").value | Select-Object -First 1
            if ($entra) { $idType = "DeviceId" }
        }

        if (-not $entra) { $status = "Skipped - Not found in Entra ID" }
        #elseif ($entra.operatingSystem -notmatch 'mac') { $status = "Skipped - OS is $($entra.operatingSystem)" }
        elseif ($existing.Contains($entra.id)) { $status = "Already member" }
        else {
            # 3.3 Add to group
            $BodyJSON = @{ "@odata.id" = "$serverUrl/v1.0/directoryObjects/$($entra.id)" } | ConvertTo-Json
            Invoke-Graph -Uri "$serverUrl/v1.0/groups/$groupId/members/`$ref" -Method 'POST' -Body $BodyJSON | Out-Null
            [void]$existing.Add($entra.id)
            $status = "Added"
        }
    }
    catch {
        $msg = if ($_.ErrorDetails.Message) { ($_.ErrorDetails.Message | ConvertFrom-Json).error.message } else { $_.Exception.Message }
        $status = if ($msg -match 'already exist') { "Already member" } else { "Error - $msg" }
    }

    $color = switch -Wildcard ($status) { "Added" {"Green"} "Error*" {"Red"} default {"Gray"} }
    Write-Host " -> [$idType] $status" -ForegroundColor $color

    [PSCustomObject]@{
        DeviceName    = $Device.'Device Name'
        InputID       = $inputId
        IdType        = $idType
        EntraObjectId = $entra.id
        EntraDeviceId = $entra.deviceId
        OS            = $entra.operatingSystem
        Status        = $status
    }
}
#endregion

$Result | Export-Csv "C:\Temp\EntraAddToGroup_Result.csv" -NoTypeInformation -Encoding UTF8
$Result | Group-Object Status | Select-Object Name, Count | Format-Table -AutoSize
Stop-Transcript

##########################
# Delete Intune managed devices via Graph API
##########################

$GetDevices = Import-Csv "C:\Temp\DevicesToRemove.csv" # Column: DeviceID (Intune ID), Device Name, Primary user UPN
$serverUrl  = "https://graph.microsoft.com"
$userToken  = Get-Content -Path 'C:\Temp\IntuneToken.txt'
$apiRequest = '/beta/deviceManagement/managedDevices/executeAction'

Start-Transcript "C:\Temp\IntuneCleanup.txt" -Force
foreach ($Device in $GetDevices) {
    $BodyJSON = @{
        "actionName" = "delete"
        "deviceIds"  = @( "$($Device."DeviceID")" )
    } | ConvertTo-Json -Depth 20

    Write-Host "Deleting Tired devices($($Device."Device Name") - User: $($Device."Primary user UPN"))" -ForegroundColor Yellow
    $Params = @{
        Uri         = ($serverUrl + $apiRequest)
        Headers     = @{ 'Authorization' = "******" }
        Method      = 'POST'
        Body        = $BodyJSON
        ContentType = "application/json"
    }
    Invoke-RestMethod @Params
}