Using Powershell to Assign iOS devices to DEP profile

Hello fellow admins!

As you can guess from the title, this post is dealing with a SCCM/Intune hybrid environment scenario. If you are in a hybrid environment you have probably noticed that using Apple DEP is a bit different than just using the Portal app on the phone. With that said, if you happen to be lucky enough to be able to delegate the mobile device management to another group. Then you will have probably also noticed that you can't limit security permissions below full admin if you want them to be able to assign devices to DEP.
Well have no fear, here is a nifty bit of powershell that you can setup to run on a schedule (hint: think CI). This handy script will lookup mobile devices and then assign them. Basically it does what this dialog does.


Now to the nitty gritty.

First off I recommend you familiarize yourself with the MSDN technical documentation for the method UpdateProfileIDForDevices, however what this documentation doesn't tell you is where the heck does RequestEnrollmentProfileId come from. Well you are in luck as I did a brief bit of digging and found you can get it from the WMI class SMS_MDMCorpEnrollmentProfiles, however be careful if you have more than one DEP enrollment profile. My script is based on the assumption that you only have one profile.

Once you have the RequestEnrollmentProfileID you can continue with your work. The WMI method UpdateProfileIDForDevices is found in the SMS_MDMCorpOwnedDevices WMI class. It takes two bits of information, the enrollment profile that we already found and the device serial number.

Finding the serial number(s) is actually easier than you might think. You can get them from WMI and only get the ones that haven't already been assigned. Here is the WMI query for you, however you will have to replace $ProfileID with the value of RequestEnrollmentProfileID.
select * from sms_mdmcorpowneddevices where (requestenrollmentprofileid is null or requestenrollmentprofileid <> '$ProfileID') and (DeviceType = '8')

Now you can throw those results in a loop and call the method and away you go. You now have a way to automate all that goodness.

Here is the script in its full glory. Enjoy!

$SiteServer = "SomeServer"
$SiteCode = "SomeCode"

$EnrollmentProfile = Get-WmiObject -Namespace "root\sms\site_$SiteCode" -Class SMS_MDMCorpEnrollmentProfiles -ComputerName $SiteServer
$ProfileID = $EnrollmentProfile.ProfileId

$MobileDevices = Get-WmiObject -Namespace "root\sms\site_$SiteCode" -Query "select * from sms_mdmcorpowneddevices where (requestenrollmentprofileid is null or requestenrollmentprofileid <> '$ProfileID') and (DeviceType = '8')" -ComputerName $SiteServer

If ($MobileDevices.Count > 0)
{
foreach ($md in $MobileDevices)
{
    $md.SerialNumber
    ([wmiclass]"root/SMS/site_$($SiteCode):SMS_MDMCorpOwnedDevices").UpdateProfileIdForDevices($ProfileID,$Md.SerialNumber)
}
}