When creating Azure Functions, there has always been a way to create and use “managed identities” to securely and simply access resources within the resource group that the function app resides.

With a little bit of PowerShell and a basic understanding of how API permissions are programmatically applied, we can use the managed identity to access Graph without needing to store credentials anywhere! Secure AND cool, right?

As I’ve said before, working with dynamic groups in Intune isn’t my favourite thing.

Luckily, Microsoft has been listening and have provided us with a better way to dynamically apply policies to devices with filters!