<# .TITLE Multi-Admin Approval Pending Requests Monitor .SYNOPSIS Automated runbook to monitor Multi-Admin Approval (MAA) pending requests in Intune and send email alerts to approvers. .DESCRIPTION This script is designed to run as a scheduled Azure Automation runbook that monitors Multi-Admin Approval requests in Microsoft Intune and identifies pending approval requests. It tracks new requests, monitors request age, identifies approvers, and sends email notifications to administrators with detailed request information and direct links to the Intune portal. The script helps maintain security compliance by ensuring timely review of administrative changes and provides visibility into the MAA approval workflow. Key Features: - Monitors all MAA pending requests across protected resources - Tracks request age and highlights urgent requests - Identifies and notifies appropriate approvers - Provides direct links to Intune portal for quick action - Tracks previously notified requests to avoid spam - Sends escalation alerts for aging requests - Supports both Azure Automation runbook and local execution - HTML formatted email reports with actionable insights - Uses Microsoft Graph Mail API exclusively .TAGS Notification,Security,RunbookOnly,Email,Monitoring,MAA,Compliance .MINROLE Intune Administrator .PERMISSIONS DeviceManagementConfiguration.Read.All,DeviceManagementApps.Read.All,DeviceManagementManagedDevices.Read.All,DeviceManagementRBAC.Read.All,AuditLog.Read.All,Mail.Send .AUTHOR Ugur Koc .VERSION 1.4 .CHANGELOG 1.4 - Added Azure Automation contract validation, portal-safe boolean parameters, beta Graph endpoints, and terminating paging errors 1.3 - Azure Automation now records script progress, outcomes, and summaries in job history 1.2 - Mail now sends from a mandatory SenderUPN mailbox via /users/{upn}/sendMail (app-only managed identity cannot use /me); request expiry now derives from the real expirationDateTime property instead of an assumed 30-day lifetime; pagination helper preserves single-item arrays 1.1 - Local runs now use MgGraphCommunity for WAM-free interactive sign-in (auto-installed if missing); pending request fields now map to real operationApprovalRequest properties (requestor identitySet, requiredOperationApprovalPolicyTypes) 1.0 - Initial release .EXECUTION RunbookOnly .OUTPUT Email .SCHEDULE Hourly .CATEGORY Notification .LASTUPDATE 2026-07-30 .EXAMPLE .\maa-pending-requests-monitor.ps1 -EmailRecipients "" -SenderUPN "" -UrgentThresholdHours 24 Monitors MAA requests and alerts security team, marking requests older than 24 hours as urgent .EXAMPLE .\maa-pending-requests-monitor.ps1 -EmailRecipients "," -SenderUPN "" -UrgentThresholdHours 48 -EscalationThresholdHours 72 Monitors MAA requests with multiple recipients and escalation for requests older than 72 hours .NOTES - Requires Microsoft.Graph.Authentication module - For Azure Automation, configure Managed Identity with required permissions - This script is designed specifically for Azure Automation runbooks - Email notifications are sent via Microsoft Graph Mail API from the SenderUPN mailbox - The Automation account's managed identity requires Mail.Send permission for the SenderUPN mailbox - Recommended to run hourly to ensure timely notifications - Stores state in Azure Automation variables to track notified requests - Critical for maintaining MAA compliance and security posture - Local interactive sign-in uses the MgGraphCommunity module to avoid the Graph SDK's mandatory WAM broker on Windows #> [CmdletBinding()] param( # Email recipients for notifications [Parameter(Mandatory = $true, HelpMessage = "Comma-separated list of email addresses to receive notifications")] [ValidateScript({ if ($_ -match '^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}(,[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,})*$') { $true } else { throw "Please provide valid email addresses separated by commas" } })] [string]$EmailRecipients, # Mailbox used as the notification sender [Parameter(Mandatory = $true, HelpMessage = "Mailbox UPN used as the notification sender (managed identity needs Mail.Send permission for it)")] [ValidateNotNullOrEmpty()] [string]$SenderUPN, # Threshold for marking requests as urgent [Parameter(Mandatory = $false, HelpMessage = "Hours before marking a request as urgent")] [ValidateRange(1, 168)] [int]$UrgentThresholdHours = 24, # Threshold for escalation alerts [Parameter(Mandatory = $false, HelpMessage = "Hours before sending escalation alerts")] [ValidateRange(1, 720)] [int]$EscalationThresholdHours = 72, # Include approved/rejected requests in summary [Parameter(Mandatory = $false, HelpMessage = "Include recently processed requests in notification")] [ValidateSet("true", "false", "1", "0", '$true', '$false')] [string]$IncludeProcessedRequests, # Force notification even if no new requests [Parameter(Mandatory = $false, HelpMessage = "Send notification even if no new pending requests")] [ValidateSet("true", "false", "1", "0", '$true', '$false')] [string]$ForceNotification, # Force module installation without prompting [Parameter(Mandatory = $false, HelpMessage = "Force module installation without prompting")] [ValidateSet("true", "false", "1", "0", '$true', '$false')] [string]$ForceModuleInstall ) # Normalize the local module-install override for Azure Automation parameter binding. $forceModuleInstallRaw = [string]$ForceModuleInstall Remove-Variable -Name ForceModuleInstall if ([string]::IsNullOrWhiteSpace($forceModuleInstallRaw)) { $ForceModuleInstall = $false } elseif ($forceModuleInstallRaw.Trim().ToLowerInvariant() -in @("true", "1", '$true')) { $ForceModuleInstall = $true } elseif ($forceModuleInstallRaw.Trim().ToLowerInvariant() -in @("false", "0", '$false')) { $ForceModuleInstall = $false } else { throw "Parameter 'ForceModuleInstall' accepts only true, false, 1, 0, $true, or $false." } # Azure Automation supplies portal parameter values as strings. Normalize the # public boolean parameters once so local and runbook execution use real booleans. foreach ($runbookBooleanParameter in @('IncludeProcessedRequests', 'ForceNotification')) { $runbookBooleanRaw = [string](Get-Variable -Name $runbookBooleanParameter -ValueOnly) Remove-Variable -Name $runbookBooleanParameter if ([string]::IsNullOrWhiteSpace($runbookBooleanRaw)) { Set-Variable -Name $runbookBooleanParameter -Value $false continue } switch ($runbookBooleanRaw.Trim().ToLowerInvariant()) { { $_ -in @("true", "1", '$true') } { Set-Variable -Name $runbookBooleanParameter -Value $true } { $_ -in @("false", "0", '$false') } { Set-Variable -Name $runbookBooleanParameter -Value $false } default { throw "Parameter '$runbookBooleanParameter' accepts only true, false, 1, 0, $true, or $false." } } } # ============================================================================ # ENVIRONMENT DETECTION AND SETUP # ============================================================================ function Initialize-RequiredModule { param( [string[]]$ModuleNames, [bool]$IsAutomationEnvironment, [bool]$ForceInstall = $false ) foreach ($ModuleName in $ModuleNames) { Write-Verbose "Checking module: $ModuleName" # Check if module is already loaded $loadedModule = Get-Module -Name $ModuleName if ($loadedModule) { Write-Verbose "Module '$ModuleName' is already loaded (version $($loadedModule.Version))" continue } # Check if module is available $module = Get-Module -ListAvailable -Name $ModuleName | Select-Object -First 1 if (-not $module) { if ($IsAutomationEnvironment) { $errorMessage = @" Module '$ModuleName' is not available in this Azure Automation Account. Please install it from the Browse Gallery in the Azure portal. Required modules: $($ModuleNames -join ', ') "@ Write-Error $errorMessage throw "Required module not found: $ModuleName" } else { Write-Information "Module '$ModuleName' not found. Installing..." -InformationAction Continue if (-not $ForceInstall) { $response = Read-Host "Module '$ModuleName' is required but not installed. Install it now? (Y/N)" if ($response -ne 'Y' -and $response -ne 'y') { Write-Error "Module installation cancelled. Cannot proceed without required module." exit 1 } } try { Write-Information "Installing module: $ModuleName" -InformationAction Continue Install-Module -Name $ModuleName -Scope CurrentUser -Force -AllowClobber -ErrorAction Stop Write-Information "✓ Successfully installed module: $ModuleName" -InformationAction Continue # Refresh available modules $module = Get-Module -ListAvailable -Name $ModuleName | Select-Object -First 1 } catch { Write-Error "Failed to install module '$ModuleName': $($_.Exception.Message)" Write-Error "Please install manually: Install-Module -Name $ModuleName -Scope CurrentUser" exit 1 } } } # Import module only if not already loaded if (-not (Get-Module -Name $ModuleName)) { try { Import-Module $ModuleName -ErrorAction Stop Write-Verbose "✓ Successfully imported module: $ModuleName" } catch { # If import fails due to version conflict, try removing and re-importing if ($_.Exception.Message -like "*Assembly with same name is already loaded*") { Write-Warning "Module version conflict detected. Attempting to resolve..." try { Remove-Module $ModuleName -ErrorAction SilentlyContinue Import-Module $ModuleName -ErrorAction Stop Write-Verbose "✓ Successfully resolved and imported module: $ModuleName" } catch { Write-Warning "Could not resolve module conflict for '$ModuleName'. Using existing loaded version." } } else { Write-Error "Failed to import module '$ModuleName': $($_.Exception.Message)" exit 1 } } } } } # ============================================================================ # MODULES AND AUTHENTICATION # ============================================================================ # Check if running in Azure Automation $RunningInAzureAutomation = $null -ne $env:AUTOMATION_ASSET_ACCOUNTID # Required modules $RequiredModules = @( "Microsoft.Graph.Authentication" ) # MgGraphCommunity gives WAM-free interactive sign-in for local runs if (-not $RunningInAzureAutomation) { $RequiredModules += "MgGraphCommunity" } # Initialize required modules Initialize-RequiredModule -ModuleNames $RequiredModules -IsAutomationEnvironment $RunningInAzureAutomation -ForceInstall $ForceModuleInstall # Connect to Microsoft Graph try { Write-Output "Connecting to Microsoft Graph..." if ($RunningInAzureAutomation) { # Use Managed Identity in Azure Automation Connect-MgGraph -Identity -NoWelcome Write-Output "✓ Connected to Microsoft Graph using Managed Identity" } else { # Use interactive authentication for local execution $Scopes = @( "DeviceManagementConfiguration.Read.All", "DeviceManagementApps.Read.All", "DeviceManagementManagedDevices.Read.All", "DeviceManagementRBAC.Read.All", "AuditLog.Read.All", "Mail.Send" ) Connect-MgGraphCommunity -Scopes $Scopes -NoWelcome Write-Output "✓ Connected to Microsoft Graph with interactive authentication" } } catch { Write-Error "Failed to connect to Microsoft Graph: $($_.Exception.Message)" exit 1 } # ============================================================================ # CONFIGURATION # ============================================================================ # Email configuration $EmailConfig = @{ Subject = "[MAA ALERT] Pending Approval Requests Require Action" Priority = "High" } # Portal URLs $IntunePortalBaseUrl = "https://intune.microsoft.com" $MAARequestsUrl = "$IntunePortalBaseUrl/#view/Microsoft_Intune_DeviceSettings/MultiAdminApprovalMenu/~/received" # ============================================================================ # HELPER FUNCTIONS # ============================================================================ # Function to get all pages of results from Graph API function Get-MgGraphAllPage { param( [Parameter(Mandatory = $true)] [string]$Uri, [int]$DelayMs = 100 ) $AllResults = @() $NextLink = $Uri $RequestCount = 0 do { try { if ($RequestCount -gt 0) { Start-Sleep -Milliseconds $DelayMs } $Response = Invoke-MgGraphRequest -Uri $NextLink -Method GET $RequestCount++ if ($null -ne $Response.value) { $AllResults += $Response.value } else { $AllResults += $Response } $NextLink = $Response.'@odata.nextLink' } catch { if ($_.Exception.Message -like "*429*" -or $_.Exception.Message -like "*throttled*") { Write-Information "Rate limit hit, waiting 60 seconds..." -InformationAction Continue Start-Sleep -Seconds 60 continue } throw "Error fetching data from $NextLink : $($_.Exception.Message)" } } while ($NextLink) # Comma keeps PowerShell from unrolling a single-item array on return return , $AllResults } # Function to get MAA pending requests function Get-MAAPendingRequest { try { Write-Information "Retrieving MAA pending requests..." -InformationAction Continue $PendingRequests = @() # Get all operation approval requests from the correct endpoint try { $Uri = "https://graph.microsoft.com/beta/deviceManagement/operationApprovalRequests" Write-Information "Querying MAA requests from: $Uri" -InformationAction Continue $AllRequests = Get-MgGraphAllPage -Uri $Uri -DelayMs 200 foreach ($Request in $AllRequests) { # Check if request is pending (status = 0 or status field indicates pending) # MAA request statuses: 0 = Pending, 1 = Approved, 2 = Rejected, 3 = Cancelled, 4 = Completed if ($Request.status -eq 0 -or $Request.status -eq "pending" -or $Request.status -eq "needsApproval") { # Calculate age and expiry $RequestDateTime = if ($Request.requestDateTime) { [DateTime]$Request.requestDateTime } elseif ($Request.createdDateTime) { [DateTime]$Request.createdDateTime } else { [DateTime]::Now } $AgeInHours = [Math]::Round(((Get-Date) - $RequestDateTime).TotalHours, 1) # Use the real expirationDateTime from the request (MAA requests expire after 3 days) $DaysUntilExpiry = if ($Request.expirationDateTime) { $RemainingDays = [Math]::Round((([DateTime]$Request.expirationDateTime) - (Get-Date)).TotalDays, 1) if ($RemainingDays -lt 0) { "Expired" } else { $RemainingDays } } else { "Unknown" } # Get requester information (requestor is an identitySet; no userPrincipalName is exposed) $RequesterName = if ($Request.requestor.user.displayName) { $Request.requestor.user.displayName } else { "Unknown" } # Get resource information from the required approval policy types $PolicyTypes = if ($Request.requiredOperationApprovalPolicyTypes) { ($Request.requiredOperationApprovalPolicyTypes -join ", ") } else { $null } $ResourceName = if ($PolicyTypes) { "Approval required: $PolicyTypes" } else { "Unknown Operation" } $ResourceType = if ($PolicyTypes) { $PolicyTypes } else { "Unknown" } $PendingRequest = [PSCustomObject]@{ Id = $Request.id RequestTime = $RequestDateTime RequestedBy = $RequesterName RequestedByName = $RequesterName ResourceType = $ResourceType ResourceName = $ResourceName BusinessJustification = if ($Request.requestJustification) { $Request.requestJustification } else { "No justification provided" } Status = "Pending" AgeInHours = $AgeInHours DaysUntilExpiry = $DaysUntilExpiry ApprovalPolicy = if ($PolicyTypes) { $PolicyTypes } else { "N/A" } } $PendingRequests += $PendingRequest } } Write-Information "✓ Found $($PendingRequests.Count) pending MAA requests" -InformationAction Continue } catch { Write-Warning "Could not retrieve MAA requests: $($_.Exception.Message)" # Fallback: Try to get from audit logs try { Write-Information "Attempting fallback to audit logs..." -InformationAction Continue $StartDate = (Get-Date).AddDays(-30).ToString("yyyy-MM-dd") $Filter = "activityDateTime ge $StartDate" $AuditLogs = Get-MgGraphAllPage -Uri "https://graph.microsoft.com/beta/auditLogs/directoryAudits?`$filter=$Filter&`$top=100" foreach ($Log in $AuditLogs) { # Look for multi-admin approval related activities if ($Log.activityDisplayName -like "*Multi*Admin*" -or $Log.activityDisplayName -like "*Approval*Request*" -or $Log.category -eq "Policy" -and $Log.result -eq "pending") { $PendingRequest = [PSCustomObject]@{ Id = $Log.id RequestTime = [DateTime]$Log.activityDateTime RequestedBy = if ($Log.initiatedBy.user.userPrincipalName) { $Log.initiatedBy.user.userPrincipalName } else { "Unknown" } RequestedByName = if ($Log.initiatedBy.user.displayName) { $Log.initiatedBy.user.displayName } else { "Unknown" } ResourceType = if ($Log.targetResources[0].type) { $Log.targetResources[0].type } else { "Policy" } ResourceName = if ($Log.targetResources[0].displayName) { $Log.targetResources[0].displayName } else { $Log.activityDisplayName } BusinessJustification = "See audit log for details" Status = "Pending" AgeInHours = [Math]::Round(((Get-Date) - [DateTime]$Log.activityDateTime).TotalHours, 1) DaysUntilExpiry = "Unknown" ApprovalPolicy = "N/A" } $PendingRequests += $PendingRequest } } } catch { Write-Warning "Fallback to audit logs also failed: $($_.Exception.Message)" } } # Get operation approval policies for additional context if needed try { $PoliciesUri = "https://graph.microsoft.com/beta/deviceManagement/operationApprovalPolicies" Write-Information "Retrieving MAA policies from: $PoliciesUri" -InformationAction Continue $Policies = Get-MgGraphAllPage -Uri $PoliciesUri -DelayMs 200 # Add policy information to requests if available (match on policyType, requests expose no policy id) foreach ($Request in $PendingRequests) { if ($Request.ApprovalPolicy -ne "N/A") { $Policy = $Policies | Where-Object { $_.policyType -and $Request.ApprovalPolicy -like "*$($_.policyType)*" } | Select-Object -First 1 if ($Policy) { $Request | Add-Member -NotePropertyName "PolicyName" -NotePropertyValue $Policy.displayName -Force } } } } catch { Write-Information "Could not retrieve MAA policies (non-critical): $($_.Exception.Message)" -InformationAction Continue } return $PendingRequests } catch { Write-Error "Failed to retrieve MAA pending requests: $($_.Exception.Message)" return @() } } # Function to get recently processed requests function Get-ProcessedRequest { param( [int]$HoursBack = 24 ) try { Write-Information "Retrieving recently processed MAA requests..." -InformationAction Continue $ProcessedRequests = @() $StartDate = (Get-Date).AddHours(-$HoursBack).ToString("yyyy-MM-ddTHH:mm:ssZ") $Filter = "activityDateTime ge $StartDate and category eq 'Policy' and (result eq 'success' or result eq 'failure')" $AuditLogs = Get-MgGraphAllPage -Uri "https://graph.microsoft.com/beta/auditLogs/directoryAudits?`$filter=$Filter&`$orderby=activityDateTime desc" foreach ($Log in $AuditLogs) { if ($Log.activityDisplayName -like "*approval*") { $Request = [PSCustomObject]@{ Id = $Log.id ProcessedTime = [DateTime]$Log.activityDateTime RequestedBy = $Log.initiatedBy.user.userPrincipalName ApprovedBy = $Log.targetResources[0].userPrincipalName ResourceName = $Log.targetResources[0].displayName Result = if ($Log.result -eq "success") { "Approved" } else { "Rejected" } ApproverNotes = $Log.additionalDetails | Where-Object { $_.key -eq "approverNotes" } | Select-Object -ExpandProperty value } $ProcessedRequests += $Request } } return $ProcessedRequests } catch { Write-Warning "Failed to retrieve processed requests: $($_.Exception.Message)" return @() } } # Function to get stored notification state function Get-NotificationState { if ($RunningInAzureAutomation) { try { $State = Get-AutomationVariable -Name "MAANotificationState" -ErrorAction SilentlyContinue if ([string]::IsNullOrWhiteSpace([string]$State)) { return @{ NotifiedRequests = @(); LastRun = (Get-Date).ToString() } } return $State | ConvertFrom-Json } catch { return @{ NotifiedRequests = @(); LastRun = (Get-Date).ToString() } } } else { # For local testing, use a temp file $StateFile = "$env:TEMP\maa-notification-state.json" if (Test-Path $StateFile) { return Get-Content $StateFile | ConvertFrom-Json } return @{ NotifiedRequests = @(); LastRun = (Get-Date).ToString() } } } # Function to save notification state function Set-NotificationState { param($State) if ($RunningInAzureAutomation) { try { Set-AutomationVariable -Name "MAANotificationState" -Value ($State | ConvertTo-Json -Compress) } catch { Write-Warning "Could not save notification state: $($_.Exception.Message)" } } else { # For local testing, use a temp file $StateFile = "$env:TEMP\maa-notification-state.json" $State | ConvertTo-Json | Set-Content $StateFile } } # Function to create HTML email body function New-EmailBody { param( [array]$PendingRequests, [array]$ProcessedRequests, [hashtable]$Summary ) $UrgentColor = "#dc3545" $WarningColor = "#ffc107" $NormalColor = "#28a745" $EmailBody = @" MAA Pending Requests Alert

🔔 Multi-Admin Approval Alert

Pending requests require your immediate attention

Pending Requests

$($Summary.TotalPending)
Awaiting Approval

Urgent Requests

$($Summary.UrgentCount)
> $UrgentThresholdHours hours old

Escalated

$($Summary.EscalatedCount)
> $EscalationThresholdHours hours old

Expiring Soon

$($Summary.ExpiringSoon)
< 7 days remaining
"@ # Add pending requests section if ($PendingRequests.Count -gt 0) { $EmailBody += @"

⏳ Pending Approval Requests

"@ foreach ($Request in $PendingRequests | Sort-Object -Property AgeInHours -Descending) { $AgeClass = if ($Request.AgeInHours -gt $EscalationThresholdHours) { "urgent" } elseif ($Request.AgeInHours -gt $UrgentThresholdHours) { "warning" } else { "normal" } $AgeLabel = if ($Request.AgeInHours -gt $EscalationThresholdHours) { "age-urgent" } elseif ($Request.AgeInHours -gt $UrgentThresholdHours) { "age-warning" } else { "age-normal" } $EmailBody += @"
$($Request.ResourceName)
$($Request.AgeInHours) hours old
Resource Type: $($Request.ResourceType)
Requested By: $($Request.RequestedByName) ($($Request.RequestedBy))
Request Time: $($Request.RequestTime.ToString("yyyy-MM-dd HH:mm:ss"))
Days Until Expiry: $($Request.DaysUntilExpiry) days "@ if ($Request.BusinessJustification) { $EmailBody += @"
Business Justification:
$($Request.BusinessJustification)
"@ } if ($Request.DaysUntilExpiry -is [double] -and $Request.DaysUntilExpiry -lt 7) { $EmailBody += @"
⚠️ This request will expire in $($Request.DaysUntilExpiry) days
"@ } $EmailBody += @"
"@ } $EmailBody += @" Review Pending Requests in Intune Portal
"@ } else { $EmailBody += @"

✅ No Pending Requests

There are currently no MAA requests awaiting approval.

"@ } # Add processed requests section if requested if ($IncludeProcessedRequests -and $ProcessedRequests.Count -gt 0) { $EmailBody += @"

📋 Recently Processed Requests (Last 24 Hours)

"@ foreach ($Request in $ProcessedRequests | Sort-Object -Property ProcessedTime -Descending) { $StatusClass = if ($Request.Result -eq "Approved") { "approved" } else { "rejected" } $EmailBody += @"
$($Request.ResourceName)
Requested by: $($Request.RequestedBy) | Processed: $($Request.ProcessedTime.ToString("yyyy-MM-dd HH:mm"))
$($Request.Result)
"@ } $EmailBody += @"
"@ } # Add recommendations $EmailBody += @"

📋 Recommended Actions

  • Review all pending requests promptly to maintain security compliance
  • Urgent requests (red) should be reviewed immediately
  • Verify business justifications align with organizational policies
  • Consider the security implications before approving changes
  • Document any concerns or questions in the approver notes
  • Requests expire after 3 days and will need to be resubmitted
Report generated: $(Get-Date -Format "yyyy-MM-dd HH:mm:ss UTC")
This is an automated notification from your Intune MAA monitoring system.
For questions about specific requests, contact the requester directly.
Access MAA Portal
"@ return $EmailBody } # Function to send email notification function Send-EmailNotification { param( [Parameter(Mandatory = $true)] [string]$Body, [Parameter(Mandatory = $true)] [array]$Recipients, [Parameter(Mandatory = $true)] [string]$Subject ) try { Write-Information "Preparing email notification..." -InformationAction Continue # Prepare recipients array $ToRecipients = @() foreach ($Recipient in $Recipients) { $ToRecipients += @{ emailAddress = @{ address = $Recipient.Trim() } } } # Prepare email message $Message = @{ subject = $Subject body = @{ contentType = "HTML" content = $Body } toRecipients = $ToRecipients importance = $EmailConfig.Priority.ToLower() } # Send email using Microsoft Graph $RequestBody = @{ message = $Message saveToSentItems = $false } | ConvertTo-Json -Depth 10 $Uri = "https://graph.microsoft.com/beta/users/$SenderUPN/sendMail" Invoke-MgGraphRequest -Uri $Uri -Method POST -Body $RequestBody -ContentType "application/json" Write-Information "✓ Email notification sent successfully to: $($Recipients -join ', ')" -InformationAction Continue return $true } catch { Write-Error "Failed to send email notification: $($_.Exception.Message)" return $false } } # ============================================================================ # MAIN SCRIPT LOGIC # ============================================================================ try { Write-Output "Starting MAA Pending Requests Monitor..." Write-Output "Urgent Threshold: $UrgentThresholdHours hours" Write-Output "Escalation Threshold: $EscalationThresholdHours hours" Write-Output "Email Recipients: $EmailRecipients" # Get notification state $NotificationState = Get-NotificationState # Step 1: Get pending MAA requests $PendingRequests = Get-MAAPendingRequest # Step 2: Get recently processed requests if requested $ProcessedRequests = @() if ($IncludeProcessedRequests) { $ProcessedRequests = Get-ProcessedRequest -HoursBack 24 } # Step 3: Analyze requests $Summary = @{ TotalPending = $PendingRequests.Count UrgentCount = ($PendingRequests | Where-Object { $_.AgeInHours -gt $UrgentThresholdHours -and $_.AgeInHours -le $EscalationThresholdHours }).Count EscalatedCount = ($PendingRequests | Where-Object { $_.AgeInHours -gt $EscalationThresholdHours }).Count ExpiringSoon = ($PendingRequests | Where-Object { $_.DaysUntilExpiry -is [double] -and $_.DaysUntilExpiry -lt 7 }).Count ProcessedCount = $ProcessedRequests.Count } Write-Output "Analysis complete: $($Summary.TotalPending) pending, $($Summary.UrgentCount) urgent, $($Summary.EscalatedCount) escalated" # Step 4: Determine if notification should be sent $NewRequests = @() $NotifiedIds = $NotificationState.NotifiedRequests foreach ($Request in $PendingRequests) { if ($Request.Id -notin $NotifiedIds) { $NewRequests += $Request } } $ShouldSendNotification = $false $NotificationReason = "" if ($NewRequests.Count -gt 0) { $ShouldSendNotification = $true $NotificationReason = "New requests detected" } elseif ($Summary.EscalatedCount -gt 0) { $ShouldSendNotification = $true $NotificationReason = "Escalated requests require attention" } elseif ($Summary.ExpiringSoon -gt 0) { $ShouldSendNotification = $true $NotificationReason = "Requests expiring soon" } elseif ($ForceNotification) { $ShouldSendNotification = $true $NotificationReason = "Forced notification" } if (-not $ShouldSendNotification) { Write-Output "✓ No notification needed. No new or urgent requests." exit 0 } # Step 5: Create and send email notification Write-Output "Sending notification: $NotificationReason" # Prepare email subject $AlertLevel = if ($Summary.EscalatedCount -gt 0) { "ESCALATED" } elseif ($Summary.UrgentCount -gt 0) { "URGENT" } else { "ACTION REQUIRED" } $Subject = "[$AlertLevel] MAA - $($Summary.TotalPending) Pending Approval Requests" if ($Summary.EscalatedCount -gt 0) { $Subject += " - $($Summary.EscalatedCount) ESCALATED" } # Generate email body $EmailBody = New-EmailBody -PendingRequests $PendingRequests -ProcessedRequests $ProcessedRequests -Summary $Summary # Parse email recipients $Recipients = $EmailRecipients -split ',' | ForEach-Object { $_.Trim() } # Send email notification $EmailSent = Send-EmailNotification -Body $EmailBody -Recipients $Recipients -Subject $Subject if ($EmailSent) { Write-Output "✓ Notification sent successfully" # Update notification state $NotificationState.NotifiedRequests = $PendingRequests.Id $NotificationState.LastRun = (Get-Date).ToString() $NotificationState.LastNotification = (Get-Date).ToString() Set-NotificationState -State $NotificationState } else { Write-Error "Failed to send email notification" exit 1 } Write-Output "✓ MAA Pending Requests Monitor completed successfully" } catch { Write-Error "Script execution failed: $($_.Exception.Message)" Write-Error "Stack trace: $($_.ScriptStackTrace)" exit 1 } finally { # Cleanup operations try { Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null Write-Output "Disconnected from Microsoft Graph" } catch { # Ignore disconnect errors } } # ============================================================================ # SCRIPT SUMMARY # ============================================================================ Write-Output " ======================================== MAA Monitoring Summary ======================================== Total Pending Requests: $($Summary.TotalPending) Urgent Requests: $($Summary.UrgentCount) Escalated Requests: $($Summary.EscalatedCount) Expiring Soon: $($Summary.ExpiringSoon) Processed (24h): $($Summary.ProcessedCount) Notification Sent: $(if ($ShouldSendNotification) { 'Yes' } else { 'No' }) Recipients: $EmailRecipients ======================================== " # Copia sin cambios de https://github.com/ugurkocde/IntuneAutomation (commit 797bb2e). # MIT License # # Copyright (c) 2025 Ugur Koc | Microsoft MVP # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in all # copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE # SOFTWARE.