MEM Monitoring: Get your Windows Autopilot deployment events in a Teams channel with Logic Apps – Part 2

A couple of weeks ago I wrote this article to describe how it is possible to get your Windows Autopilot deployments events in a Teams channel with Logic Apps. I described the basic actions which are needed to post the events in a Teams channel on a recurring schedule.

After reviewing the messages in Teams, I missed some information about the devices which I couldn’t grab directly from the deployment events themselves; manufacturer and device model. And besides that, I got some questions about how to post the Group TAG in the messages. Information that is also missing from the events.

This information can be easily requested by using an extra HTTP action, to query MS Graph for the Windows Autopilot Device Identities.

And when we do have the Group TAG, we could use this to split up the messages and deliver the messages to the Teams channel of the local IT department instead of our own Teams channel (or we deliver them to both). This possibility of course depends on how the Group TAGs are used in our environment. In my example, I can split up the message from the Dutch and Belgium devices, as I use a country code in the group TAGs. You might think of a filter mechanism yourself, based on another value we get from one of the Graph queries.

This blog post is part of the MEM (Intune) Monitoring series. An article with a short explanation of every MEM Monitoring flow I shared and links to the related articles can be found here.

Let’s see how we can expand the Logic App, which we created in the previous article.

Add an extra HTTP GET action to the flow

If you followed part 1 of this post, you probably have created a Logic App like below.

The HTTP GET action provides us in the response body the serial number. With that serial number, we are able to query with a second HTTP GET query for the Windows Autopilot Device Identities. The response of that query contains manufacturer, device model, and Group TAG.

This is the query which we will use in a new HTTP action.

https://graph.microsoft.com/beta/deviceManagement/windowsAutopilotDeviceIdentities?$filter=((contains(serialnumber,'[SERIALNR]')))

This is the response when using the query in Graph Explorer.

Time to add the extra action.

Sign-in to the Azure portal and open the previously created Logic App.

Add the new HTTP action before the HTTP Post action.

As Method select GET.
As URI enter:

https://graph.microsoft.com/beta/deviceManagement/windowsAutopilotDeviceIdentities?$filter=((contains(serialnumber,'[SERIALNR]')))

Replace [SERIALNR] with deviceSerialNumber, which you can find as Dynamic content from the first HTTP GET Action.

Check Authentication and choose Active Directory OAuth as Authentication type. Enter the Tenant, Client ID (from the app registration) and Audience.
And make sure to select the Key Vault secret value from the Key Vault action.

Next we add a Parse JSON action to the flow, to parse the output from the HTTP action so we can use that in the upcoming actions.

As content add Dynamic content Body from the new HTTP action.
We can fill the Schema, by using an example payload. This example payload is generated by running this flow or by running the same Graph query as from our HTTP action using Graph Explorer.
Copy the response in Graph Explorer, click Use sample payload to generate the schema, and paste the response in the text box.

Open the HTTP POST action to add the Dynamic content from the new HTTP GET action. In below example I added manufacturer, model and Group TAG. As soon as you add the new manufacturer, model or Group TAG in the body, the HTTP POST action will be placed in another For each action.

This is our flow after we added the new actions.

Deliver messages to local IT Teams channel

To split the Teams messages based on the Group TAG and deliver these to the local IT Teams channel, we add a Switch action to our flow which creates several cases.

After the Parse JSON action, we created in the previous step, we add a Switch action.

In the On box, we add the Dynamic content groupTag.
We can create several cases, for every IT department one case. In the Equals to box we enter our Group TAG.

Under every case, we add a HTTP POST action for the corresponding Teams channel (with there own Incoming webhook URI).

We can also add a HTTP POST action under Default. When the Group TAG doesn’t match one of the TAGs in the cases, the default cases handles the POST action.

And this is the complete new Logic App flow.

If you would like to post the messages to the local IT Teams channel and also post all messages to one central Channel, an extra HTTP POST action can be added to the flow after the switch action.

The end result

I get the deployment event, including the manufacturer, device model and Group TAG, posted in the corresponding Teams channel.

The event with Group TAG ‘BE AADJ’ is posted in the Belgium channel.

And the one witch the NL TAG in the Dutch channel.

Thanks for reading! Please reach out to me with any thought and ideas on this solution, so we can further improve the Logic App.

The complete flow can also be downloaded as an ARM Template from my GitHub repository.