Get-MtMacOSEnrollmentProfile
SYNOPSIS
Retrieves macOS Automated Device Enrollment (ADE) profiles across all Apple enrollment tokens.
SYNTAX
Get-MtMacOSEnrollmentProfile [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
macOS enrollment profiles are not returned by a single flat endpoint. They hang off each Apple Business Manager / Automated Device Enrollment token, so retrieval is a two-hop query: deviceManagement/depOnboardingSettings gives the tokens, then enrollmentProfiles under each token gives the profiles.
This helper performs both hops and returns a normalized object per macOS profile, carrying the local account and password-rotation configuration that macOS LAPS depends on.
The adminAccountPassword property returned by Graph is deliberately never surfaced. Only whether an admin account name is configured is retained, so that no seeded credential can reach a Maester report.
Returns $null when the enrollment tokens could not be read at all, so that callers can report a skip rather than a failure. The populated result is emitted with -NoEnumerate because PowerShell unrolls collections on output: an empty list would otherwise arrive at the caller as $null and be indistinguishable from a read failure. deviceManagement/depOnboardingSettings is gated by Intune RBAC on top of the Graph scope, and returns 403 for accounts without the enrollment programs permission. Invoke-MtGraphRequest surfaces that as a non-terminating error with a null result, which collects as a single empty element. Treating it as "no profiles exist" would report a false security finding for any under-permissioned caller.
Errors are deliberately not caught here. The calling check wraps its logic in try/catch and maps 401/403 to NotAuthorized and anything else to a skip, so swallowing the exception at this level would lose the status code and turn a permission problem into a false security finding.
EXAMPLES
EXAMPLE 1
Get-MtMacOSEnrollmentProfile
Returns the macOS ADE enrollment profiles configured in the tenant.
PARAMETERS
-ProgressAction
Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.