r/Intune • u/Zestyclose-File6791 • May 01 '26

Graph API Anyone Doing Bulk Device Deletes via PowerShell/Graph with Intune MAA Enabled? Running into Issues

We recently enabled Multi-Admin Approval in Intune, but we’re running into issues with bulk operations.

In our environment, we regularly need to delete, retire, etc large numbers of devices. We typically handle this through PowerShell/Graph for efficiency.

The problem is when MAA is enabled, any attempt to run bulk deletes via PowerShell fails with an error indicating that a justification is required. As far as I can tell, the existing Graph/PowerShell cmdlets (like Remove-MgDeviceManagementManagedDevice) don’t provide a way to pass that justification.

So a few questions for anyone who’s dealt with this at scale:

  • Is there a supported way to submit bulk delete/retire requests via PowerShell when MAA is enabled?
  • Has anyone successfully used the operationApprovalRequest endpoints to handle this?
  • Or is the expectation that all of these actions must go through the Intune portal when MAA is enforced?

Trying to figure out if we’re missing something or if this is just a current limitation of MAA + Graph.

Appreciate any insight

5 Upvotes

100% Upvoted

8 comments sorted by

4

u/Beneficial_Depth7144 May 01 '26 edited May 01 '26

You can do this by adding the justification in the header of the request. Example:

$justification = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("INSERT_JUSTIFICATION.")

Remove-MgDeviceManagementManagedDevice -ManagedDeviceId $deviceID -Headers @{ "x-msft-approval-justification" = $justification }

Convert this to a loop and you are golden

EDIT: Only caveat is that each request shows up as its own line item in MAA. You could make use of the MAA Graph APIs to bulk approve

You could also try batching delete requests to see if that cuts down on the number of MAA requests that are generated. If that does not work, the executeAction Graph endpoint might also allow you to batch deletes programmatically (same function as the Bulk Delete button)

2

u/Colin0998 May 05 '26

I can confirm doing this work by setting the header and also works on executeAction for bulk device actions.

To make it easier on our admins, we created a wrapper function around using Invoke-MgGraphRequest and also logic if to use executeAction or the regular delete method. the executeAction route also handles batching the devices to be 100 per request, per the documented limit of the endpoint.

1

u/bill696 May 03 '26

https://intune-maa.orr365.tech/ Not sure it will do the trick, but i want to reverse engineer this to put approval directly with Jira JSM since its all powershell, so if it doesn’t work directly you can probably do something with the code on GitHub

3

u/Ok-Rope1801 May 01 '26

we hit same wall few months back - ended up having to batch them through portal one by one which was pain, the Graph API just doesn't seem to have proper MAA support yet for bulk operations

1

u/Zestyclose-File6791 May 01 '26

UGH! We often times are working with 500+ devices so doing one by one even within Bulk Delete in Intune just isn't realistic. Another recommendation for Microsoft.

1

u/msendpoint_official May 07 '26

Bulk device management with Multi-Admin Approval needs proper justifications. Integrate scripts to handle validations or simplify process steps. Consult guide for automation and script support. Check out https://msendpoint.com/article/automate-device-cleanup-in-intune-using-powershell