Get-IntuneConfigProfileAssignmentReport

<#
.SYNOPSIS
    Reports assignment groups for all Intune configuration profiles.

.DESCRIPTION
    Lists every device configuration profile and resolves the group
    names it is assigned to, so gaps between what you believe is
    deployed and what is actually assigned become visible in one report.

.EXAMPLE
    .\Get-IntuneConfigProfileAssignmentReport.ps1

.NOTES
    Requires Microsoft.Graph.DeviceManagement and Microsoft.Graph.Groups
    with an active Connect-MgGraph session.

.AUTHOR
    Shehryar Hassan
#>

$profiles = Get-MgDeviceManagementDeviceConfiguration -All

$report = foreach ($profile in $profiles) {
    $assignments = Get-MgDeviceManagementDeviceConfigurationAssignment -DeviceConfigurationId $profile.Id
    $groupNames = foreach ($a in $assignments) {
        if ($a.Target.AdditionalProperties.groupId) {
            (Get-MgGroup -GroupId $a.Target.AdditionalProperties.groupId).DisplayName
        } else {
            $a.Target.AdditionalProperties.'@odata.type' -replace '#microsoft.graph.', ''
        }
    }
    [pscustomobject]@{
        ProfileName = $profile.DisplayName
        AssignedTo  = ($groupNames -join ", ")
        Unassigned  = $assignments.Count -eq 0
    }
}

$report | Format-Table -AutoSize
$report | Where-Object Unassigned | ForEach-Object { Write-Warning "$($_.ProfileName) has no assignment." }