Intune & Autopilot: Bulk Changing Autopilot Tags in Intune

This article’s intended audience is University IT technicians who have been provisioned access to UConn’s Microsoft Intune Admin Center.

This guide shows how to retag any number of existing Autopilot devices—e.g. moving classroom laptops from mwManagedWorkstation to mwCLASin one PowerShell run.

1 Prerequisites

Requirement	Notes

Requirement	Notes
PowerShell 5.1 or 7+	Built-in on Windows 10/11; PowerShell 7 from the Store
Graph permission	Tier 1 or 2 Intune acces
Module	Microsoft.Graph.DeviceManagement.Enrollment – installed automatically by the script
Serial-number file	CSV headed `SerialNumber`

💡 Tip – You only need to run this process when devices are already in Autopilot and just need a new tag; newly imported devices can receive the correct tag during upload.

2 Download & Edit the Script

Copy the block below into Notepad and save it as
Set-AutopilotGroupTag.ps1.
Edit only the two lines highlighted at the top:
- $CsvPath → full path to your serial-number file.
- $GroupTag → the tag you want every listed device to receive.

# ========= EDIT THESE TWO VALUES =================================
$CsvPath  = "C:\csvlocation\file.csv"    # ← your file
$GroupTag = 'mwCLAS'               # ← target groupTag
# =================================================================

# Ensure the correct Graph module exists
if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.DeviceManagement.Enrollment)) {
    Write-Host 'Installing Microsoft.Graph.DeviceManagement.Enrollment...'
    Install-Module Microsoft.Graph.DeviceManagement.Enrollment -Scope CurrentUser -Force
}
Import-Module Microsoft.Graph.DeviceManagement.Enrollment

Write-Host 'Connecting to Microsoft Graph...'
Connect-MgGraph                                 # interactive sign-in

# ----- read serials ------------------------------------------------
if (-not (Test-Path $CsvPath)) { throw "File not found: $CsvPath" }
$first = (Get-Content $CsvPath -First 1).Trim()
$Serials = if ($first -eq 'SerialNumber') {
              (Import-Csv $CsvPath).SerialNumber
           } else { Get-Content $CsvPath }

if (-not $Serials) { throw 'No serial numbers found in file.' }

# ----- loop & update ----------------------------------------------
$OK = 0; $Fail = 0
foreach ($s in $Serials) {
    $s = $s.Trim(); if (-not $s) { continue }

    $d = Get-MgDeviceManagementWindowsAutopilotDeviceIdentity `
            -Filter "contains(serialNumber,'$s')" -All |
         Where-Object { $_.serialNumber -eq $s }

    if (-not $d) { Write-Warning "[$s] not found"; $Fail++; continue }

    try {
        Update-MgDeviceManagementWindowsAutopilotDeviceIdentityDeviceProperty `
            -WindowsAutopilotDeviceIdentityId $d.Id `
            -GroupTag $GroupTag
        Write-Host "[$s] groupTag set to '$GroupTag'"
        $OK++
    } catch {
        Write-Warning "[$s] $($_.Exception.Message)"; $Fail++
    }
}

Write-Host "`nFinished - Success: $OK   Failed: $Fail"
Disconnect-MgGraph

3 Create the Serial-Number File

3.1 CSV (Excel friendly)

`SerialNumber 180X4Q3 CX9X291`

`SerialNumber 180X4Q3 CX9X291`

4 Run the Script

Open PowerShell as Administrator.
Navigate to the folder with the script:
cd C:\Path\To\Script
Execute:
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass .\Set-AutopilotGroupTag.ps1
Sign in when the browser window appears.

Example output:

[120XN92] groupTag set to 'MyTargetGroup'
Finished — Success: 27   Failed: 0

5 Verify in Intune

Portal path: Devices ▸ Windows ▸ Windows enrollment ▸ Devices

6 Reference Tag Values

Department/Area	Group Tag

Department/Area	Group Tag
Business	mwBUSN
CLAS	mwCLAS
Education	mwEDU
Engineering	mwENGR
Marine Sciences	mwManagedWorkstation
OVPR	mwOVPR
SAIT	mwSA
UConn Library	mwLibrary
UConn Law	mwLAW
ITS TSC Loaner	TSCLoaner
ITS Managed Workstation	MWManagedWorkstation
ITS Classrooms	MWClassrooms
ITS Labs	MWLabs
ITS Conference Rooms	MWConference

7 Troubleshooting

Symptom	Cause	Fix

Symptom	Cause	Fix
File not found	`$CsvPath` incorrect	Check full path and quotes
✖ not found	Serial isn’t in Autopilot	Import device or correct typo
403 / Forbidden	Missing permission	Contact ITS
Module install fails	NuGet provider missing	`Install-PackageProvider -Name NuGet -Force`

8 Revision History

Date	Rev	Notes

Date	Rev	Notes
23 Jul 2025	1.0	Initial publication