Find out which groups have been assigned apps

[BGSICTSupport]

Hi

Is there a way of exporting/finding out (without clicking them one by one) which app has been assigned to which group etc. I want to keep a record to show certain members of staff.

[bumbletech]

I made a bash script for this a week or so ago when I needed to lookup and update app scopes/VPP with the API:

Never tested it outside of my environment... so, YMMV.

It'll spit out a CSV (separated by semi-colons, so make sure whatever spreadsheet program you're using is looking for that when you open it) that has the Name, BundleID, App's JSS-ID, Device Groups, User Groups, LDAP group limitations and VPP account number ID.

Not the cleanest script or output—commas in names will throw the columns off and all of the groups will appear on one line in each column, but it did what I needed to do in the time I had.

#!/bin/bash

# Created by Josh Bourdon @joshbourdon
# Test on Mac OS X 10.11.5 and JSS 9.93
# This script creates a semi-colon separated CSV to better see App group scoping for Casper
# If you create a new spreadsheet in Google Sheets and import the output of this script
# set your separator character to custom: ";"
# Some apps have commas in their names. They suck.

#edit for your JSS URL
jss_url=https://your.jss.url:8443



### Don't edit below this line
### Unless you really want to
### Who's going to stop you?
### This is all read only stuff so things *shouldn't* blow up

echo "JSS URL is set to $jss_url"

echo "Please enter your username"
read username

echo "Please enter your JSS password (some special characters may fail):"
read -s apipass

#get list of apps from the JSS to get App ids so we can loop through them later
jss_app_ids=`curl -s -k -u "$username":"$apipass" -H "Accept: application/xml" ${jss_url}/JSSResource/mobiledeviceapplications | xpath '//mobile_device_application/id' 2>&1 | awk -F'<id>|</id>' '{print $2}' | tail -n +3 | sort`

echo "looking up apps..."

function writeCSV(){
#create header for CSV
echo "DisplayName;BundleID;jssID;Device Groups;User Groups;User Group Limitations"
for a in $jss_app_ids
do
    id=$a

    #get api data for app
    curl -s -k -u "$username":"$apipass" -H "Accept: application/xml" "${jss_url}/JSSResource/mobiledeviceapplications/id/${id}" > /tmp/app_scope.xml

    md_groups=`cat /tmp/app_scope.xml | xpath '//mobile_device_application/scope/mobile_device_groups/mobile_device_group' 2>&1 | awk -F'<name>|</name>' '{print $2}' | tail -n +3 | sort | tr '
' ' '`
    user_groups=`cat /tmp/app_scope.xml | xpath '//mobile_device_application/scope/jss_user_groups/user_group' 2>&1 | awk -F'<name>|</name>' '{print $2}' | tail -n +3 | sort | tr '
' ' '`
    limit_users=`cat /tmp/app_scope.xml | xpath '//mobile_device_application/scope/limit_to_users/user_groups' 2>&1 | awk -F'<user_group>|</user_group>' '{print $2}' | tail -n +3 | sort | tr '
' ' '`

    dvpp=`cat /tmp/app_scope.xml | xpath '//mobile_device_application/vpp' 2>&1 | awk -F'<vpp_admin_account_id>|</vpp_admin_account_id>' '{print $2}' | tail -n +3 | sort`
    display_name=`cat /tmp/app_scope.xml | xpath '//mobile_device_application/general/display_name' 2>&1 | awk -F'<display_name>|</display_name>' '{print $2}' | tail -n +3 | sort`
    bundle_id=`cat /tmp/app_scope.xml | xpath '//mobile_device_application/general/bundle_id' 2>&1 | awk -F'<bundle_id>|</bundle_id>' '{print $2}' | tail -n +3 | sort`

    #spit the results out in a CSV friendly way
    echo "$display_name;$bundle_id;$id;$md_groups;$user_groups;$limit_users;$dvpp"

done
}


current_time=$(date "+%Y.%m.%d-%H.%M.%S")
writeCSV > ~/Desktop/"JSS_Apps_scope_${current_time}.csv"



echo "all done"
echo "File written to ~/Desktop/JSS_Apps_scope_${current_time}.csv"

[gbyers]

jbourdon I tried your script. Worked perfectly. Thanks

[BGSICTSupport]

Thank you for that. I get some out put but it only seems to show one group rather than all of them? Is this a simple change?

[bumbletech]

@ghowson Right now the groups are separated with a space which isn't the easiest thing to look at. Which group field are you looking at, or is it all of them? What's your JSS version and what version of OS X are you running the script from?

[cdenesha]

@jbourdon love your comments. :) :D

[BGSICTSupport]

Hi

I am revisiting this and have rerun the bash script. In the User group limitations column I am only getting one user group outputted. Is there a change I can make to make it show all of the groups the apps are being scoped to?

[BGSICTSupport]

@jbourdon

[BGSICTSupport · Accepted solution]

I've managed to solve this with a powershell script. (below for anyone that would like it)

Script+UnderlinedText+

$FormatEnumerationLimit = -1

$cred = get-credential

$i = 0

$uri = 'https://CASPERSERVERADDRESS:8443/JSSResource/mobiledeviceapplications/id/'

$devices = @()

Do {$i += 1

Try {

$data = Invoke-restmethod -Method Get -Uri $uri$i -Credential $cred

$a = $data.mobile_device_application.general.display_name $b = $data.mobile_device_application.scope.all_jss_users $c = $data.mobile_device_application.scope.all_mobile_devices $d = $data.mobile_device_application.scope.limit_to_users.user_groups $e = $data.mobile_device_application.scope.exclusions.user_groups $f = $data.mobile_device_application.scope.exclusions.departments

$device = New-Object PsObject -Property @{ DisplayName = $a AllJSSUSers = $b ALLMobileDevices = $c LimitToUsers = (@($d) -Join ",") Exclusions = (@($e) -join ",") }

$device

}

Catch { Write-Host "There was a problem with " $i }

}

while ($i -le 150)

Then I ran the following command to run the script and to save it

.Test.ps1 | Select-Object -Property DisplayName,AllJSSUsers,AllMobileDevices,LimitToUsers,Exclusions | Export-csv .iPadScopedApps2016-11.csv