A collection of PowerShell scripts for automating Microsoft Intune device management tasks.
Quick Start • Scripts • Prerequisites • Contributing • Website
This repository contains PowerShell scripts designed to help IT administrators automate common Microsoft Intune management operations. All scripts use the Microsoft Graph API and are organized by functional category for easy discovery and use.
- 📱 Device Management: Automated device operations and lifecycle management
- 🔒 Security & Compliance: Automated compliance reporting and security operations
- 📦 Application Management: Streamlined app deployment and management
- 📊 Monitoring & Reporting: Comprehensive monitoring and analytics tools
- ☁️ Azure Integration: Native support for Azure Automation runbooks
- 🔐 Security-First: Built with enterprise security best practices
The simplest way to use these scripts is to download and run them locally:
- 📥 Download the scripts you need from this repository
- 📦 Install required modules (the scripts will prompt you if needed)
▶️ Run the scripts directly from PowerShell with appropriate parameters- 📋 Review the output and logs for results
Most scripts are designed to work immediately without additional setup beyond the required PowerShell modules.
Example:
# Download a script and run it
.\Get-DeviceComplianceReport.ps1 -TenantId "your-tenant-id"For scheduling, unattended execution, or more complex automation, you can deploy these scripts as Azure Automation Runbooks:
Create a User Assigned Managed Identity in your Azure tenant through the Azure Portal.
Use our setup script to grant necessary Microsoft Graph permissions:
# Grant default Intune permissions to your managed identity
.\grant-permissions-managed-identity.ps1 -ManagedIdentityDisplayName "YourManagedIdentityName"
# Or grant custom permissions for specific use cases
.\grant-permissions-managed-identity.ps1 -ManagedIdentityDisplayName "YourManagedIdentityName" -CustomPermissions @("User.Read.All", "Group.Read.All")- Assign the managed identity to your Azure Automation Account
- Import the scripts as runbooks
- Schedule execution as needed
This approach enables:
- ⏰ Scheduled execution (daily, weekly, etc.)
- 🤖 Unattended operations without user interaction
- 📈 Centralized logging and monitoring
- 🔗 Integration with other Azure services
The grant-permissions-managed-identity.ps1 script grants these Microsoft Graph API permissions by default:
| Permission | Description |
|---|---|
DeviceManagementManagedDevices.ReadWrite.All |
Full device management access |
DeviceManagementConfiguration.ReadWrite.All |
Configuration policy management |
DeviceManagementApps.ReadWrite.All |
Application management |
Device
8000
ManagementServiceConfig.ReadWrite.All |
Service configuration |
DeviceManagementRBAC.ReadWrite.All |
Role-based access control |
DeviceManagementManagedDevices.PrivilegedOperations.All |
Advanced device operations |
These permissions cover most common Intune automation scenarios.
IntuneAutomation/
├── 🔧 grant-permissions-managed-identity.ps1 # Setup script for managed identity permissions
├── 📂 scripts/
│ ├── 🔄 operational/ # Device operations (restart, wipe, sync)
│ ├── 📱 apps/ # Application management and deployment
│ ├── ✅ compliance/ # Compliance reporting and remediation
│ ├── 🔒 security/ # Security operations and policies
│ ├── 💻 devices/ # Device management and inventory
│ └── 📊 monitoring/ # Monitoring, reporting, and analytics
├── 📄 templates/ # Script templates for contributors
├── 📋 LICENSE
├── 🤝 CONTRIBUTING.md
└── 📖 README.md
- Device Operations: Bulk device actions, automated device cleanup
- Compliance Reporting: Automated compliance dashboards and alerts
- App Management: Silent app deployment and update automation
- Security Monitoring: Threat detection and response automation
💡 Tip: Each script category includes detailed documentation and usage examples.
- PowerShell 5.1 or later (PowerShell 7+ recommended)
- Microsoft Graph PowerShell modules:
Microsoft.Graph.Authentication
- You have to sign in with an Intune Admin account
- Azure Automation Account
- User Assigned Managed Identity with the following permissions:
DeviceManagementManagedDevices.ReadWrite.AllDeviceManagementConfiguration.ReadWrite.AllDeviceManagementApps.ReadWrite.AllDeviceManagementServiceConfig.ReadWrite.AllDeviceManagementRBAC.ReadWrite.AllDeviceManagementManagedDevices.PrivilegedOperations.All
💡 Tip: Check
grant-permissions-managed-identity.ps1for more details and how to grant the permissions
- Your Environment in the Azure Automation Account has to have the following modules installed:
Az.AccountsAz.ResourcesMicrosoft.Graph.ApplicationsMicrosoft.Graph.Authentication
- Interactive Authentication (default for local execution)
- Managed Identity (recommended for Azure Automation)
We welcome contributions from the community! Whether you're fixing bugs, improving existing scripts, or adding new automation tools, your contributions help IT professionals worldwide.
- 🍴 Fork the repository and clone it locally
- 📝 Use our script template: Copy
templates/script-template.ps1to get started - 📏 Follow our guidelines: Read CONTRIBUTING.md for detailed instructions
- 🧪 Test thoroughly: Always test your scripts in a lab environment first
- 🔄 Submit a pull request: Use our PR template for faster reviews
See our Contributing Guide for detailed instructions, coding standards, and submission guidelines.
Q: I have an Idea for a new script but I need someone to implement it? A: Open an issue and let me know. I'll be happy to implement it.
Q: Scripts fail with authentication errors A: Ensure you have the required Microsoft Graph permissions and modules installed.
Q: Can I use these scripts with GCC High/DoD tenants? A: Yes, but you may need to modify the Graph API endpoints for government clouds.
Q: Are these scripts suitable for production use? A: Yes, but always test in a lab environment first and follow your organization's change management processes.
- 📖 Check the documentation
- 🐛 Report issues on GitHub Issues
- 💬 Join discussions on GitHub Discussions
This project is licensed under the MIT License - see the LICENSE file for details.
Ugur Koc - Microsoft MVP
- 🌐 Website: https://ugurkoc.de
- 🐦 X: @ugurkocde
- 💼 LinkedIn: Ugur Koc
⭐ If this project helps you, please give it a star! ⭐