Folders and files
| Name | Name | Last commit date | ||
|---|---|---|---|---|
Collection of practical PowerShell scripts for Microsoft Intune administration and device management.
Driving AI with passion · Microsoft Foundry · Intune · Azure
This repository contains 40+ ready-to-use scripts for Intune administrators covering:
- Device Management -- Change device categories, remove primary users, sync kiosk assignments
- Proactive Remediations -- Disk cleanup, pending reboot detection, taskbar customization, toast notifications
- Reporting & Analytics -- Enrollment reports, app inventory, compliance anomaly detection, Windows 11 readiness
- Autopilot -- Prerequisite checks, ESP detection, deployment wave groups
- Automation -- Azure Automation runbooks for group management, assignment monitoring, filter deployment
- Diagnostics -- IME log analysis (with AI summarization), MDM diagnostic log parsing, speed tests
- UX Customization -- Desktop shortcuts, system tray tools, context menu changes, taskbar alignment
| Folder | Category | Description |
|---|---|---|
| Add-CertificateToTrustedStore/ | Device Config | Deploy certificates to Trusted Publisher store via OMA-URI |
| Change-DeviceCategory/ | Device Mgmt | Assign device categories (single & bulk) |
| Change-ImeLogLevel/ | Diagnostics | Toggle IME log verbosity and restart the service |
| Change-Windows11ContextMenu/ | UX | Revert Windows 11 right-click menu to classic style |
| Check-AutopilotPrerequisites/ | Autopilot | Full network, TPM, OS, and NTP diagnostic for Autopilot |
| Collect-CustomInventory/ | Inventory | Client-side telemetry collection via Azure Function to Log Analytics |
| Copy-DeviceConfigurationProfile/ | Device Config | Duplicate an existing Intune configuration profile |
| Create-AadGroupFromEaScript/ | Automation | Dynamic AAD groups based on Endpoint Analytics script output |
| Create-AssignmentGroupsForNewApps/ | Automation | Auto-create Available/Required/Uninstall groups for new apps |
| Create-DesktopShortcut/ | UX | Deploy/detect/remove website shortcuts on public desktop |
| Create-IntuneSystemtray/ | UX | System tray icon with IT quick-actions (sync, diagnostics, etc.) |
| Create-WaveDeplyomentGroups/ | Automation | Percentage-based wave deployment group distribution |
| Deploy-DefaultFilter/ | Device Config | Create a standard set of Intune assignment filters |
| Get-AllAadGroupAssignments/ | Reporting | List all Intune assignments for a given AAD group |
| Get-AllAssignmentsError/ | Reporting | Export failed config profile & app assignments to CSV |
| Get-AllDeviceAssignments/ | Reporting | Show all assignments targeting a specific device |
| Get-CleanUpDisk/ | Remediation | Detect low disk space and run automated cleanup |
| Get-ConnectedDevices/ | Detection | Detect specific PnP device connections |
| Get-DeviceAppInventory/ | Inventory | Export detected apps per device to Log Analytics or JSON |
| Get-EspDetection/ | Autopilot | Detect whether ESP is currently active (two methods) |
| Get-GraphExportApiReport/ | Reporting | Trigger and download Intune export API reports |
| Get-IMEChange/ | Diagnostics | Monitor IME binary changes with hash baseline and toast alerts |
| Get-IntuneApplicationInstallationAnomaly/ | Analytics | Anomaly detection on app install failures via Azure AI |
| Get-IntuneBlueScreenAnomaly/ | Analytics | Anomaly detection on BSOD rates via Azure AI |
| Get-IntuneComplianceAnomaly/ | Analytics | Anomaly detection on compliance drift via Azure AI |
| Get-IntuneDataScience/ | Analytics | EDA report on managed devices using Pandas + Sweetviz |
| Get-IntuneStatus/ | Reporting | Quick tenant status overview (device counts, sync dates) |
| Get-MdmDiagnostigLogs/ | Diagnostics | Parse MDM diagnostic XML into structured PowerShell objects |
| Get-NewEnrolledDevicesReport/ | Reporting | Email report of devices enrolled in the past 7 days |
| Get-PendingReboot/ | Remediation | Detect pending reboots and show toast notification |
| Get-Top5FailedAppInstallations/ | Reporting | Teams webhook alert for top 5 failing app installs |
| Get-UnassignedAppsAndConfigurations/ | Reporting | Find apps/configs with no assignments |
| Get-Windows11Report/ | Reporting | HTML report with Chart.js pie chart of Win11 adoption |
| Hide-TaskViewWidgetsAndSearch/ | Remediation | Hide Task View, Widgets, and Search from taskbar |
| Ime-LogSummarizer/ | Diagnostics | AI-powered IME log analysis (local & remote, Python) |
| Make-Speedtest/ | Diagnostics | Download speed test with Log Analytics upload |
| ManagementImprovements/ | Tenant Mgmt | 10 housekeeping scripts: stale/duplicate devices, config backup, empty groups, unused filters, BitLocker escrow, app success rate, unassigned scripts, tenant health, policy conflicts |
| Move-Windows11Taskbar/ | Remediation | Set Windows 11 taskbar alignment to left |
| Remove-ApplicabilityRule/ | Device Config | Strip OS applicability rules from all config profiles |
| Remove-PrimaryUserFromIntuneDevices/ | Device Mgmt | Remove primary user from managed devices |
| Sync-KioskAssignmentWithAadGroup/ | Automation | Sync AAD group members into Kiosk profile user lists |
| Sync-SecWithDistributionGroup/ | Automation | Mirror security group members to Exchange distribution groups |
| Translate-DeivceAndUserGroups/ | Automation | Migrate user/device membership between AAD groups |
| Write-ToastSurveyLogAnalytics/ | Remediation | Toast survey with response logging to Log Analytics |
- PowerShell 5.1+ (Windows PowerShell) or PowerShell 7+
- Microsoft Graph PowerShell SDK (Install-Module Microsoft.Graph)
- Azure AD / Entra ID permissions appropriate to each script (see individual script headers)
- For Python scripts: Python 3.9+ with msal, requests, pandas, sweetviz, openai
# Clone the repository
git clone https://github.com/JayRHa/IntuneScripts.git
cd IntuneScripts
# Example: Check Autopilot prerequisites on a device
.\Check-AutopilotPrerequisites\Check-AutopilotPrerequisites.ps1
# Example: Get all assignments for a specific AAD group
.\Get-AllAadGroupAssignments\Get-AllAadGroupAssignments.ps1
# Example: Deploy default Intune filters
.\Deploy-DefaultFilter\Deploy-DefaultFilter.ps1Scripts use different authentication methods depending on their execution context:
| Method | Use Case | Scripts |
|---|---|---|
| Connect-MgGraph (interactive) | Admin-run scripts | Deploy-DefaultFilter, Get-AllAadGroupAssignments, etc. |
| Client Credentials (App Registration) | Azure Automation runbooks | Create-AadGroupFromEaScript, Get-AllAssignmentsError, etc. |
| Managed Identity | Azure Functions / Automation | Collect-CustomInventory, Get-Windows11Report, etc. |
| MSAL Device Code (Python) | Data science notebooks | Get-IntuneDataScience |
Upload the Detection and Remediation scripts as a pair in the Intune portal:
| Script Pair | Purpose |
|---|---|
| Get-CleanUpDisk/ | Detect low disk space, run Windows Disk Cleanup |
| Get-PendingReboot/ | Detect pending reboot, show toast notification |
| Hide-TaskViewWidgetsAndSearch/ | Detect visible taskbar elements, hide them |
| Move-Windows11Taskbar/ | Detect centered taskbar, move to left |
| Collect-CustomInventory/ | Collect device telemetry, POST to Azure Function |
These scripts are designed to run on a schedule in Azure Automation:
| Script | Purpose |
|---|---|
| Create-AadGroupFromEaScript/ | Dynamic groups from Endpoint Analytics data |
| Create-AssignmentGroupsForNewApps/ | Auto-create assignment groups for new apps |
| Sync-KioskAssignmentWithAadGroup/ | Sync kiosk profile users from AAD group |
| Get-NewEnrolledDevicesReport/ | Weekly enrollment email report |
| Get-AllAssignmentsError/*AppRegistration.ps1 | Email CSV of failed assignments |
All detection and remediation scripts follow this convention:
| Code | Meaning |
|---|---|
| 0 | Success / Compliant (no remediation needed) |
| 1 | Runtime error / Non-compliant (remediation needed) |
- Fork the repository
- Create a feature branch
- Follow existing naming conventions (Verb-Noun/Verb-Noun.ps1)
- Include a comment-based help header with .SYNOPSIS, .DESCRIPTION, and .NOTES
- Add proper error handling (try/catch) and exit codes
- Submit a Pull Request
Jannik Reinhard -- Blog | X | GitHub
This project is available under the terms in LICENSE.
Built and maintained by Jannik Reinhard · Microsoft MVP for Security and AI Platform.
Stay healthy, Cheers Jannik