intune-device-mgmt

name	intune-device-mgmt
description	Use when managing endpoints with Microsoft Intune. Covers device enrollment, compliance policies, configuration profiles, app deployment, Windows Autopilot, conditional access integration, and remote device actions.
user-invocable	true
disable-model-invocation	true
context	fork
allowed-tools	["Read","Write","Bash"]
argument-hint	device management action (e.g., create compliance policy, deploy app)
hooks	{"PreToolUse":[{"matcher":"Bash","hooks":"[Truncated]"}]}

Microsoft Intune Device Management

Overview

Endpoint management using Microsoft Intune via Graph API and PowerShell. Covers device enrollment, compliance policies, configuration profiles, application deployment, and Windows Autopilot.

Device Enrollment

Windows Autopilot Profile

Connect-MgGraph -Scopes "DeviceManagementServiceConfig.ReadWrite.All"

# Create Autopilot deployment profile
$params = @{
    "@odata.type" = "#microsoft.graph.azureADWindowsAutopilotDeploymentProfile"
    DisplayName = "Standard Employee Device"
    Description = "Default Autopilot profile for employee devices"
    Language = "en-US"
    OutOfBoxExperienceSettings = @{
        HidePrivacySettings = $true
        HideEULA = $true
        UserType = "standard"
        DeviceUsageType = "singleUser"
        SkipKeyboardSelectionPage = $true
        HideEscapeLink = $true
    }
    EnrollmentStatusScreenSettings = @{
        AllowDeviceUseBeforeProfileAndAppInstallComplete = $false
        BlockDeviceSetupRetryByUser = $false
        ShowInstallationProgress = $true
        InstallProgressTimeoutInMinutes = 60
    }
}
New-MgDeviceManagementWindowsAutopilotDeploymentProfile @params

Register Autopilot Device

# Import hardware hash
$device = @{
    "@odata.type" = "#microsoft.graph.importedWindowsAutopilotDeviceIdentity"
    SerialNumber = "SERIAL123"
    HardwareIdentifier = [Convert]::ToBase64String([IO.File]::ReadAllBytes("hardware-hash.csv"))
    AssignedUserPrincipalName = "[e-mail]"
    GroupTag = "Engineering"
}
New-MgDeviceManagementImportedWindowsAutopilotDeviceIdentity @device

Compliance Policies

Windows Compliance Policy

curl -X POST https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "@odata.type": "#microsoft.graph.windows10CompliancePolicy",
    "displayName": "Windows 10/11 - Standard Compliance",
    "description": "Baseline compliance for all Windows devices",
    "passwordRequired": true,
    "passwordMinimumLength": 12,
    "passwordRequiredType": "alphanumeric",
    "passwordMinutesOfInactivityBeforeLock": 15,
    "osMinimumVersion": "10.0.19045",
    "bitLockerEnabled": true,
    "secureBootEnabled": true,
    "codeIntegrityEnabled": true,
    "storageRequireEncryption": true,
    "activeFirewallRequired": true,
    "defenderEnabled": true,
    "antivirusRequired": true,
    "antiSpywareRequired": true,
    "realTimeProtectionEnabled": true,
    "scheduledActionsForRule": [{
      "ruleName": "PasswordRequired",
      "scheduledActionConfigurations": [{
        "actionType": "block",
        "gracePeriodHours": 24,
        "notificationTemplateId": ""
      }]
    }]
  }'