IntuneManagement Toolkit

IntuneManagement is a PowerShell-based tool with a WPF UI designed to manage Microsoft Intune and Azure objects using MSAL, Microsoft Graph APIs, and Azure Management APIs. It enables administrators to backup, clone, or migrate complete Intune environments by exporting and importing objects (including assignments and dependencies) between tenants.

Key capabilities include:

• Export/Import: Supports full environment cloning, including assignments and group creation (including dynamic groups).
• Dependency Support: Handles relationships like App Protection depending on an App, or Policy Sets depending on Compliance Policies, by using exported JSON files to map IDs and names.
• Bulk Operations: Supports bulk export, import, copy, and comparison.
• Documentation: Can document profiles and policies using the same language strings found in the Intune portal.

Starting with version 3.3.1 (Beta), the tool supports tenant-specific settings. This allows you to define unique configurations for different environments, such as restricting deletions in test environments or using specific Intune app folders per tenant.

Key behaviors:

• Login settings like Cloud and GCC are only applied when logging on with a cached token. Otherwise, the tool uses the current tenant settings.
• Only Setting Values are supported for tenant-specific overrides; some global settings (like the last Bulk Compare strings) remain global.
• Cached settings might not automatically update when switching to a different tenant.

When Use Default Permissions is enabled (which is the default setting as of version 3.3.1 Beta), the tool checks the required permissions against the Access Token consented to by the selected Azure App.

How it works:

• If permissions are missing for specific objects, they are marked in red in the menu.
• You can hide these items by enabling Hide No-access items in Settings.
• Note for Consultants: If you access multiple environments (e.g., US Government) where you might not have permission to grant consent, you can enable this globally and then disable it for specific tenants where permissions can be manually added.

The documentation engine handles complex properties using separators. By default, multi-property values (like firewall rules) use a comma (,) as a property separator, and properties containing multiple values use a new line as an object separator.

If you are documenting to a CSV format, you may want to change these separators (e.g., using | as an object separator) to ensure the CSV structure remains intact. These separators can be configured within the documentation settings.

The tool provides enhanced support for migrating objects between different Intune environments, including:

• Group Migrations: Support for various group types, including Dynamic Groups.
• Dependency Management: For objects like Policy Sets that reference other objects (e.g., Compliance Settings), the import process uses exported JSON files to identify dependencies and automatically map old IDs to new IDs in the target environment.
• Scope Tags: Can be migrated using the dependency functionality (ensure Scope Tags are exported/imported first).
• Assignments: Improved support for migrating object assignments.

Since version 3.0.0 Beta 1, authentication is managed via the Microsoft Authentication Library (MSAL). This enables several capabilities:

• Switching between users.
• Switching between tenants (Multi-tenant support must be enabled in Settings).
• Viewing token information and profile pictures.

Dependencies: This requires Microsoft.Identity.Client.dll, which is included in the Az or MSAL.PS modules. Version 3.0.0 Beta 1 was tested with MSAL version 4.21.0.0.

Version 3.9.7 introduced a new Compare provider: Intune Objects with Exported Files (Name). This allows you to compare policies that have been exported to files against the live objects currently in Intune, facilitating environment-to-environment comparisons.

Additionally, the comparison engine supports:

• Skipping missing source policies.
• Skipping missing destination policies.
• Ignoring Basic properties and Assignments (note: properties will still be logged but with an empty value for the Match field).