155+ free tools, scripts and modules, curated by the community, scanned for security, and searchable by the problem you are facing.
CMTrace Web (CMTrace.dev) is a free, browser-based log viewer for ConfigMgr/SCCM and Intune logs. Reimplementing CMTrace in the browser, it handles 1M+ line logs with color-coded severities, error-code lookups, and side-by-side diffs, all client-side and offline as a PWA. It opens .log, .txt, .gz, and .zip, with Intune/IME presets to jump straight to relevant logs.
Adobe DC (Computer) ADMX provides machine-level Group Policy and Intune management templates for Adobe Acrobat DC and Reader DC on Windows. It ships as a combined AdobeDC.admx/ADML pair (plus separate x64 and x86 files) and enables 552 policies covering cloud connectors, security hardening, trust, UI, updates, and upsell controls via HKLM. The documentation notes per-architecture deployment, unified installer considerations, and inverted registry values for some bToggle policies, ensuring consistent Enabled/Disabled behavior in GPO and Intune.
Per-user Adobe Acrobat DC and Reader DC ADMX/ADML templates for Intune, enabling HKCU policy management on Windows. The v1.10 User bundle includes 501 policies (across Reader and Acrobat), with security hardening, nags reduction, and full documentation to configure per-user preferences via Intune or GPO. It ships AdobeDC_User.admx/adml files and user-scoped policy controls for per-user settings.
Apple Compliance Version Updater automatically updates the osMinimumVersion in macOS and iOS/iPadOS Intune compliance policies based on the SOFA feed. It provides per-platform control, supports flexible version strategies (track major, pin to major, or track minor), and runs in Azure Automation with Managed Identity for zero-secret maintenance. Choose separate or unified runbooks for scalable, diagnostics-driven policy updates.
Autopilotlens. see what actually applies in Intune.
Defender Device Control macOS Policy Manager is a browser-based editor for authoring and exporting Microsoft Defender for Endpoint device-control policies as Apple .mobileconfig profiles. It combines a Monaco JSON editor, visual Groups/Rules/Entries, a recursive query builder, live validation, and a policy simulator, plus import/export to standard .mobileconfig for deployment via Jamf, Intune, or any MDM.
Edge Extension Inventory Collector is a lightweight tool that scans endpoints to enumerate installed Microsoft Edge extensions, capturing extension ID, name, publisher, version, enabled state, and install source. It exports a consolidated inventory to JSON or CSV for software asset management, security audits, and Intune/Endpoint Manager workflows. It helps maintain visibility of browser extensions across managed devices and supports baseline compliance checks.
HTMD – Microsoft Intune Reports Export Tool v1.0 exports all available Intune data via Microsoft Graph and then enables post-export column selection to tailor reports. Built with Python (requests, pandas) and a tkinter GUI, it supports optional Power BI automation and Excel export via openpyxl. Prerequisites include Python 3.8+, Windows 10/11, and Graph permissions such as DeviceManagementConfiguration.Read.All, DeviceManagementManagedDevices.Read.All, and DeviceManagementApps.Read.All.
An Azure Automation Runbook for Microsoft Intune that automatically updates the iOS compliance policy osMinimumVersion based on real device inventory. It queries devices via Microsoft Graph, derives a safe minimum iOS version (third newest when enough data, with a fallback), updates the policy if needed, and sends a detailed HTML notification. Emphasizes idempotency, robust error handling, and routine scheduling.
Intune Profile Bulk Renamer Tool is a self-contained PowerShell 7 + Windows Forms desktop app that connects to Microsoft Graph to bulk rename and re-describe Intune configuration profiles. It pulls multiple content types into an editable grid, supports inline edits, CSV export/import, and literal/regex Find & Replace; updates are applied as minimal PATCH requests only to changed items. Includes dry-run, JSON backups, automatic safety backups, and thorough logging.
IntuneLinuxBaseline is a modular baseline for Linux devices managed with Microsoft Intune. It delivers custom compliance policies, configuration scripts, and an automated enrollment workflow to establish a consistent, secure Ubuntu posture. The baseline includes an autoinstall ready enrollment, full-disk LUKS encryption, and recurring, idempotent scripts to re-apply settings and maintain compliance.
IntuneOSCompliance is a PowerShell tool that automatically updates Windows, Android, and Apple OS compliance policies, app protection policies, and device enrollment platform restrictions to the latest supported OS versions. It fetches current builds via APIs and RSS feeds, detects policies needing updates, and can push results to a rich Microsoft Teams card via an Incoming Webhook. Public Preview with configurable report-only mode and OS version offsets.
IntuneWin32AppUninstall is a PowerShell GUI tool that inventories MSI-based apps by scanning uninstall registry keys (HKLM and HKCU) and generates Intune-compatible detection and remediation scripts. For each selected app it creates a ready-to-deploy package with Detect and Remediate scripts, a README, and AppInfo.json, with batch generation, per-app folders, and CSV export. Remediation uninstalls silently via msiexec /X {GUID} and logs results for Intune deployment under Endpoint Security.
IntuneWin32BulkManagement is a PowerShell-based GUI for managing Win32 apps in Microsoft Intune. It offers a WPF interface to browse apps, perform bulk group assignments, and streamline update workflows using Winget, with per-app workspaces and live logging. The tool can download, package to .intunewin, upload updates, enrich metadata from Winget, and export or backup catalog data for easy Intune administration.
A comprehensive MCP server that manages Microsoft Intune and Entra ID via the Microsoft Graph API. It exposes 134 tools across 16 categories, enabling AI assistants to perform device and user management, security configuration, policy enforcement, and rich reporting. Features include remote actions (sync, restart, lock, wipe, retire), device inventory, Autopilot management, conditional access, app and group management, and bulk operations.
RepoFabric is a self-hosted WinGet source platform for Microsoft-managed fleets. It provides Entra ID sign-in, one-click Intune policy export (DesktopAppInstaller CSP) to point endpoints to a private source, Azure Arc readiness, and a GUI admin console. It also offers a REST API and a 48-cmdlet PowerShell module, GitOps manifests, scheduled sync, and LAN peer-caching to reduce bandwidth.
1PhoneMirror is a Windows-based screen-mirroring receiver designed for Intune admins to capture consistent, framed mobile-device screens for documentation and training. It supports iOS/macOS AirPlay with optional PIN, Android wireless debugging via bundled adb/scrcpy, and experimental Miracast, delivering one-click screenshots or MP4/GIF recordings inside a device frame. Multiple devices can stay paired and be switched from a bottom bezel, with no app installations on phones.
Driver Automation Tool is a PowerShell WPF desktop app that automates the full lifecycle of OEM driver and BIOS package management for ConfigMgr and Intune. It automatically discovers vendor catalogs, downloads with resume-enabled curl, extracts, builds WIMs, and wraps packages as .intunewin for Intune Win32 deployment. The tool supports multiple OEMs, BIOS update handling, hash verification, and configurable packaging (DISM/wimlib/7-Zip) to streamline ConfigMgr and Intune workflows.
93 of 155 listed tools passed every automated security check.
Every open-source tool's code is scanned for six classes of risk: obfuscation, remote execution, credential theft, data exfiltration, malicious patterns, and hardcoded secrets.
Tools are reviewed and selected by Intune practitioners. Closed-source tools that can't be scanned are vetted manually before they're listed.
Every tool in the directory is free to use. Source links and downloads go straight to the original author's repository - nothing is paywalled here.
