Best Configuration Tools for Microsoft Intune

A PowerShell-based customization tool packaged as an Intune Win32 app for configuring Windows 10/11 devices during Autopilot deployment. Customizes start menu layout, background/theme, time zone, removes built-in apps, installs OneDrive, configures language packs, and manages Windows features.

Baseline is an MDM-agnostic, zero-touch or light-touch macOS deployment tool. It uses swiftDialog, Installomator, and custom code to automate app installation and script execution. Behavior is configured via a mobileconfig or plist, with Baseline installing packages, scripts, and Installomator labels as defined in the configuration.

TrustM365 is a free, self-hosted dashboard for Microsoft 365 administrators and MSSPs. It connects to multiple tenants via Graph, baselines exact resources and properties to monitor, detects drift with property-level diffs on every sync, and restores baseline values with one click. It provides branded reports, webhook alerts, and a full audit trail, plus auto-restore and multi-tenant views for MSSP workflows.

A lightweight user environment manager for Intune-managed devices. Manages drive mappings, printer mappings, registry settings, file actions, application launcher, Start Menu and desktop shortcuts, with on-demand refresh and centralized JSON-based configuration.

Intune Baselines provides curated JSON Intune profiles that implement CIS, compliance, and security baselines across Windows, macOS, iOS/iPadOS, Android, and enterprise apps. Built from best practices, Zero Trust concepts, and official CIS benchmarks, these profiles are designed for rapid import into Intune (via Micke-K's IntuneManagement tool). Regularly updated, they support scalable Modern Workplace deployments and testing in diverse environments.

Adobe DC (Computer) ADMX provides machine-level Group Policy and Intune management templates for Adobe Acrobat DC and Reader DC on Windows. It ships as a combined AdobeDC.admx/ADML pair (plus separate x64 and x86 files) and enables 552 policies covering cloud connectors, security hardening, trust, UI, updates, and upsell controls via HKLM. The documentation notes per-architecture deployment, unified installer considerations, and inverted registry values for some bToggle policies, ensuring consistent Enabled/Disabled behavior in GPO and Intune.

WinPEAP is a WinPE-based workflow to transition devices to Entra Joined and auto-enroll them into Intune via Windows Autopilot. It uses OSDCloud to build a customized WinPE ISO, injects the 4kAutopilotHashUpload.ps1 script and oa3tool-based hardware hash capture, and uploads the Autopilot hash to Intune during WinPE. Automation spans OS deployment, driver injection, hash registration, and enrollment, with support for user-driven Autopilot profiles and VM testing considerations.

BrowserConfigEditor is a macOS GUI tool that creates and edits browser policy configurations for enterprise deployments. It supports multiple browsers (Chrome, Edge, Safari, Firefox, Brave, and other Chromium-based browsers) and exports policies in plist, JSON, Intune XML, or shell scripts for deployment. It includes features like visual policy configuration, import/export, search/filter, built-in documentation, and deployment-ready outputs for MDM and Intune.

FixMyADMX is a script-based tool that automatically repairs ADMX/ADML templates for Intune administrative templates. It replaces unsupported controls (comboBox) with textBox, injects explainText attributes for policies, and attempts to remove or report on Windows.admx references to improve import reliability. It builds on the approach used in Citrix ADMX cleanup and aims to streamline ADMX ingestion for Intune deployments.

IntuneFirewallMigration is a public-preview tool that migrates Group Policy and local firewall rules into Intune as Settings Catalog policies. It supports selecting specific firewall profiles (Domain, Private, Public) and importing only inbound or outbound rules, using Microsoft.Graph.Authentication with Invoke-MgGraphRequest. The script disables telemetry, requires Graph permissions (DeviceManagementConfiguration.ReadWrite.All), and works with PowerShell 5 or 7 to modernize firewall management in Intune.

Feature Update Controller is a remediation package for Microsoft Intune that centralizes Windows feature upgrades with configurable setup, scripts, and custom actions. It generates and manages SetupConfig.ini, prestages Script Modules, and configures Custom Actions to tailor upgrade behavior, including post-install and rollback steps. The solution downloads and applies a manifest.json, stages scripts and actions, and supports updating or removing configurations on devices for a consistent upgrade experience.

Intune Profile Converter is a native macOS app that transforms Apple .mobileconfig profiles into Microsoft Intune-compatible formats. It supports Settings Catalog JSON and Preference File XML, automatically strips CMS/PKCS#7 signatures, and can batch process multiple profiles. It also handles MCX managed preferences, provides a session log with per-file results, and includes a built-in Settings Catalog reference browser with auto-updates via Sparkle.

Intune PPPC Utility is a native macOS app for creating and editing PPPC profiles to deploy via Microsoft Intune as Settings Catalog configurations. It enforces a single permission model per entry (Allowed or Authorization), supports per-app entries and Apple Events, and can read code requirements via codesign. It can import mobileconfig payloads and live TCC data, and outputs JSON compatible with the Microsoft Graph API deviceManagement/configurationPolicies.

A PowerShell utility for capturing, comparing, and exporting Windows Defender firewall rules for Microsoft Intune deployment. Captures baseline rules, compares post-install changes, and exports to JSON for Intune or CSV formats with interactive menu and CLI modes.

MacPPPC is a browser-based builder for macOS Privacy Preferences Policy Control profiles. It generates unsigned .mobileconfig or Settings Catalog JSON output and can deploy profiles, scope tags, and assignments directly to Microsoft Intune through delegated Microsoft Graph access.

IntuneLinuxBaseline is a modular baseline for Linux devices managed with Microsoft Intune. It delivers custom compliance policies, configuration scripts, and an automated enrollment workflow to establish a consistent, secure Ubuntu posture. The baseline includes an autoinstall ready enrollment, full-disk LUKS encryption, and recurring, idempotent scripts to re-apply settings and maintain compliance.

InToolz is a management tool for Microsoft Intune designed to simplify cross-tenant migrations and bulk configuration tasks. It enables tenant-to-tenant copy of Intune content, bulk assignment deployment and removal between groups, profiles, and applications, and mass updates to description fields. Note that the project is a work in progress, with several features planned for future releases.

Professional-grade PowerShell script that automates deploying Windows 365 Cloud PC environments in Azure and Microsoft Entra ID. It creates or reuses security groups, applies user/admin settings policies, and provisions Cloud PCs regionally with intelligent Enterprise assignment preservation. It uses a lightweight Microsoft Graph authentication module and includes robust error handling, scalable naming conventions, and license-driven provisioning.

PowerShell ADMX Wizard creates custom ADMX/ADML templates from a CSV of registry keys, enabling Windows policies via Intune. It generates GUID-based templates, adds registry entries (STRING, DWORD, BINARY), and logs progress. After creation, upload the ADM/ADML to Intune as Imported ADMX to apply through a configuration profile.

Per-user Adobe Acrobat DC and Reader DC ADMX/ADML templates for Intune, enabling HKCU policy management on Windows. The v1.10 User bundle includes 501 policies (across Reader and Acrobat), with security hardening, nags reduction, and full documentation to configure per-user preferences via Intune or GPO. It ships AdobeDC_User.admx/adml files and user-scoped policy controls for per-user settings.

Windows Media Creation CLI is a PowerShell-based tool that automates building Windows installation media on a USB drive. It supports Windows 11 (22H2-25H2) and Windows 10, with customizable architecture, language, region and edition, enabling fully automated media creation. It also supports OEM driver injection via AUTOUNATTEND or DISM, single or multi-driver packs, and can generate an installwimdrivers.csv catalog to track installed drivers.

A Microsoft Intune wrapper that enables deploying a custom wallpaper to Microsoft Teams Rooms devices via a PowerShell installer. It packages a wallpaper into an .INTUNEWIN package, supports install and uninstall commands, and uses registry-based detection to verify the deployed version. It also generates logs under the Intune Management Extension folder for troubleshooting, with a configurable company name for branding.

Edge Favorites Builder is a web-based tool that creates and manages Microsoft Edge bookmarks configurations for enterprise deployment. It offers a visual drag-and-drop interface, supports nested folders, and provides real-time previews. It exports to Windows Intune JSON and macOS mobileconfig for deployment via Intune or other MDMs; it runs offline with zero dependencies and requires no backend, and it can import existing configurations for quick updates.

Intune Profile Bulk Renamer Tool is a self-contained PowerShell 7 + Windows Forms desktop app that connects to Microsoft Graph to bulk rename and re-describe Intune configuration profiles. It pulls multiple content types into an editable grid, supports inline edits, CSV export/import, and literal/regex Find & Replace; updates are applied as minimal PATCH requests only to changed items. Includes dry-run, JSON backups, automatic safety backups, and thorough logging.

Windows Recovery Partition Editor resizes the local Windows Recovery Partition to 984MB and injects CAB files to enable optional features and language support. It deploys via a PowerShell script, placing architecture-specific CABs under tools\amd64 or tools\arm64cpu and matching language packs, with an optional backup of OEM images. Detection uses the registry key HKLM:\SOFTWARE\YourCompanyNameHere\Client-Recovery with value 1.0.0.

Browse and search ADMX Group Policy templates from 60+ vendors. Windows 11, Edge, Chrome, Office, Citrix and more. All languages supported.

A comprehensive web tool for browsing and exploring Apple device management policies across iOS, macOS, tvOS, watchOS, and visionOS. Provides detailed documentation for MDM and DDM (Declarative Device Management) policies.

A web-based tool for creating and managing Windows AppLocker policies. Create application control rules through an intuitive interface and export them as valid AppLocker XML files for use with Windows Group Policy or Microsoft Intune.

Cloud Policy Preferences is a cloud-native Intune policy platform that restores Group Policy-like control: deploy registry, files, drives, printers, and more, with real-time monitoring and granular targeting. It offers RBAC, What-If analysis, auditing and reporting, automated validation, and Teams notifications, all secured by per-tenant TDEK, end-to-end encryption, and Entra ID authentication.

An AI-powered tool for IT administrators that generates exact Microsoft Intune configuration profiles from plain English descriptions.

Intune Registry Builder is a browser-based tool to create, validate, and export Intune-ready PowerShell scripts for Windows registry changes. It supports Proactive Remediations and Win32 apps, allows direct deployment to Intune, and processes everything locally in the browser. No data or credentials are stored or sent to any server.

This is a faster way to see what's in the Intune settings catalog, with an additional page to track changes made by Microsoft.

A powerful, free tool for comparing Microsoft Intune policies and analyzing configuration differences. Features real-time policy access via Microsoft Graph API, JSON import for offline comparison, device comparison against security baselines, settings search, and full Settings Catalog support.

IntuneShade is a free community console for Microsoft Intune admins that lets you sign in with a Microsoft 365 account to view and manage your tenant—assignments, device compliance, Autopilot, and reports—without any install or app registration. This multi-tenant SPA runs in the browser with delegated Graph permissions and no server-side data storage. Key features include Group Assignment Manager, Bulk Assign, AI policy analysis and script generation, conflict detection, smart bulk automation, assignment matrix, compliance reporting, and audit history.

A web-based tool for building Windows kiosk deployments by generating Assigned Access XML configurations. Supports Single-App, Multi-App, and Restricted User modes with customizable Start menu, taskbar, auto-launch, idle timeout, and breakout keys. Exports for Intune OMA-URI, PowerShell, or provisioning packages.

LanguagePackDeployer is a web-based Intune deployment tool that streamlines multilingual rollouts for Windows and macOS. From a browser, you select languages, region, timezone, and keyboard overrides, then publish assigned policies or download ready-to-run deployment bundles. It includes 100 locale presets, the option to designate a primary UI language, and supports packaging as a Win32 app, Platform Script, or macOS Intune shell script with granular assignment controls.

NameTune is a purpose-built Intune companion that helps teams design, apply, and document consistent naming standards across real-world Microsoft Intune environments.