Skip to content
PS Script
5/6 checks passed

Intune App Factory

Intune App Factory is a set of PowerShell scripts run in an Azure DevOps Pipeline that automatically detects, downloads, packages, and publishes onboarded applications as Win32 apps to Microsoft Intune, ensuring up-to-date deployments. It supports onboarding via manifests, integrates the PowerShell App Deployment Toolkit, and automates version checks from Winget, Evergreen, or Storage Account sources to streamline packaging and publishing.

Works with
WindowsWin32 AppsGraph APIAzure DevOpsWinget
Visit WebsiteView on GitHub

Screenshots

Security Analysis

5of 6
1 Issue Found

22 files scanned on Jul 12, 2026

Issues Detected
No Malicious Patterns
No known malware techniques
The script explicitly sets the PowerShell execution policy to ByPass for the current process (Set-ExecutionPolicy -ExecutionPolicy 'ByPass' -Scope 'Process'). This bypasses execution restrictions and can be exploited to run unsigned or tampered code, particularly during deployment. While common in deployment contexts, it represents a potential abuse surface and should be constrained (e.g., sign scripts, scope limited, audit).
Passed Checks
No Obfuscated Code
No Remote Execution
No Credential Theft
No Data Exfiltration
No Hardcoded Secrets
AI Analysis

Assessment finds no remote code download, credential theft, or data exfiltration. Primary concerns are (1) execution policy bypass in deployment scripts, which lowers defense in depth, (2) a potential misuse surface in silent uninstall logic, and (3) templated placeholders that should be securely substituted and reviewed for unintended leakage. Overall, these scripts are typical for Intune/App Deployment Toolkit usage but require strict access control, signing, and auditing to prevent abuse.

You might also like

PS Script

IntuneComplianceMaintainer

IntuneComplianceMaintainer is a PowerShell automation script that keeps Microsoft Intune compliance and app-protection policies up to date with the latest supported OS minimums across iOS, iPadOS, macOS, Android, and Windows. It uses endoflife.date and the Graph Windows Update Catalog to drive cadence-based updates, with flexible authentication (Managed Identity, App Registration with certificate or secret, plus Key Vault integration) and safety features like dry-run and downgrade protection. It provides comprehensive logging and built-in retry logic for resilience.

James RobinsonJames Robinson
PowerShell Module

Wintuner

WinTuner is a tool that lets you take any WinGet app and upload it to Intune in minutes. It automates downloading the installer and logo, generates the intunewin package, creates the required deployment script details, and publishes the app to Intune. It also ships a PowerShell module for automation and includes documentation to guide you through the process.

Stephan van RooijStephan van Rooij
PS Script

Autopilot Management

Autopilot Management is a Windows-based Intune utility that simplifies Autopilot device administration. It supports searching by serial number or device name, bulk updates to Group Tags, bulk or single deletions, and uploading hardware hashes. It can load and verify devices from CSV, backup data, and query with an optional cache for large environments. Authentication uses Azure Graph tools (MFA supported) for secure admin access.

Espen JaegtvikEspen Jaegtvik
PS Script

AutopilotGroupTagger

AutopilotGroupTagger is a PowerShell-based utility for bulk updating and managing Windows Autopilot Device Group Tags, with optional unblocking of devices. It supports updating tags by group, manufacturer, model, purchase order, and interactive selection, plus exporting data and creating dynamic Entra ID groups. The tool runs with Microsoft Graph authentication and supports PowerShell 7 on Windows/macOS, including a whatIf simulation mode and Community Tool status.

Nick BentonNick Benton