Loading
PowerShell Module
4/6 checks passed
Updated Nov 2025Intune Device Migration
Intune Device Migration off-boards devices from one tenant and automatically joins them to a destination tenant, preserving user data during the transition. Built with PowerShell, Microsoft Graph, and Windows provisioning packages, it enables near-zero downtime cross-tenant migrations, with detailed logging, registry updates, and post-install validation to ensure provisioning packages are applied correctly.
Security Analysis
4of 6
2 Issues Found
5 files scanned on Sep 20, 2026
Issues Detected
No Malicious Patterns
No known malware techniques
decryptDrive calls Disable-BitLocker to decrypt the system drive. This directly lowers device security by removing encryption and could be abused. Requires strict controls, approvals, and auditing; consider conditionally enabling only with user/tenant consent and TPM-bound policies.
No Hardcoded Secrets
No API keys or credentials in code
Config.json stores clientSecret and other Graph credentials used to obtain tokens. If the file is exposed or not protected, a malicious actor could impersonate the app. Recommendation: move secrets to a secure vault (e.g., Azure Key Vault) with managed identities, and avoid plaintext storage.
Passed Checks
No Obfuscated Code
No Remote Execution
No Credential Theft
No Data Exfiltration
AI Analysis
The Intune Device Migration scripts perform legitimate Graph API orchestration for device tagging, user assignment, and Autopilot enrollment. Security concerns center on plaintext credential storage (config.json), mild obfuscation, high-risk BitLocker decryption path, and post-migration cleanup actions that could be misused or hinder forensics. Mitigations include secure secret management, explicit approvals for destructive actions, and hardened logging/privacy controls. Overall, the code appears aligned with admin tooling but requires strong secret handling and safeguards around encryption/deletion operations.
You might also like
Other
Somesh Pathak
JUMP-IN
JUMP-IN is an all-in-one macOS application that simplifies migrating between MDM solutions, enabling migration to Microsoft Intune or between Intune tenants without data loss. It performs system compatibility checks, automatic MDM detection, backups, profile removal, Company Portal installation, tenant enrollment, and FileVault key rotation to maintain security; typical migration runs in about 15-20 minutes per device.
Somesh PathakPowerShell Module
Maciej Horbacz
Intune-App-Sandbox
Intune-App-Sandbox is a testing utility for PowerShell-based installers packaged with the Win32 Content Prep Tool for Intune deployments. It creates a sandbox workspace (C:\SandboxEnvironment), and adds context-menu options to pack with IntunewinUtil or run tests in a Safe sandbox. It also supports a detection-based test flow and a reusable template script to accelerate building and validating packaging for Win32 apps in Intune.
Maciej HorbaczPowerShell Module
Mark Oldham
IntuneAccess
IntuneAccess is an open-source, read-only PowerShell module that connects Microsoft Intune RBAC, workload targeting, and evidence into a single local report. It correlates admins, groups, policies, devices, apps and updates to produce structured objects and an offline HTML Signal Atlas explorer. It supports findings, resolution guides, snapshot comparisons and export-only datasets without uploading tenant data.
Mark OldhamPowerShell Module
Giovanni Solone
IntuneWinAppUtil GUI
IntuneWinAppUtil GUI is a PowerShell-based WPF wrapper for Microsoft's IntuneWinAppUtil.exe. It streamlines packaging Win32 apps for Intune with auto-download of the latest tool, input validation, path-length checks, and configuration persistence across launches. It also detects PSAppDeployToolkit usage to suggest names and sanitizes invalid filename characters.
Giovanni Solone