Loading
PowerShell Module
Verified
Updated Jul 2026Intune Hydration Kit
A PowerShell module that automates Microsoft Intune tenant setup by deploying 70+ security baselines, 43 dynamic groups, 24 device filters, compliance policies, app protection policies, and Conditional Access policies in a single command. Integrates OpenIntuneBaseline and supports multi-cloud environments.
Works with
WindowsGraph APISecurity BaselinesConfig ProfilesComplianceConditional AccessDevice FiltersApp Protection
Screenshots
Security Analysis
6of 6
All Checks Passed
50 files scanned on Sep 20, 2026
No Obfuscated Code
No Remote Execution
No Credential Theft
No Data Exfiltration
No Malicious Patterns
No Hardcoded Secrets
AI Analysis
Overall assessment: The IntuneHydrationKit codebase appears to be a structured Intune management toolkit with Graph API usage and Intune-centric features. While many patterns are standard for admin tooling, there are notable concerns: (1) dynamic loading of all scripts from Private/Public can enable unintended code execution if those directories are compromised; (2) a hard-coded default client ID could lead to insecure defaults and should be configurable; (3) runtime installation of modules from PSGallery introduces supply-chain risk and should be tightly controlled with signing/pinning; (4) in-memory token handling via ConvertTo-SecureString should avoid plain-text exposure; and (5) secret management for publishing (PSGallery API key) should be handled securely. No evidence of active credential harvesting, remote command execution beyond standard module installs, or explicit data exfiltration of user secrets was observed.
You might also like
PS Script
James Robinson
IntuneComplianceMaintainer
IntuneComplianceMaintainer is a PowerShell automation script that keeps Microsoft Intune compliance and app-protection policies up to date with the latest supported OS minimums across iOS, iPadOS, macOS, Android, and Windows. It uses endoflife.date and the Graph Windows Update Catalog to drive cadence-based updates, with flexible authentication (Managed Identity, App Registration with certificate or secret, plus Key Vault integration) and safety features like dry-run and downgrade protection. It provides comprehensive logging and built-in retry logic for resilience.
James RobinsonWeb AppJames Robinson
OIB Deployer
OIB Deployer automates the deployment of OpenIntuneBaseline configurations within Microsoft Intune, enabling rapid, repeatable rollouts of baseline security policies and device configurations. It supports policy templating, script deployment, and integration with community-provided baseline content, with built-in logging and error reporting for auditability. Ideal for IT admins seeking consistent, scalable endpoint security across devices.
James RobinsonDesktop App
Ugur Koc
TenuVault
TenuVault is a desktop app for Windows and macOS that backs up and restores Microsoft Intune configuration through Microsoft Graph using your own delegated admin sign-in. It backs up Settings Catalog, compliance, endpoint security, Administrative Templates, scripts and other supported policy types with their assignments, stores backups encrypted with AES-256-GCM on your device (or in your own Azure storage on Pro and MSP), detects configuration drift and deploys OpenIntuneBaseline. The free Community plan covers one tenant with weekly backups and restores items as unassigned copies; paid Pro and MSP plans add daily schedules and in-place restore, and MSP adds cross-tenant recovery. TenuVault Desktop succeeds the original PowerShell script and hosted web portal, which remains available for existing users.
Ugur KocPowerShell Module
Nickolaj Andersen
Entra ID Device Trust
Entra ID Device Trust enables binding Function Apps to Entra ID joined devices by validating requests originate from trusted devices via the device certificate enrolled during device registration. It combines client-side data gathering (signature hash, device CN, public key, thumbprint) with server-side validation, and can be embedded as a module in your Function App or installed as a dependency. The solution supports embedding EntraIDDeviceTrust.Client on clients and EntraIDDeviceTrust.FunctionApp in Function Apps for seamless, enhanced request security.
Nickolaj Andersen