Adding Microsoft Intune Checks #1327

nicolonsky · 2025-11-20T14:44:40Z

Description

Adding Intune license check to decide whether Intune checks are applicable
Adding multiple Microsoft Intune checks:
- MT.1090 - Global administrator role should not be added as local administrator on the device during Microsoft Entra join
- MT.1091 - Registering user should not be added as local administrator on the device during Microsoft Entra join
- MT.1092 - Intune APNS certificate should be valid for more than 30 days
- MT.1093 - Apple Automated Device Enrollment Tokens should be valid for more than 30 days
- MT.1094 - Apple Volume Purchase Program Tokens should be valid for more than 30 days
- MT.1095 - Android Enterprise account connection should be healthy
- MT.1096 - Ensure at least one Intune Multi Admin Approval policy is configured
- MT.1097 - Ensure all Intune Certificate Connectors are healthy and running supported versions
- MT.1098 - Mobile Threat Defense Connectors should be healthy
- MT.1099 - Windows Diagnostic Data Processing should be enabled
- MT.1100 - Intune Diagnostic Settings should include Audit Logs
- MT.1101 - Default Branding Profile should be customized
- MT.1102 - Windows Feature Update Policy Settings should not reference end of support builds
- MT.1103 - Ensure Intune RBAC groups are protected by Restricted Management Administrative Units or Role Assignable groups
- MT.1105 - Ensure MDM Authority is set to Intune

Contribution Checklist

Before submitting this PR, please confirm you have completed the following:

📖 Read the guidelines for contributing to this repository.
🧪 Ensure the build and unit tests pass by running /powershell/tests/pester.ps1 on your local system.

Join us at the Maester repository discussions 💬 or Entra Discord 🧑‍💻 for more help and conversations!

Copilot

Pull Request Overview

This PR adds comprehensive Microsoft Intune health checks and monitoring capabilities to the Maester framework. It introduces license validation for Intune and implements 16 new security and operational checks covering device enrollment policies, certificate management, connector health, and platform configurations.

Key changes:

Added Intune license detection in Get-MtLicenseInformation with support for multiple Intune service plan SKUs
Implemented 16 new test functions covering Apple/Android integrations, certificate connectors, compliance settings, and administrative policies
Added DeviceManagementRBAC.Read.All permission requirement for RBAC group protection checks

Reviewed Changes

Copilot reviewed 43 out of 43 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
website/docs/sections/permissions.md	Added DeviceManagementRBAC.Read.All permission
tests/maester-config.json	Added metadata for 16 new Intune checks (MT.1090-MT.1105)
tests/Maester/Intune/Test-MtIntunePlatform.Tests.ps1	Added 6 new platform-level Intune tests
tests/Maester/Intune/Test-MtIntuneConnectorHealth.Tests.ps1	New file with 5 connector health validation tests
tests/Maester/Entra/Test-MtEntraDeviceRegistrationPolicy.Tests.ps1	Consolidated device registration and local admin tests
powershell/public/maester/intune/*.ps1	Implemented 13 new test functions with license checking
powershell/public/maester/entra/*.ps1	Added 2 device registration local admin validation functions
powershell/public/Get-MtLicenseInformation.ps1	Added Intune license detection support
powershell/public/Get-MtGraphScope.ps1	Added DeviceManagementRBAC.Read.All scope
powershell/public/Add-MtTestResultDetail.ps1	Added NotLicensedIntune skip reason
powershell/internal/Get-MtSkippedReason.ps1	Added Intune licensing message
powershell/Maester.psd1	Exported 13 new test functions

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

powershell/public/maester/intune/Test-MtCertificateConnectors.md

powershell/public/maester/intune/Test-MtIntuneDiagnosticSettings.md

powershell/public/maester/intune/Test-MtTenantCustomization.md

powershell/public/maester/intune/Test-MtIntuneDiagnosticSettings.ps1

powershell/public/maester/intune/Test-MtFeatureUpdatePolicy.ps1

powershell/public/Add-MtTestResultDetail.ps1

powershell/public/maester/intune/Test-MtCertificateConnectors.ps1

powershell/public/maester/intune/Test-MtOperationApprovalPolicies.md

powershell/public/maester/intune/Test-MtApplePushNotificationCertificate.md

powershell/public/maester/intune/Test-MtAndroidEnterpriseConnection.ps1

Copilot

Pull Request Overview

Copilot reviewed 43 out of 43 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

powershell/public/maester/intune/Test-MtIntuneRbacGroupsProtected.ps1

powershell/public/maester/intune/Test-MtAppleVolumePurchaseProgramToken.md

powershell/public/maester/intune/Test-MtCertificateConnectors.ps1

powershell/public/maester/intune/Test-MtApplePushNotificationCertificate.ps1

Copilot

Pull Request Overview

Copilot reviewed 43 out of 43 changed files in this pull request and generated 13 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

powershell/public/maester/intune/Test-MtTenantCustomization.ps1

tests/Maester/Entra/Test-MtEntraDeviceRegistrationPolicy.Tests.ps1

powershell/public/maester/intune/Test-MtCertificateConnectors.ps1

powershell/public/maester/intune/Test-MtMdmAuthority.ps1

powershell/public/maester/intune/Test-MtTenantCustomization.ps1

powershell/public/maester/intune/Test-MtAppleVolumePurchaseProgramToken.ps1

powershell/public/maester/intune/Test-MtAppleAutomatedDeviceEnrollmentToken.ps1

powershell/public/maester/intune/Test-MtAppleVolumePurchaseProgramToken.ps1

powershell/public/maester/intune/Test-MtAppleAutomatedDeviceEnrollmentToken.ps1

powershell/public/maester/intune/Test-MtMobileThreatDefenseConnectors.ps1

f-bader · 2025-11-21T15:55:50Z

Thank you @nicolonsky for this submission. I will review this over the weekend

merill

@nicolonsky this is amazing. Thank you for all the tests you are contributing.

In my tenant, which has intune license but not much configured a lot of the tests are erroring out.

Please see comments.

Thanks

merill · 2025-11-25T23:04:18Z

powershell/public/maester/intune/Test-MtAppleAutomatedDeviceEnrollmentToken.ps1

+<#
+.SYNOPSIS
+    Check the validity of the Apple Automated Device Enrollment (ADE) token for Intune.
+.DESCRIPTION
+    The Apple Automated Device Enrollment (ADE) token is required to synchronize Apple devices with Microsoft Intune. This command checks if the ADE token is valid and not expired.
+
+.EXAMPLE
+    Test-MtAppleAutomatedDeviceEnrollmentToken
+
+    Returns true if the ADE token is valid for more than 30 days, false if it is expired or expiring soon.
+
+.LINK
+    https://maester.dev/docs/commands/Test-MtAppleAutomatedDeviceEnrollmentToken
+#>
+function Test-MtAppleAutomatedDeviceEnrollmentToken {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param()
+
+    if (-not (Get-MtLicenseInformation -Product Intune)) {
+        Add-MtTestResultDetail -SkippedBecause NotLicensedIntune
+        return $null
+    }
+
+    try {
+        Write-Verbose 'Retrieving Apple Automated Device Enrollment token status...'
+        $expirationThresholdDays = 30
+        $automatedDeviceEnrollmentTokens = @(Invoke-MtGraphRequest -RelativeUri 'deviceManagement/depOnboardingSettings' -ApiVersion beta)
+
+        $testResultMarkdown = "Intune Automated Device Enrollment Token Status:`n"
+        $testResultMarkdown += "| Name | TokenExpirationDateTime | LastSuccessfulSyncDateTime | LastSyncErrorCode |`n"
+        $testResultMarkdown += "| --- | --- | --- | --- |`n"
+
+        $healthStatus = foreach ($token in $automatedDeviceEnrollmentTokens) {
+            $expiresInDays = [System.Math]::Ceiling(([datetime]$token.tokenExpirationDateTime - (Get-Date)).TotalDays)
+            $lastSyncDiffDays = [System.Math]::Floor(((Get-Date) - [datetime]$token.lastSuccessfulSyncDateTime).TotalDays)
+            $testResultMarkdown += "| $($token.tokenName) | $($token.tokenExpirationDateTime) | $($token.lastSuccessfulSyncDateTime) | $($token.lastSyncErrorCode) |`n"
+            Write-Output $($expiresInDays -gt $expirationThresholdDays -and $lastSyncDiffDays -eq 0)
+        }
+
+        $testResultMarkdown += '```' + "`n"
+        $testResultMarkdown += $automatedDeviceEnrollmentTokens | ConvertTo-Json
+        $testResultMarkdown += "`n"
+        $testResultMarkdown += '```'
+
+        Add-MtTestResultDetail -Result $testResultMarkdown
+        return $healthStatus -notcontains $false
+    } catch {
+        Add-MtTestResultDetail -SkippedBecause Error -SkippedError $_
+        return $null
+    }
+}


I'm seeing the following error in my tenant.

InvalidArgument: /Users/merill/GitHub/maester/powershell/public/maester/intune/Test-MtAppleAutomatedDeviceEnrollmentToken.ps1:35 Line | 35 | $expiresInDays = [System.Math]::Ceiling(([datetime]$token … | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Cannot convert null to type "System.DateTime".

I dug further and can see the rest api returning

{ "@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceManagement/depOnboardingSettings", "@odata.count": 0, "@microsoft.graph.tips": "Use $select to choose only the properties your app needs, as this can lead to performance improvements. For example: GET deviceManagement/depOnboardingSettings?$select=appleIdentifier,dataSharingConsentGranted", "value": [] }

So in the code, it needs to read from .value

NOTE: I see the same issue with almost all the tests in this PR.

Can you confirm if these are working in your tenant?

I can see that in Test-MtIntuneRbacGroupsProtected you are reading the .value property correctly.

merill · 2025-11-25T23:08:33Z

powershell/public/maester/intune/Test-MtIntuneDiagnosticSettings.ps1

+        $diagnosticSettingsRequest = Invoke-AzRestMethod -Method GET -Path "/providers/microsoft.intune/diagnosticSettings?api-version=2017-04-01-preview"
+        $diagnosticSettings = $diagnosticSettingsRequest | Select-Object -ExpandProperty Content | ConvertFrom-Json | Select-Object -ExpandProperty value
+
+        $testResultMarkdown = "Intune Diagnostic Settings:`n"


The table is shown even when there are no logs. We should ideally not show an empty table with no data.

Also, It will be good to provide a relevant message when the test fails. So it says something like.

Intune diagnostic settings are not configured to include audit logs.

merill · 2025-11-25T23:10:53Z

powershell/public/maester/intune/Test-MtAppleAutomatedDeviceEnrollmentToken.ps1

+.LINK
+    https://maester.dev/docs/commands/Test-MtAppleAutomatedDeviceEnrollmentToken
+#>
+function Test-MtAppleAutomatedDeviceEnrollmentToken {


Errors out in tenants with no ADE configured.

Similar issue with 1094, 1095, 1097, 1098,

Expected to Fail.

merill · 2025-11-25T23:13:19Z

powershell/public/maester/intune/Test-MtOperationApprovalPolicies.ps1

+        return $null
+    }
+
+    try {


Test passes but no values shown in table.

merill · 2025-11-25T23:14:16Z

powershell/public/maester/intune/Test-MtFeatureUpdatePolicy.ps1

+.LINK
+    https://maester.dev/docs/commands/Test-MtFeatureUpdatePolicy
+#>
+function Test-MtFeatureUpdatePolicy {


Errors out:

nicolonsky · 2025-12-04T11:39:02Z

Hi @merill, I changed the behaviour of the failing tests and re-tested them in my tenant after deleting some of the tokens. All tests referring to a token or connector are now only performed if they exist, otherwise test execution is skipped. Based on my opinion this approach reflects the 'as-is-state' better in the test report and is more comprehensive:

Example test results for an individual check:

merill · 2025-12-05T13:04:13Z

Awesome. Looks good now @nicolonsky !!

nicolonsky added 10 commits November 11, 2025 14:45

Add Intune licensing checks

9f149e3

Create Device Registration Checks

97a35ef

Intune checks

118d6bb

WIP: Intune checks

037be6c

WIP: Intune checks

431bd5c

WIP: Intune checks

f94c7f1

Merge branch 'main' into main

f124500

WIP: Revert unintended changes

a981f36

WIP: Intune checks

a8f0522

WIP: Intune checks

2915bdb

nicolonsky marked this pull request as ready for review November 20, 2025 15:10

nicolonsky requested review from a team as code owners November 20, 2025 15:10

SamErde requested a review from Copilot November 20, 2025 18:55

Copilot started reviewing on behalf of SamErde November 20, 2025 18:55 View session

Copilot finished reviewing on behalf of SamErde November 20, 2025 18:57

Copilot AI reviewed Nov 20, 2025

View reviewed changes

Fix PR typos

ef8353c

nicolonsky requested a review from Copilot November 21, 2025 09:39

Copilot started reviewing on behalf of nicolonsky November 21, 2025 09:39 View session

Copilot finished reviewing on behalf of nicolonsky November 21, 2025 09:40

Copilot AI reviewed Nov 21, 2025

View reviewed changes

Fix PR Copilot findings

3e00605

nicolonsky requested a review from Copilot November 21, 2025 09:48

Copilot started reviewing on behalf of nicolonsky November 21, 2025 09:48 View session

Copilot finished reviewing on behalf of nicolonsky November 21, 2025 09:51

Copilot AI reviewed Nov 21, 2025

View reviewed changes

Fix PR Copilot findings^2

8a30046

merill requested changes Nov 25, 2025

View reviewed changes

merill assigned nicolonsky Nov 25, 2025

merill added the in-progress label Nov 25, 2025

nicolonsky added 3 commits December 4, 2025 07:46

Fix tests for unconfigured tenants

f81acdc

Fix empty collection checks & PR feedback

3d95ed2

Merge branch 'main' into main

0773c49

nicolonsky force-pushed the main branch from 454781c to 0773c49 Compare December 4, 2025 11:28

nicolonsky requested a review from merill December 4, 2025 19:57

Fixeed bug in inoke-graph

95b3d58

merill merged commit 1e4d680 into maester365:main Dec 5, 2025

SamErde added intune Microsoft Intune and removed in-progress labels Jan 22, 2026

Adding Microsoft Intune Checks #1327

Adding Microsoft Intune Checks #1327

Uh oh!

Conversation

nicolonsky commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Contribution Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

f-bader commented Nov 21, 2025

Uh oh!

merill left a comment

Choose a reason for hiding this comment

Uh oh!

merill Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

merill Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

merill Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

merill Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

merill Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

nicolonsky commented Dec 4, 2025

Uh oh!

merill commented Dec 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

nicolonsky commented Nov 20, 2025 •

edited

Loading