IntuneAutomation Scripts 2026.07.30

Azure Automation compatibility

• Supports deployment into an existing Azure Automation account without trying to recreate the account or replace its region and identity settings.
• Uses the PowerShell 7.4 runtime with Microsoft.Graph.Authentication 2.38.1 in generated templates.
• Removes unsupported PowerShell parameter sets from runbook entry points and adds explicit parameter validation.
• Uses portal-safe string values for Boolean runbook inputs, including true, false, 1, and 0.
• Adds safe dry-run parameters where scripts can otherwise perform consequential operations.

Microsoft Graph reliability

• Correctly handles report endpoints that return octet-stream files.
• Handles empty Graph collections without failing or producing misleading counts.
• Stops on paging failures instead of returning incomplete results.
• Fixes URI interpolation and normalizes Graph disconnect behavior.

Permissions and notification safety

• Aligns script metadata and deployment guidance with 22 Microsoft Graph application permissions used across 69 scripts.
• Adds missing DeviceManagementScripts.Read.All declarations where required.
• Uses BitLockerKey.ReadBasic.All for recovery-key existence and count checks. Full secret access is reserved for the separate local backup workflow.
• Keeps sender and recipient addresses as runtime inputs. No personal email address is embedded in scripts or templates.

Deployment and generated assets

• Publishes 52 Azure Automation compatible ARM templates.
• Clearly excludes 17 local-only or Intune remediation scripts from runbook template generation.
• Adds the get-outdated-ios-devices-report runbook and template.
• Adds repeatable template generation and validation tooling.

Certification results

• All 52 deployable runbooks reached Completed in the live Azure Automation certification run.
• All 52 jobs had an empty error stream.
• 51 jobs had an empty warning stream.
• One job reported a genuine tenant configuration warning because four Windows devices had no Firewall or Attack Surface Reduction policy assignment.
• Restart, sync, and wipe workflows were tested in dry-run mode against an empty test group.
• Local regression validation passed 76 PowerShell checks and validated all 52 ARM templates.

Website and dependency security

• Makes the support email address runtime configurable.
• Removes the critical npm audit finding.
• Two high-severity sharp dependency advisories remain. The automated resolution requires a breaking framework dependency change, so it is intentionally deferred.

Upgrade notes

• Existing imported runbooks are not updated automatically. Redeploy or reimport the desired scripts to receive these fixes.
• Grant the managed identity only the application permissions declared by each deployed script, or use the included permission helper for the selected runbook set.
• Email notifications require sender and recipient values at run time and an appropriately licensed sender mailbox.
• File-based and local-only scripts intentionally do not have Azure Automation ARM templates.
• Review renamed or normalized Boolean parameters before updating existing schedules or webhooks.

IntuneAutomation Scripts 2026.07.29

Fixes

Cleanup Duplicate Intune Device Records 1.2

The script now clearly states that it evaluates duplicate Intune managed-device records only. Its title, synopsis, examples, parameter help, report headings, summaries, and MCP catalog metadata now consistently describe that scope.

This clarification addresses confusion when an administrator sees duplicate-looking Windows objects in Microsoft Entra ID but the script reports only Intune duplicates. The script queries /deviceManagement/managedDevices, so Entra-only objects with no Intune management record are intentionally outside its results.

Safety and reliability

• Added a runtime scope banner before device retrieval.
• Added explicit warnings that Microsoft Entra device objects and Windows Autopilot registrations are not evaluated or removed.
• Documented that Hybrid Autopilot deployments can create expected duplicate-looking Entra objects.
• Preserved the existing serial-number matching, keeper selection, confirmation, WhatIf, and deletion behavior.

These changes reduce the risk of treating an Autopilot registration anchor as an obsolete Intune device record.

Compatibility

There are no breaking changes. Parameters, Microsoft Graph permissions, endpoint selection, exported report shape, and deletion behavior are unchanged. Existing automation can continue using the script without modification.

Upgrade notes

Administrators using a downloaded or imported copy should replace or reimport the script to receive version 1.2 and its updated safety guidance. Azure Automation runbooks do not automatically replace previously imported script content.

Known limitation

The script does not find or clean duplicate Microsoft Entra device objects or Windows Autopilot registrations. This remains intentional because those records require separate lifecycle checks, especially in Hybrid Autopilot environments.

IntuneAutomation Scripts 2026.07.28

Fixes

• Updated 56 Azure Automation compatible Microsoft Graph scripts so script-level progress, outcomes, no-op decisions, warnings, and completion summaries are recorded in standard job output.
• This resolves runbooks that appeared to stop immediately after a successful Microsoft Graph connection because later messages were written only to the Information stream.
• All eight notification runbooks now visibly report data retrieval, no alert required paths, email delivery attempts, and final results in Azure Automation job history.

Reliability

• Kept helper-function diagnostic logging off the output stream where output pollution could alter returned data, preserving existing behavior.
• Added AST-based validation that fails CI if future scripts or templates introduce script-scope Write-Information logging.
• All 75 PowerShell scripts passed repository analysis. MCP build and verification completed with 38 checks passed.

Version and website metadata

• Bumped the .VERSION field by one minor step for each of the 56 affected scripts.
• Added a changelog entry and set .LASTUPDATE to 2026-07-28 for every affected script.
• Refreshed the script index, Azure deployment templates, and test artifacts. The website now displays the updated versions, dates, and changelog entries.

Compatibility and upgrade notes

• No Microsoft Graph permissions or script parameters changed.
• No breaking changes are included.
• Existing Azure Automation users must import the updated script and publish a new runbook version, or redeploy from the updated Azure template, to receive the improved job-history output.
• The 12 remediation scripts were not version-bumped because they did not contain the affected runbook logging pattern.
• Fine-grained helper-function diagnostics remain on the Information stream to protect function return values. Script-level outcomes and summaries are visible in normal job history.

Traceability

• Implementation and review: #24

intuneautomation-mcp v1.0.1

Renamed the MCP README title to "IntuneAutomation MCP". No functional changes.

intuneautomation-mcp v1.0.0

Initial public release of @ugurkocde/intuneautomation-mcp — an MCP server to search, retrieve, and author IntuneAutomation PowerShell scripts from Claude Code, Codex, and any MCP client.

• 5 tools, 3 resources, 2 prompts over stdio; read-only, no auth, no telemetry
• Fetches the script catalog and authoring guide from GitHub, with an offline fallback
• Install (Claude Code): claude mcp add intuneautomation -- npx -y @ugurkocde/intuneautomation-mcp

See mcp/README.md for per-client setup and mcp/CHANGELOG.md for details.