IntuneAutomation Scripts 2026.07.30

Azure Automation compatibility

• Supports deployment into an existing Azure Automation account without trying to recreate the account or replace its region and identity settings.
• Uses the PowerShell 7.4 runtime with Microsoft.Graph.Authentication 2.38.1 in generated templates.
• Removes unsupported PowerShell parameter sets from runbook entry points and adds explicit parameter validation.
• Uses portal-safe string values for Boolean runbook inputs, including true, false, 1, and 0.
• Adds safe dry-run parameters where scripts can otherwise perform consequential operations.

Microsoft Graph reliability

• Correctly handles report endpoints that return octet-stream files.
• Handles empty Graph collections without failing or producing misleading counts.
• Stops on paging failures instead of returning incomplete results.
• Fixes URI interpolation and normalizes Graph disconnect behavior.

Permissions and notification safety

• Aligns script metadata and deployment guidance with 22 Microsoft Graph application permissions used across 69 scripts.
• Adds missing DeviceManagementScripts.Read.All declarations where required.
• Uses BitLockerKey.ReadBasic.All for recovery-key existence and count checks. Full secret access is reserved for the separate local backup workflow.
• Keeps sender and recipient addresses as runtime inputs. No personal email address is embedded in scripts or templates.

Deployment and generated assets

• Publishes 52 Azure Automation compatible ARM templates.
• Clearly excludes 17 local-only or Intune remediation scripts from runbook template generation.
• Adds the get-outdated-ios-devices-report runbook and template.
• Adds repeatable template generation and validation tooling.

Certification results

• All 52 deployable runbooks reached Completed in the live Azure Automation certification run.
• All 52 jobs had an empty error stream.
• 51 jobs had an empty warning stream.
• One job reported a genuine tenant configuration warning because four Windows devices had no Firewall or Attack Surface Reduction policy assignment.
• Restart, sync, and wipe workflows were tested in dry-run mode against an empty test group.
• Local regression validation passed 76 PowerShell checks and validated all 52 ARM templates.

Website and dependency security

• Makes the support email address runtime configurable.
• Removes the critical npm audit finding.
• Two high-severity sharp dependency advisories remain. The automated resolution requires a breaking framework dependency change, so it is intentionally deferred.

Upgrade notes

• Existing imported runbooks are not updated automatically. Redeploy or reimport the desired scripts to receive these fixes.
• Grant the managed identity only the application permissions declared by each deployed script, or use the included permission helper for the selected runbook set.
• Email notifications require sender and recipient values at run time and an appropriately licensed sender mailbox.
• File-based and local-only scripts intentionally do not have Azure Automation ARM templates.
• Review renamed or normalized Boolean parameters before updating existing schedules or webhooks.