# IntuneManagement: cross-tenant Intune backup, import and comparison with PowerShell and a WPF UI

> IntuneManagement is a PowerShell and WPF tool that exports, imports, copies and compares Intune and Azure policies across tenants, handling assignments, group creation and dependency ordering automatically. A beta of the next major version adds macOS and Linux support and exposes every operation as a standalone PowerShell command.

**Micke-K/IntuneManagement** — Copy, export, import, delete, document and compare policies and profiles in Intune and Azure with PowerShell script and WPF UI. Import ADMX files and registry settings with ADMX ingestion. View and edit PowerShell script.  

- Repository: https://github.com/Micke-K/IntuneManagement
- Stars: 2,090 · Forks: 381
- Language: PowerShell
- License: MIT
- Published: 2026-10-11 · Updated: 2026-10-11 · Language: en
- Canonical page: https://hysenlabs.com/projects/micke-k-intunemanagement

## What IntuneManagement solves and who uses it

Migrating an Intune environment from one Azure tenant to another without a purpose-built tool requires manually recreating every policy, profile and assignment in the destination. IntuneManagement replaces that manual work by handling the object export, remapping IDs across tenant boundaries, recreating groups that exist in the source but not the destination, and preserving group attributes such as name, description, type and dynamic membership rules.

The dependency problem is where the tool earns its complexity. Some Intune objects cannot be imported independently: an App Protection policy needs its associated App present, a Policy Set needs Compliance Policies, and objects carry Scope Tags that reference other objects. IntuneManagement tracks these relationships through the exported JSON files and presents an import sequence in the Bulk Import form, ordered by dependency level. Reading the import sequence in the Bulk Import form before starting lets an administrator verify that each dependency tier will be satisfied before the process reaches it.

The audience is Intune administrators who move entire environments between tenants, maintain backup snapshots of production configurations, or compare two environments to find drift.

## MSAL authentication and the foundation plus extension module architecture

Every request to Intune and Azure goes through the Microsoft Authentication Library (MSAL), which obtains tokens for 2 separate audiences: the Microsoft Graph API and the Azure Management API. The app defaults to the Intune PowerShell Azure Enterprise Application and uses the permissions already granted to it. Requesting permissions beyond that set means disabling the 'Use Default Permissions' setting, which generates a consent prompt if the requesting permission has not been pre-approved for the organization.

The codebase is split into a foundation and extension layer. The 2 foundation modules (CloudAPIPowerShellManagement and Core) handle authentication, settings, logging and the WPF window frame. Extension modules in the Extensions/ directory contain the object-specific logic: what API endpoints to call for Device Configuration profiles versus App Protection policies, how to serialize them, and what dependencies to track. The architecture means adding support for a new object type is an extension addition rather than a core change, and removing a feature is equally contained.

Bundling the MSAL DLLs in Bin/ removes a dependency that would otherwise block authentication on machines without Az or MSAL.PS. Those bundled DLLs can be replaced with copies downloaded from Microsoft directly, with links in MSALInfo.md, if policy requires verifying the provenance of every dependency.

## Starting the app and unblocking the CMD launcher before first run

4 entry points exist for launching IntuneManagement. Start.cmd is the standard launch. Start-WithConsole.cmd keeps the command prompt visible so the log is readable during the session, which is useful for diagnosing issues. Start-WithJson.cmd takes a JSON configuration. Start-IntuneManagement.ps1 is the PowerShell entry point and the script used for headless runs.

A prerequisite step that a quick read of the setup instructions might miss: the CMD files must be manually unblocked by the user before any of those entry points can work. The reason is sequential. Windows blocks files downloaded from the internet, and the CMD launcher is one of them. The README notes that the script will unblock 'all other files' once it runs, but the CMD launcher itself is the file that needs to execute first. It cannot unblock itself. So the unblocking step for CMD files must happen before the first launch, outside the script.

For access to multiple tenants through a single account, enabling 'Get Tenant List' in Settings enumerates available tenants, including those the account has guest access to. This may generate a consent prompt.

## Silent Batch Job for DevOps pipelines: four supported operations without a UI

4 operations (Export, Import, Documentation and Compare) can all run without opening the WPF window. This headless mode is beta. It requires an Azure App configured with either a client secret or a certificate, plus delegated permissions to the Graph objects the operation needs to access.

The workflow starts in the UI. The Bulk Export or Bulk Import form has a control for each setting the silent run needs. After configuring a run in the form, exporting it produces a JSON file. That file can then be passed on the command line in a DevOps environment. Path and filename in that file support 3 variables: %Date% expands to yyyy-MM-dd, %DateTime% expands to yyyyMMdd-HHmm, and %Organization% expands to the tenant name (which requires at least read permission on the Organizations API).

The command-line syntax uses these parameters:

```powershell
Start-IntuneManagement.ps1 -Silent -TenantId "<*TenantID*>" -SilentBatchFile <*PathToFile*> [-AppId <*AppId*>] [-Secret <*Secret*> | -Certificate <*CertThumb*>]
```

A concrete example from the README:

```powershell
Start-IntuneManagement.ps1 -Silent -SilentBatchFile "C:\Temp\BatchImport.json" -TenantId "00000000-0000-0000-0000-000000000000" -AppId "00000000-0000-0000-0000-000000000001" -Secret "KJ76P~B9###9-.8I####-_MySecret"
```

Two default settings files, BulkExport.json and BulkImport.json, are generated separately and must be manually merged if a single file is needed.

## Unsigned scripts and what to verify before approving IntuneManagement for your organization

IntuneManagement's PowerShell scripts are not code-signed. This creates two friction points on first setup: an execution policy warning if the machine enforces code signing, and a download block on files extracted from a zip archive. The tool clears the download block on its own files once it is running, but the same constraint applies to the CMD launcher that starts it, and no script can clear a block on the file being asked to execute.

The README's response to this is transparency rather than a mitigation. The PowerShell source code is open for review, and the MSAL DLL in Bin/ can be replaced with a copy downloaded from Microsoft's own repositories. Links are in MSALInfo.md. The README states this directly under a security note, which lets an administrator make an informed decision rather than discover the warning at runtime.

Organizations with a PowerShell execution policy that requires code signing will need a policy exception to run IntuneManagement. SECURITY.md at the repository root covers the project's security disclosure process.

## Version 3 for Windows-only use and the version 4 beta for cross-platform automation

The master branch holds the current production build, which runs on Windows and uses WPF for its UI. WPF is a Windows-only presentation layer, so macOS and Linux are not supported in this branch. The README states that the current stable build stays supported while a complete rewrite is finalized.

That rewrite is available as a pre-release on the v4 branch; the 4.0.0-beta1 release and the last push to the repository both landed on 2026-09-23. 2 changes distinguish the rewrite from the current stable build: every operation becomes a standalone PowerShell command, removing the WPF window as a requirement, and the rewrite runs on macOS and Linux. The automation capability this enables goes further than the Silent Batch Job feature, since each operation can be scripted individually rather than through a preconfigured batch file.

The repository provides separate issue forms for beta and stable feedback to keep reports directed correctly.

## What the native Intune portal lacks that IntuneManagement provides

Microsoft's Intune portal in Endpoint Manager handles day-to-day policy creation and assignment for a single tenant. It does not offer bulk export of all policies to JSON files, comparison between two tenants to identify drift, or a scripted import that resolves assignment remapping across tenant boundaries automatically. IntuneManagement covers that gap for organizations managing more than one Intune environment.

For teams that only administer a single tenant and never need to migrate or clone, most of IntuneManagement's complexity is unused. The comparison feature and the dependency-aware Bulk Import are valuable proportionally to the number of tenants being managed.

ADMX ingestion adds a further capability beyond standard policy management. The tool can import ADMX files and registry settings into Intune's custom profile mechanism, documented in ADMXImport.md in the repository. This path is for organizations that already manage Group Policy Objects and want to replicate that configuration in Intune without rebuilding each setting manually. The repository root contains example images for the ingestion process and OMA-URI configuration.

## Conclusion

IntuneManagement suits Intune administrators who need to back up, migrate or compare policies across tenants and want more than the native portal provides. Skip it if your team cannot accept unsigned PowerShell scripts, since the README's explanation of the unblocking behavior may not satisfy your security policy. Before using it in production, run a full export of your current tenant and confirm that every policy type you depend on exports correctly, then import to a test environment and verify that assignments are remapped correctly. Generate the JSON settings files from the Bulk Export and Bulk Import forms before attempting unattended runs.

## FAQ

### What is IntuneManagement?

IntuneManagement is a PowerShell and WPF application for exporting, importing, copying, comparing and documenting Intune and Azure policies. It supports cross-tenant migration including assignments, automatic group creation and dependency-ordered bulk import.

### Does IntuneManagement run on macOS or Linux?

The current stable build on the master branch requires Windows because it uses WPF for its UI. A cross-platform rewrite is available as a pre-release on the v4 branch that runs on macOS and Linux and exposes each operation as a standalone PowerShell command.

### Can IntuneManagement run without a UI for automation?

Yes, the Silent Batch Job feature (beta) supports Export, Import, Documentation and Compare without the WPF window. It requires an Azure App with a secret or certificate, and the settings come from a JSON file generated by the Bulk Export or Bulk Import form in the UI.

### Why does IntuneManagement show a security warning on Windows?

The scripts are not code-signed, so Windows blocks them on download and displays a warning on first run. CMD files must be manually unblocked before launch. Once running, the script unblocks the remaining files, and the MSAL DLL can be replaced with a download from Microsoft's repositories if needed.

### What authentication does IntuneManagement use?

Authentication uses MSAL and communicates through the Microsoft Graph API and Azure Management API. By default the app uses the Intune PowerShell Azure Enterprise Application with its existing permissions; additional permissions require disabling 'Use Default Permissions' in Settings.

## Sources

- [Issues](https://github.com/Micke-K/IntuneManagement/issues)
- [License: MIT](https://github.com/Micke-K/IntuneManagement/blob/master/LICENSE)
- [Micke-K/IntuneManagement on GitHub](https://github.com/Micke-K/IntuneManagement)
- [README](https://github.com/Micke-K/IntuneManagement/blob/master/README.md)
- [Releases](https://github.com/Micke-K/IntuneManagement/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/micke-k-intunemanagement