intune-graph

Query and manage Microsoft Intune devices, policies, and apps through the Microsoft Graph API.

2|Updated Jul 28, 2026
One-click install
npx skills add https://github.com/mbadali25/useful-claude-add-ons --skill intune-graph-mbadali25
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: intune-graph
Source: https://github.com/mbadali25/useful-claude-add-ons/tree/main/skills/intune-graph
Command: npx skills add https://github.com/mbadali25/useful-claude-add-ons --skill intune-graph-mbadali25

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

What problem does it solve? Managing Microsoft Intune at scale means fighting the Graph API's quirks: inconsistent OData filtering, aggressive throttling, sparse list responses, buried error messages, and auth setups that fail in confusing ways. This Skill provides tested scripts and reference guides that handle auth, paging, retries, and the Export API so device troubleshooting, policy investigation, and app deployment don't require re-solving the same API problems every time. ## Core Features & Use Cases - Device lookup and troubleshooting: Find devices by name, user, or compliance state; diagnose why a device is non-compliant down to the exact failing setting; queue remote actions like sync, reboot, wipe, or retire with confirmation safeguards. - Compliance and configuration management: Inspect compliance policies, legacy configuration profiles, and settings catalog policies, and answer "which policy set this setting" directly from device state. - Win32/LOB app deployment: Walk through the six-stage .intunewin upload flow, assignments, and install-failure diagnosis including detection-rule error codes. - Fleet-wide reporting: Run Export API jobs end to end (submit, poll, download, unzip) for inventory, compliance, and app install reports across thousands of devices in minutes. - Use Case: A user asks "why is this laptop showing non-compliant?" The Skill verifies auth with auth.py --check, pulls the device's compliance policy states via graph.py, and names the exact failing setting and responsible policy. ## Quick Start Ask the assistant to find a managed device by name in Intune and show its compliance state and last check-in time.

Frequently Asked Questions about intune-graph

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I query Intune devices with the Microsoft Graph API?

Use the deviceManagement/managedDevices endpoint with OData filters on fields like deviceName, userPrincipalName, complianceState, and operatingSystem. The graph.py script handles paging through @odata.nextLink and honors Retry-After headers when Intune throttles requests.

How do I authenticate to Microsoft Graph for Intune automation?

Three modes work: client credentials with an app registration for unattended jobs, device code flow for interactive troubleshooting that respects Intune RBAC, and Azure CLI token passthrough for quick local work. App-only tokens need Application permissions plus admin consent, not delegated ones.

Why does Graph return 403 when my app registration lists the permission?

A listed permission is not the same as granted consent — admin consent must be clicked until the column reads Granted for the tenant. App-only tokens also fail if you added Delegated permissions instead of Application permissions. Run auth.py --check to see the token's actual scopes.

Why do Intune device fields like serial number or MAC address come back null?

List calls on managedDevices return sparse results — fields like ethernetMacAddress, physicalMemoryInBytes, and totalStorageSpaceInBytes only populate on an individual GET with an explicit $select. Re-fetch the single device before concluding data is missing from the tenant.

How do I export Intune device inventory for a large tenant?

Use the Export API at deviceManagement/reports/exportJobs instead of paging list endpoints, which takes hours and gets throttled on large tenants. The export_report.py script runs the full submit, poll, download, and unzip cycle and returns CSV reports like DevicesWithInventory in about a minute.

When should I use the Graph beta endpoint instead of v1.0 for Intune?

Default to v1.0 and use beta only when the resource does not exist in v1.0, notably the settings catalog (configurationPolicies), Win32 app content upload endpoints, and some report types. Beta can change without notice, so document why a script depends on it.