macOS_IntuneManagement/CHANGELOG_macOS_IntuneToolkit.md

macOS Intune Toolkit Changelog

2026-08-07 — v4.4.0 — Folder browser for Export/Import path prompts

Added

• Scripts/Private/Start-IntuneManagementTui.ps1
  • New Select-FolderPath helper: when fzf is available, the Export/Import root folder prompt (and the report flow's export/backup-root/output-dir prompts) becomes an interactive folder browser — navigate into subfolders, go up with .., confirm the current folder, or type a path manually. Read-Host alone has no tab-completion (that's a top-level PSReadLine feature, not available to script prompts), so this reuses the fzf dependency already required for menus instead of building custom completion.
  • Falls back to a plain Read-Host prompt when fzf isn't installed — no regression from prior behavior.

2026-08-07 — v4.3.1 — Fix redundant action prompt

Fixed

• Scripts/Private/Start-IntuneManagementTui.ps1
  • Choosing 1. Export policies or 2. Import policies in the launcher still re-asked "Select action" (Export/Import/DeployCISBaseline/GenerateReports) — the same missing-passthrough issue as the tenant re-prompt fix below, just for -Action. Now accepts -Action and skips the prompt when it's already supplied.
• Start-IntuneToolkit.ps1 / Scripts/Start-HeadlessIntune.ps1
  • Menu items 1/2 now pass -Action Export / -Action Import through to the headless script and on to the TUI.

2026-08-07 — v4.3.0 — Bulk delete tool and TUI fixes

Added

• Scripts/Bulk-DeletePolicies.ps1
  • Select object type, filter by name, multi-select objects, and delete them from the tenant.
  • Requires typing DELETE to confirm since the operation is irreversible. Supports -WhatIf dry-run.
  • Wired into Start-IntuneToolkit.ps1 as menu item 21. Bulk delete policies.

Fixed

• Start-IntuneToolkit.ps1
  • Fixed an infinite loop when fzf is not installed: the numbered-menu fallback returned "EXIT" for the tenant-selection Exit option, but the check only matched the fzf path's "[Exit]" string, so choosing Exit was silently ignored and the tenant became the literal string "EXIT".
• Scripts/Private/Start-IntuneManagementTui.ps1
  • The interactive Export/Import/GenerateReports/DeployCISBaseline flow always re-prompted for a Tenant ID even when the tenant was already selected in the outer launcher, because it was invoked with no parameters and had an empty param() block. It now accepts -TenantId and skips its three tenant prompts when the value is already supplied.
  • Clarified the "Name filter" prompt text — it's a plain case-insensitive substring match, not a regex (the underlying match escapes the value via [RegEx]::Escape()), so the old '^Win-OIB-' example was misleading.
• Scripts/Start-HeadlessIntune.ps1
  • Passes -TenantId through to Start-IntuneManagementTui.ps1 so the fix above takes effect.

2026-06-23 — v4.2.0 — Entra directory role membership export

Added

• Scripts/Export-EntraRoleMembership.ps1

  • Exports all active and PIM-eligible Microsoft Entra directory role memberships to CSV.
  • Expands group-assigned roles to transitive group members.
  • Marks whether each role is privileged.
  • Supports the toolkit's standard -AuthMode (AppOnly, Browser, DeviceCode) and reads saved credentials from Settings.json/macOS Keychain.

• Start-IntuneToolkit.ps1

  • Added menu item 20. Export Entra role membership that launches the new script and prompts for the CSV output path.

• README.md

  • Listed Scripts/Export-EntraRoleMembership.ps1 in the entry points and documented its purpose.

Repository hygiene

• .gitignore
  • Ignore the local accounts/ folder and stray operational shell scripts (deploy.sh, restart_gateways.sh).

---

2026-06-22 — Expanded settings report coverage and Conditional Access documentation

Added

• Scripts/Export-SettingsReport.py

  • Greatly expanded coverage: Settings Catalog, Compliance Policies V2, Endpoint Security, Device Management Intents, Administrative Templates, Device Configuration (with OMA-URI expansion), Compliance Policies V1, PowerShell/Shell/Compliance/Health scripts (base64-decoded previews), App Protection, App Configuration, Update Policies, Enrollment restrictions, Autopilot, W365, Filters, and more.
  • Added dedicated processors for intent-style settings (_Settings.json companion files) and ADMX definition values.
  • Added base64 decoding for script content with a configurable preview length.

• Scripts/Invoke-ConditionalAccessDocumentation.ps1

  • New menu-driven Conditional Access policy documentation script (menu item 19 in Start-IntuneToolkit.ps1).
  • Exports CA policies to CSV and optionally Excel, resolving object IDs to display names.

• Start-IntuneToolkit.ps1

  • Added menu item 19. Document Conditional Access policies.

Fixed

• .gitignore
  • Ignore Scripts/ConditionalAccessDocumentation.csv and .xlsx output files so tenant-specific documentation is not committed by accident.

---

2026-06-14 — Auto-export Settings Catalog definitions for report resolution

Added

• Extensions/EndpointManager.psm1

  • Start-PostExportSettingsCatalog now auto-exports /deviceManagement/configurationSettings to <backup-root>/configurationSettings.json the first time a Settings Catalog policy is exported.
  • New helper Start-ExportSettingsCatalogDefinitions fetches all pages of setting definitions and writes them next to the policy folders.
  • This lets Scripts/Export-SettingsReport.py resolve settingDefinitionId values to the human-readable names shown in the Intune portal without any manual steps.
  • Errors during definition export are logged but do not fail the policy export.

• Scripts/Export-SettingsReport.py

  • New Platform column between Policy and Setting.
  • For Settings Catalog, platform is read from the platforms field (e.g. macOS, windows10).
  • For legacy policies, platform is inferred from platform/platformType or from @odata.type (e.g. #microsoft.graph.iosCompliancePolicy → iOS).

Fixed

• Extensions/MSGraph.psm1

  • Get-GraphMetaData now stores GraphMetaData.xml in the cross-platform data folder (Get-CloudApiDataFolder) instead of the literal Windows path %LOCALAPPDATA%\CloudAPIPowerShellManagement\GraphMetaData.xml.
  • Removed the stray %LOCALAPPDATA%\CloudAPIPowerShellManagement folder from the repository and moved the existing GraphMetaData.xml to the correct macOS app-data location.

• Extensions/MSALAuthentication.psm1

  • On non-Windows platforms the toolkit now skips TokenCacheHelperEx compilation with an informational log instead of throwing a System.Security.Cryptography.ProtectedData.dll error.
  • Applied the same skip to the legacy Add-MSALPrereq_old function for consistency.

• .gitignore

  • Removed the literal %LOCALAPPDATA% ignore patterns; kept GraphMetaData.xml and CloudAPIPowerShellManagement/ ignores as safeguards.

Modified

• AGENTS.md
  • Added Scripts/Export-SettingsReport.py to the main entry points table and noted the automatic Settings Catalog name resolution.

---

2026-04-16 — v4.1.0 — Accountability, PIM & Auth Management

Modified

• Scripts/Initialize-IntuneAuth.ps1

  • App registrations are now named after the authenticated Entra user (e.g., IntuneManagement-tomas.kracmar@cqre.net) instead of the local OS username. This improves audit-log traceability when multiple admins use the toolkit against the same tenant.
  • Added -Delete switch to remove local tenant credentials (Settings.json + macOS Keychain) without touching the Entra app registration.
  • Added -DeleteApp switch to delete both the Entra app registration and local credentials.
  • Onboarding now automatically caches the tenant display name after auth setup, so the TUI shows friendly names immediately.
  • Added Organization.Read.All to the Connect-MgGraph scopes to support tenant name caching.

• Scripts/Start-IntuneToolkit.ps1

  • Added menu items 14 (delete local auth) and 15 (delete auth + app registration) to the TUI.
  • Selecting "[+ Onboard new tenant]" now runs the auth initializer immediately and restarts the launcher, instead of dropping into the main menu for an unconfigured tenant.
  • The TUI now exits cleanly after deleting tenant auth.

• README.md

  • Added Accountability & PIM caveats section explaining the trade-offs of app-only auth versus delegated auth, and how app naming affects audit logs.

---

2026-04-13 — API Permissions Sync for Initialize-IntuneAuth.ps1

Modified

• Scripts/Initialize-IntuneAuth.ps1
  • Unified the required Microsoft Graph application permissions into a single $requiredRoles list defined before app creation/reuse logic:
    • DeviceManagementApps.ReadWrite.All
    • DeviceManagementConfiguration.ReadWrite.All
    • DeviceManagementManagedDevices.ReadWrite.All
    • DeviceManagementScripts.ReadWrite.All
    • DeviceManagementServiceConfig.ReadWrite.All
    • DeviceManagementRBAC.ReadWrite.All
    • Group.ReadWrite.All
    • Directory.Read.All
    • User.Read.All
    • Organization.Read.All
    • Policy.ReadWrite.ConditionalAccess
    • Agreement.ReadWrite.All
    • CloudPC.ReadWrite.All
    • Application.Read.All
  • Existing app patching: When reusing an existing app registration, the script now inspects its current RequiredResourceAccess. If any required permissions are missing, it patches the app via Update-MgApplication, refreshes the local app object, and the downstream admin-consent loop automatically grants consent for the newly added roles.

---

Prior delivered changes (context summary)

New scripts added

• Scripts/Bulk-AppAssignment.ps1 — bulk-assign apps to groups/All Users/All Devices
• Scripts/Bulk-AssignmentManager.ps1 — add/remove assignments for any policy type using correct @odata.type and bulk /assign endpoint
• Scripts/Backup-Restore-Assignments.ps1 — JSON backup with cross-tenant group name resolution
• Scripts/Export-AssignmentsToCsv.ps1 — CSV and Markdown documentation output
• Scripts/Bulk-RenamePolicies.ps1 — search/replace, add/strip prefix across displayName/description
• Scripts/Bulk-DeviceOperations.ps1 — delete/retire/wipe/lock/sync with -WhatIf safeguards
• Scripts/Start-IntuneToolkit.ps1 — unified reverse-numbered fzf-based launcher
• Scripts/Initialize-IntuneAuth.ps1 — one-time Entra app + secret + Keychain setup

Core / Extensions / Headless changes

• Extensions/MSGraph.psm1
  • Invoke-GraphRequest now throws on 4xx/5xx HTTP errors (was silently returning null)
  • Added -AllPages support to Get-GraphObjects and toolkit queries for large tenants
• Headless/IntuneManagement.Headless.psm1
  • Expanded Get-DefaultIntunePolicyObjectTypes to ~45 types, including DeviceManagementIntents
  • Threaded NameSearchPattern / NameReplacePattern through export/import/action flows
• Settings Catalog fixes
  • Uses name property instead of displayName for queries/labels
  • Assignments use #microsoft.graph.deviceManagementConfigurationPolicyAssignment and the bulk POST …/assign endpoint
• TUI / fzf
  • Spacebar toggle, Esc to go back, reverse numbering (10→1) in unified launcher

2026-04-13 — Declarative Baseline Deployer

Added

• Scripts/Deploy-IntuneBaseline.ps1

  • YAML-driven one-click deployment of Intune policies + assignments to new tenants.
  • Supports global and per-policy name mutations (search/replace or prefix).
  • Auto-creates cloud-only security groups if missing.
  • Idempotent imports with configurable conflict resolution (Skip, Update, Error).
  • Full -WhatIf dry-run support.
  • Handles 20+ policy types including Settings Catalog (name property), EndpointSecurity (settings file companion upload), and Applications.
  • Integrates with existing auth stack (Settings.json / macOS Keychain).

• Scripts/ConvertTo-IntuneBaseline.ps1

  • Converts an existing toolkit export folder into a baseline YAML skeleton.
  • Maps folder names to baseline types, extracts display names, and generates empty assignment blocks.

• Baselines/OpenIntuneBaseline.example.yaml

  • Example manifest demonstrating groups, mutations, policies, and assignments.

Dependencies

• powershell-yaml module (auto-install prompt if missing).

2026-04-13 — Unified Launcher: Baseline Deployer Integration

Modified

• Scripts/Start-IntuneToolkit.ps1
  • Added menu entries for baseline deployment:
    • 10. Deploy baseline
    • 11. Deploy baseline (dry-run / WhatIf)
  • Forwards -WhatIf switch correctly when dry-run option is selected.
  • Ensures WhatIf flag is cleared between loop iterations to avoid leakage to other tools.