Intune, Entra & Graph, decoded in the open¶

The one script that writes: enriching Lenovo warranty into device Notes

Cover: the one opt-in tool that writes OEM warranty into Intune device Notes, surgically

Lenovo warranty isn't a field Intune gives you — so this tool looks it up by serial number and writes it into each device's Notes, where the read-only inventory collector and Power BI can then simply read it. It's also the one deliberate exception in this project: everything else is read-only by construction, with no write scope anywhere in the chain, but this single, human-run, opt-in tool does write to the tenant. It's fenced off in tools/ on purpose, and being honest about it is the whole point.

Device lifecycle

The read-only AI agent that can't touch your tenant

Cover: a read-only AI agent answering endpoint questions from sanitized snapshots, with no live tenant access

Someone on the service desk asked me last month how many of our Finnish devices were failing the firewall compliance setting. Simple question. The honest answer was that I had to go and write a Graph query to find out, because there is no way to just ask the fleet a question like that.

So I built something that can answer it. You type "how many devices fail Firewall in Finland" in plain English and get the number back in a few seconds, with the source report and the date on it. The obvious way to build that is to give an AI model live access to Intune and Graph. That is also the most dangerous way, and I did not want to do it.

This is the capstone of everything else on this site. An AI agent that answers questions about our whole Intune fleet, and holds no access to any live system at all. (If you want to see how it compares to Microsoft's own Intune Copilot agents, jump to Where this fits.)

Behind the portal · AI · Power BI

Where Autopilot actually breaks: ESP phase, failure category, per deployment

Cover: Autopilot and ESP deployment failures classified by phase and category

When an Autopilot build fails, the technician sees a spinning ESP and a vague error. What the fleet owner needs is the pattern: which phase deployments die in, which category of failure dominates, and which app keeps timing out. This read-only collector turns Autopilot events into that operational picture.

Behind the portal · Power BI

Which devices can't take Windows 11 — the hardware blocker, per device

Cover: Windows 11 hardware readiness with the exact failing check per device

"How many of our devices are Windows 11 ready?" is a question that decides a hardware budget. Intune hints at readiness but won't hand you the specific blocker — TPM, CPU, Secure Boot, RAM — for every device, as data. This read-only collector does, so the refresh plan writes itself.

Behind the portal · Power BI

Who's missing an Intune license: finding the devices slipping through

Cover: corporate Windows devices missing an Intune or Windows Enterprise licence

A corporate Windows device whose primary user has no Intune (or Windows Enterprise) license is a compliance and cost problem hiding in plain sight — it enrols, it looks managed, but it's out of licensing bounds. Intune won't cross-reference devices against user licences. This read-only collector does.

Compliance · Power BI

Which app is failing, and why: turning Intune app errors into a triage board

Cover: Intune app deployment failures triaged per app with an owner and a fix

Intune's app install status is a sea of red per-device rows. What it won't tell you at a glance is which app is the problem, how bad, and who should fix it. This is the read-only collector that rolls every failure up per app and triages it into a category, an owner, and a remediation.

Behind the portal · Power BI

The devices no one owns anymore: a read-only hygiene report with recommended actions

Cover: an Intune device-hygiene worklist with a recommended action per device

Every fleet accumulates cruft: laptops that stopped checking in months ago, records for devices that were wiped, machines whose owner left the company. Intune lists them all as if they're equal. This is the read-only collector that separates the living from the stale and tells you what to do about each one.

Behind the portal · Compliance · Power BI

Every policy, every target: the assignment map Intune won't draw for you

Cover: mapping every Intune policy to every target group, dynamic and broken alike

Open any compliance policy or configuration profile and Intune shows you its assignments. What it never shows is the whole map — every policy, every group it targets, which of those groups are dynamic, and which point at a group that no longer exists. This is the read-only collector that flattens all of it into one table.

Behind the portal · Power BI

Who's running Ollama on your fleet? A read-only shadow-AI inventory

Cover: read-only shadow-AI inventory flagging unsanctioned local AI tools and leavers

Somewhere on your fleet right now, someone has quietly installed a local LLM. Maybe it's Ollama pulling a model, maybe LM Studio, maybe a coding assistant quietly indexing your repos into a local model that sits on the laptop — and never gets wiped when they leave. Intune won't tell you — it doesn't inventory "AI tools" as a thing. This is a scheduled, read-only collector that turns shadow AI into a governance report: who's running what, sanctioned or not, and the finding that should worry you most — leavers who still have it installed.

Behind the portal · Compliance · Power BI

Documentation that writes itself: a read-only snapshot of your whole Intune config

Cover: read-only Intune and Windows 365 configuration documented automatically

Ask an admin for "the documentation" of their Intune tenant and you'll get a nervous laugh. It's in the portal — spread across compliance policies, configuration profiles, app assignments, Autopilot profiles, update rings — and the moment anyone writes it down in a Word doc, it's out of date. This is a scheduled, read-only collector that renders the entire Intune and Windows 365 configuration into one always-current, human-readable document.

Behind the portal