Client-side Microsoft Intune / Entra ops dashboard for MSPs and admins. Runs in the browser only — no backend. Sign in with Microsoft Graph (MSAL); optional Claude/OpenRouter for log and error analysis.
🔗 Live: haavarstein.github.io/intune-dashboard
🔒 Security: SECURITY.md
📘 Full feature reference: docs/FEATURES.md (detailed tabs, endpoints, edge cases)
| Tab | Purpose |
|---|---|
| Local | Visualize uninstall registry from CSV or Intune Collect diagnostics .reg files |
| Intune | Live tenant: 22 sub-tabs (apps, hardware, MAA, Autopilot, BitLocker, Secure Boot, posture, Defender views, metering, …) |
| Analyze | Drop IME / AgentExecutor / MSI logs → AI triage (optional API key) |
| Settings | MSP customer list, approvers, metering script IDs, Claude/OpenRouter key |
Intune sub-tabs (22): Overview · Installed · Approvals · Failed Install · Required Install · Required Uninstall · Software Metering · Remediation · Hardware · Disk Space · App Versions · Autopilot · BitLocker · Secure Boot · Management Health · Assignments · Posture · Vulnerabilities (P2/E5) · Drift & Compliance (P2/E5) · Soft-Deleted · Stale Users (P1) · AI Agents (P2/E5)
Highlights that fill portal gaps: failed-install session-noise verdicts, MAA queue + email notifications, management-certificate health, Secure Boot on/off from DHA, BitLocker key-escrow gaps, compliance + Conditional Access posture audit, app version sprawl cleanup, software metering via Proactive Remediation, Autopilot orphan reconciliation.
- Export uninstall data (PowerShell snippet in docs/FEATURES.md, or Intune Collect diagnostics
.regfiles). - Open the live dashboard → Local.
- Drop
.csvor.regfiles. Search, sort, copy uninstall strings.
- Sign in with Microsoft (popup → multi-tenant
login.microsoftonline.com/common). - Consent to the read scopes (listed below). Write scopes are requested only when you use a write action.
- Overview loads first; open any other sub-tab as needed.
- Settings → paste an Anthropic (
sk-ant-…) or OpenRouter (sk-or-v1-…) key (stored in browserlocalStorage). - Drop log files → Analyze with Claude. Prefer Haiku for cost/speed.
Do not open index.html as file:// (MSAL redirect fails). From the repo root:
python -m http.server 8080
# open http://localhost:8080/Pre-registered multi-tenant public client (MSAL.js). Tokens stay in sessionStorage. Customer list / API key use localStorage (no refresh tokens persisted across browser restarts).
| Scope | Used for |
|---|---|
DeviceManagementManagedDevices.Read.All |
Devices, hardware, disk, cert health, … |
DeviceManagementApps.Read.All |
Apps, install reports, audit history |
DeviceManagementScripts.Read.All |
Remediations, PowerShell scripts |
DeviceManagementConfiguration.Read.All |
Policies, MAA queue list, update profiles |
DeviceManagementServiceConfig.Read.All |
Autopilot |
Group.Read.All |
Assignment group names |
User.Read |
Signed-in display name |
User.Read.All + AuditLog.Read.All |
Stale users (signInActivity) |
ThreatHunting.Read.All |
Defender KQL (Vulnerabilities, Drift, AI agents) — needs P2/E5 + security role |
BitlockerKey.ReadBasic.All |
BitLocker key metadata only (no recovery material) |
Device.Read.All |
Entra devices (hygiene / Autopilot duplicates / soft-delete list) |
| Scope | Used for |
|---|---|
Policy.Read.All |
Posture Conditional Access section only — not requested at sign-in; Grant on the tab |
Requested only on first use of the matching action:
| Scope | Action |
|---|---|
DeviceManagementApps.ReadWrite.All |
Delete apps; MAA approve/reject/complete (apps) |
Mail.Send |
MAA notification emails from your mailbox |
DeviceManagementScripts.ReadWrite.All |
Auto-deploy metering / AI scan / IME check-in scripts |
Directory.AccessAsUser.All |
Restore soft-deleted Entra devices |
User.RevokeSessions.All / User.EnableDisableAccount.All |
Stale users actions |
DeviceManagementManagedDevices.PrivilegedOperations.All |
On-demand IME check-in |
DeviceManagementManagedDevices.ReadWrite.All |
Device delete/wipe; complete device MAA |
DeviceManagementRBAC.ReadWrite.All / DeviceManagementConfiguration.ReadWrite.All |
Complete certain MAA create/update requests |
Stricter tenants may need admin consent for write scopes. Full endpoint list and edge cases: docs/FEATURES.md.
In Settings → Customers, add short codes (e.g. ACME), login email, optional approvers and metering script GUIDs. With 2+ customers, a code-only dropdown appears in the auth bar (screenshot-safe). Switching uses MSAL loginHint / cached accounts; no tokens stored for the list. Details: docs/FEATURES.md.
- Anthropic or OpenRouter key in Settings; models selectable (Haiku default).
- Used for error-code analysis and log triage; key never sent to Microsoft Graph.
- Prefer a spend-capped key. See SECURITY.md.
Proactive Remediation collectors (software metering, AI agent scan, IME required-app check-in) live under scripts/ with deploy steps in scripts/README.md. Third-party notices: scripts/THIRD_PARTY_NOTICES.md.
| Piece | Location |
|---|---|
| UI + tab logic | index.html |
| Styles | css/dashboard.css |
| MSAL config + read scopes | js/msal-config.js |
| Graph helpers | js/graph.js |
| Collectors | scripts/*.ps1 |
No build step. MSAL + PapaParse from CDN. Static hosting (GitHub Pages).
There is no hard device cap, but Graph rate limits and browser work still matter:
| Surface | Behavior |
|---|---|
| Pagination | Collection GETs use $top=999 when the caller does not set $top (fewer pages). |
| Access tokens | Read-scope tokens are cached until near expiry so thousands of GETs do not each call MSAL. |
| Hardware | Device list + storage/OS render first; RAM is filled with concurrency 25 and a progress line. ✕ Cancel aborts paging/RAM mid-walk (keeps partial data). Refresh / tenant switch also abandons in-flight work. |
| Hardware slim mode | Settings → Large tenants → skip RAM backfill entirely (list still loads). |
| Assignments | Nine policy endpoints load in parallel with per-endpoint progress in the status line; ✕ Cancel stops the index. |
| Installed apps | Slim $select + assignment id expand; progress while paging. Zero-install tile still pages the install-summary report. |
| Failed → by error | Per-app install-status reports run with concurrency 8. |
| Overview | Slim device $select only (no RAM fan-out). |
| Cache | Sub-tab Graph results stay in memory until Refresh or tenant switch; tokens in sessionStorage; customers/API key/scale toggles in localStorage. In-app notes under Settings. |
Expect multi-minute Hardware RAM backfill on fleets of several thousand devices; the table is usable before that finishes. Use Cancel or slim mode when you only need storage/OS.
| Doc | Content |
|---|---|
| README.md | Overview, quick start, scopes (this file) |
| docs/FEATURES.md | Full tab-by-tab reference, Graph calls, registry export snippet |
| SECURITY.md | Data flow, storage, reporting vulnerabilities |
| scripts/README.md | Deploy metering / AI scan / IME check-in |
| tasks/todo.md | Active backlog |
| CLAUDE.md | Agent coding rules for this repo |
Vendored remediations and licenses: scripts/THIRD_PARTY_NOTICES.md.
IME Required App Check-in: Rudy Ooms / Call4Cloud (MIT).
MIT — see LICENSE.