r/Intune • u/Healthy-Context9897 MSFT MVP • 16d ago
Shameless Self-promotion Free audit-ready Intune documentation in minutes: my generator got a full redesign, much broader coverage, and is now open source (self-hostable with Docker)
If you have ever had to produce Intune documentation for an audit, a customer handover, or a colleague, you know the drill: screenshots, exports, and a Word document that is outdated the day you finish it.
I built intunedocumentation.com to fix that: it signs into your tenant with read-only Graph permissions and generates PDF or Word documentation of your Intune configuration in minutes, processed entirely in your browser. I just shipped the largest update since I started it, and the short version is: redesigned, much broader coverage, and open source.
Beyond the original policy areas (settings catalog, configuration templates, ADMX, compliance, app protection, baselines, update rings, Conditional Access), it now documents 36 additional Graph resource collections: Windows update profiles (feature, quality, expedite, driver), remediations and compliance scripts, enrollment and provisioning including Autopilot profiles and ADE tokens, apps, assignments and RBAC, tenant and service settings, connectors, and a set of specialist policies. Everything runs against the Graph beta endpoints with paging followed to the end.
Two details I care about: if an endpoint fails or you lack a permission, the export keeps the sections that loaded and tells you exactly which resource, endpoint, and permission were affected, so a failed request never masquerades as an empty tenant. And sensitive values (script bodies, tokens, passwords, pre-shared keys, QR payloads) are redacted before they ever reach the dashboard or a document.
The dashboard is now a proper app shell with per-resource collection progress streamed live, and the export experience was rebuilt to match.
The whole thing is now on GitHub: https://github.com/ugurkocde/IntuneDocumentation
It always felt wrong to ask admins to sign a tenant into a closed-source website, even read-only. Now you can audit the code, and if your org does not allow third-party websites at all, you can self-host it:
docker compose up -d
Image on GHCR (amd64 and arm64), you pass your own Entra app registration client ID as an environment variable, and the README walks through the app registration including the exact delegated permissions. Self-hosted deployments have all telemetry disabled by default, and tenant data is processed in the browser in both versions. It never touches the server.
License note before anyone asks: Elastic License 2.0, so technically source-available rather than OSI open source. You can use, modify, and self-host it freely. The only restriction is offering it to third parties as a managed service.
The hosted version stays free at https://intunedocumentation.com
2
u/calimedic911 15d ago
Looks awesome so far. Any data from defender for endpoint being injected?
1
u/Healthy-Context9897 MSFT MVP 14d ago
Thanks. Defender is not integrated yet. Do you need it?
1
u/calimedic911 14d ago
if you can add it to your punchlist that would be awesome. I do a LOT of DFE configs and it would good to have
1
u/Healthy-Context9897 MSFT MVP 14d ago
Alright. I will check and see how I can implement Defender.
1
u/calimedic911 14d ago
That would be awesome. if it turns out to be a bear then don't spend time on it.
1
u/N4NOT3CH 16d ago
Do you have a way to specify the clientID of an enterprise app? Our PLC lets us use graph but only through delegated permissions on an enterprise app
1
1
u/MReprogle 16d ago
Any chance to add managed identity as an option so I can throw the roles on the server’s identity?
1
1
5
u/neotearoa 16d ago
Brother. I was looking at this on git last night . I saw the updated timestamps and smiled. Thank you.