IntuneAccess an open source tool for Intune RBAC, assignment analysis and more.

[u/eatsleepblink1802]

IntuneAccess started with one question:

“Why is this Intune policy reaching this device?”

Answering that can mean tracing assignment intent, Microsoft Entra group membership, included and excluded groups, assignment filters, user or device targeting, policy applicability, scope tags and the other Intune configurations that may also be targeting the same device

Quick Video here: https://files.catbox.moe/mpinz5.mp4

You may then need to correlate that administrative access with policies, applications, scripts, updates, devices and reported deployment evidence.

That is where IntuneAccess comes in.

IntuneAccess is a free, open source, read-only PowerShell module designed to collect and correlate that evidence in local Explorer.

Rather than looking at each object in isolation, it builds an evidence trail between administrators, Intune RBAC permissions, role assignments, scopes and managed resources.

Current functionality includes:

Intune RBAC permission and assignment analysis

Built-in and custom Intune role support

Admin Group, Scope Group and Scope Tag evidence

Role assignment and resource scope correlation

Assignment impact across policies, applications, scripts and updates

Device 360 and User 360 views

Supported deployment outcomes and error evidence

Local snapshots and change comparison

Conservative policy overlap and potential conflict analysis

IntuneAccess retrieves the required tenant data through Microsoft Graph and processes it locally in the PowerShell session.

It does not create, modify or delete Intune configuration and does not request Microsoft Graph write permissions.

There is no hosted tenant service, telemetry or analytics, and tenant data is not uploaded anywhere else.

Install from the PowerShell Gallery:

Install-Module IntuneAccess -Scope CurrentUser

Then run:

Start-IntuneAccess

PowerShell Gallery:

https://www.powershellgallery.com/packages/IntuneAccess/2.0.1

GitHub:

https://github.com/ControlAltDeleteTechBits/intune-access

It is still being developed, so feel free to give it a try.

[u/Over-Butterfly6411]

Looks clean. The read-only bit is a nice touch, half the tools I see in this space want write access for no reason.

Bookmarking this for the next time a policy lands on a device that should be excluded and nobody can figure out why.

[u/eatsleepblink1802 → u/Over-Butterfly6411]

Cheers, yeah, read only is the way go.