Skip to content
Tobias AlmΓ©n edited this page Mar 4, 2024 · 14 revisions

Introduction

IntuneCD or, Intune Continuous Delivery as it stands for is a Python package that is used to back up, update and document configurations in Intune. It was created with running it from a CI/CD pipeline in mind. Using this approach we get complete history of which configurations have been changed and what setting has been changed.

The main function is to back up configurations from Intune to a Git repository from a DEV environment and if any configurations has changed, push them to PROD Intune environment.

Change flow

When running IntuneCD in a pipeline with a Git repo, the flow of backing up and updating configurations looks like this:

flowchart LR
    A[Change in DEV] --> B[Backup pipeline] --> C[Git repo] --> D{Change Approved?};
    D -- Yes --> E[Update pipeline] --> F[PROD];
    D -- No --> G[End];
Loading

Above, it is assumed that the main branch of the repository is protected so that a Pull Request is required for the changes to be merged into the main branch from the backup pipeline. If the change is approved and merged, the update pipeline will automatically run and push the changed to the PROD environment. If not approved, no change will be pushed.

Supported configurations

Payload Back up Update Document Create Remove Audit Notes
Apple Push Notification πŸŽ‰ πŸŽ‰ πŸŽ‰
Apple Volume Purchase Program tokens πŸŽ‰ πŸŽ‰ πŸŽ‰
Application Configuration Policies πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰
Application Protection Policies πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰
Applications πŸŽ‰ πŸŽ‰ πŸŽ‰
Compliance Policies πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰
Conditional Access πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ Assignments are not updated currently
Device Categories πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰
Device Configurations πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ For custom macOS and iOS configurations,
mobileconfigs are backed up
Device Management Settings πŸŽ‰ πŸŽ‰* πŸŽ‰ πŸŽ‰ Interactive authentication is currently required to update these settings
Group Policy Configurations πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ For custom ADMX, the presentation value will not be added when creating the configuration
Enrollment profiles πŸŽ‰ [^1] πŸŽ‰ πŸŽ‰ πŸŽ‰ [^2] πŸŽ‰ [^3] πŸŽ‰
Enrollment Status Page πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰
Endpoint Security πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ Security Baselines
Antivirus
Disk Encryption
Firewall
Endpoint Detection and Response
Attack Surface Reduction
Account Protection
Filters πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰
Managed Google Play πŸŽ‰ πŸŽ‰ πŸŽ‰
Notification Templates πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰
Proactive Remediation πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰
Partner Connections πŸŽ‰ πŸŽ‰ πŸŽ‰ Compliance
Management
Remote Assistance
Shell Scripts πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰
Custom Attributes πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰
Powershell Scripts πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰
Settings Catalog Policies πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰
Enrollment Configurations πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ Enrollment platform restrictions
Enrollment device limit
Windows Hello For Business
Windows Driver Updates πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰
Windows Feature Updates πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰
Windows Quality Updates πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰
Roles πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ Only custom roles are managed
Scope Tags πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰
Activation Lock Bypass Codes πŸŽ‰
Custom Compliance Scripts πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰ πŸŽ‰

[^1]: Only Apple Business Manager and Windows Autopilot profiles are backed up. [^2]: Only Windows Autopilot profiles are created. [^3]: Only Windows Autopilot profiles are removed.

Good to know

When this tool tries to update configurations, it matches the display name. Therefore, the display name from DEV must match in PROD.

Current known limitations

Updating Windows Update Rings configurations is currently not supported, the tool can however create update rings if they don't exist.

Clone this wiki locally