intune-preflight
Intune Preflight is a read-only, self-hosted tool that simulates an Intune endpoint to preview the full merged policy baseline before deployment.
Ficha actualizada 23 sept 2026, 13:08 · upstream 23 sept 2026, 13:04 · release v2.1.0
Qué es intune-preflight
Descripción editorial construida a partir del repositorio, su documentación y sus señales de mantenimiento.
Intune makes you click into every Configuration Profile, Compliance Policy, Settings Catalog policy, and Administrative Template one at a time to work out what actually lands on a device. Intune Preflight connects to your tenant, reads every policy and its assignments, and lets you simulate an endpoint — pick an OS, the Entra groups it belongs to, its Autopilot Group Tag, and any Assignment Filters it matches — then compute the full merged CSP-level baseline that endpoint would receive. No hardware, no enrollment, no Policy Sets required.
It is a read-only, self-hosted tool for validating and understanding assignments in a sandbox or production tenant before you roll changes out to real devices. It authenticates with tenant-wide application permissions so it returns the complete, unfiltered picture of every policy and assignment — not just what one admin unit sees. This means you can see conflicts, overlaps, exclusions, and cross-model collisions that would otherwise be hidden.
The tool includes an endpoint simulator that visualizes the device → Autopilot → groups → policies flow as a live diagram. It also exposes an Assignment Manifest showing which groups carry which policies with filter simulation. A full tenant-wide policy waitlist lets you preview "what if" scenarios by pulling unassigned policies into the simulation.
- Validate that all required Intune policies are applied to a new OS image before deployment
- Identify conflicts between multiple CSPs or settings catalogs on the same device
- Check for redundant duplicate policies across different policy models (legacy vs. Settings Catalog)
- Verify Autopilot Group Tag assignments and dynamic group membership rules
- Preview what happens when a user group is added to an endpoint before rollout
- Audit legacy Endpoint Security policies (BitLocker, Defender Antivirus) against the unified settings platform
- Read-only tool with full tenant visibility — no RBAC scope filtering of policy data
- Endpoint simulator visualizes the complete device → Autopilot → groups → policies flow
- Conflict and overlap detection is Windows-specific but merged baseline is shown on every platform
- Dynamic Group Tag membership is surfaced per group rather than guessed by a single evaluator
- Assignment Manifest provides a tenant-wide view of policy-to-group mappings with filter simulation
- Group Tag / Autopilot auto-selection reads the [OrderID] and [ZTDId] clauses in devicePhysicalIds; confident matches are auto-selected but conditional rules remain visible
- Conflict and overlap detection is Windows-only — other platforms (macOS, iOS, Android) show merged baselines without conflict flags
- Cross-model collision detection between Settings Catalog ↔ OMA-URI is exact, but legacy Endpoint Security intents aren't crosswalked yet
- Settings flattening uses schema-agnostic Graph properties rather than a hand-maintained CSP schema, so raw field names may appear as setting names in some cases
- A conflicted policy setting has no computed winner — the tool shows all values and marks rows as 'conflicted' but does not decide which value wins on the device
Capturas del proyecto
Imágenes reales detectadas en la documentación del repositorio.
Perfil de infraestructura
Estimación inicial derivada del repositorio y de los servicios detectados.
Despliegue detectado
Qué señales reales de instalación hemos encontrado.
Install via npm: `npm install` then run `npm run dev` for server (port 4000) and web UI (port 5173). Use a `.env` file with `TENANT_ID`, `CLIENT_ID`, and `CLIENT_SECRET`. The tool listens on all interfaces (`0.0.0.0`) so it must be restricted to localhost or a trusted private network. It requires no Docker, no app registration, and no tenant enrollment — just a valid Intune tenant URL via the `.env` variables. For production use, consider running in a containerized environment with proper network isolation.
Stack y dependencias
Componentes inferidos a partir de manifests, configuración y documentación.
Puede sustituir a
Relaciones detectadas por el análisis del repositorio y su categoría.
Experiencia real de la comunidad
Ayuda a contrastar la estimación automática con instalaciones reales.
Todavía no hay datos comunitarios para este proyecto.