device_management
Microsoft Intune
Connect Microsoft Intune to Elaichi and hand every teammate a governed MCP endpoint — 195 tools ready to call from Claude, Cursor, or any MCP client, clamped by roles, restrictions, and an audit log.
AI tools
Microsoft Intune tools for your AI agents
195 tools are ready to mint as an MCP endpoint the moment you connect Microsoft Intune — governed by the same roles, restrictions, and audit log as everything else in Elaichi.
list_all_msintune_managed_devices
List managed devices enrolled in Microsoft Intune. Returns: @odata.type, id, userId, deviceName, managedDeviceOwnerType, deviceActionResults, managementState, enrolledDateTime, lastSyncDateTime, operatingSystem, complianceState, jailBroken, managementAgent, osVersion, easActivated, easDeviceId, easActivationDateTime, azureADRegistered, deviceEnrollmentType, activationLockBypassCode, emailAddress,…
get_single_msintune_managed_device_by_id
Get a single managed device by id in Microsoft Intune. Returns: @odata.type, id, userId, deviceName, managedDeviceOwnerType, deviceActionResults, managementState, enrolledDateTime, lastSyncDateTime, operatingSystem, complianceState, jailBroken, managementAgent, osVersion, easActivated, easDeviceId, easActivationDateTime, azureADRegistered, deviceEnrollmentType, activationLockBypassCode,…
create_a_msintune_managed_device
Create a new managed device in Microsoft Intune. Returns: @odata.type, id, userId, deviceName, managedDeviceOwnerType, deviceActionResults, managementState, enrolledDateTime, lastSyncDateTime, operatingSystem, complianceState, jailBroken, managementAgent, osVersion, easActivated, easDeviceId, easActivationDateTime, azureADRegistered, deviceEnrollmentType, activationLockBypassCode, emailAddress,…
delete_a_msintune_managed_device_by_id
Delete a managed device in Microsoft Intune by id. Returns an empty 204 response on success. Required: id. The API requires an active Intune license for the tenant.
update_a_msintune_managed_device_by_id
Update a managed device's properties in Microsoft Intune. Returns the updated managedDevice object including id, deviceName, managedDeviceOwnerType, complianceState, operatingSystem, osVersion, enrolledDateTime, and lastSyncDateTime. Required: id. Requires an active Intune license for the tenant.
msintune_managed_devices_retire
Retire a managed device in Microsoft Intune by initiating a retire action on the specified device. Returns an empty 204 response on success. Required: managed_device_id.
msintune_managed_devices_wipe
Wipe a managed device in Microsoft Intune, optionally preserving enrollment data, user data, and eSIM data plan. Returns an empty 204 response on success. Required: managed_device_id. Optional body parameters control retention of enrollment data, user data, eSIM plans, Mac unlock code, and obliteration behavior.
msintune_managed_devices_reset_passcode
Reset the passcode on a managed device in Microsoft Intune by initiating a resetPasscode action on the specified device. Returns an empty 204 response on success. Required: managed_device_id.
msintune_managed_devices_remote_lock
Remotely lock a managed device in msintune. Returns an empty 204 response on success. Required: managed_device_id.
msintune_managed_devices_request_remote_assistance
Request remote assistance for a managed device in msintune. Returns an empty 204 response on success. Required: managed_device_id.
msintune_managed_devices_disable_lost_mode
Disable lost mode on a managed Intune device. Returns an empty 204 response on success. Required: managed_device_id.
msintune_managed_devices_locate_device
Locate a managed Intune device, triggering a request for the device to report its location. Returns an empty 204 response on success. Required: managed_device_id.
msintune_managed_devices_bypass_activation_lock
Bypass the activation lock on a managed Intune device. Returns an empty 204 response on success. Required: managed_device_id.
msintune_managed_devices_reboot_now
Reboot a managed Intune device immediately. Returns an empty 204 response on success. Required: managed_device_id.
msintune_managed_devices_shut_down
Shut down a managed Intune device. Returns an empty 204 response on success. Required: managed_device_id.
msintune_managed_devices_recover_passcode
Recover the passcode of a managed device in Microsoft Intune. Returns an empty 204 response on success. Required: managed_device_id.
msintune_managed_devices_clean_windows_device
Clean a Windows managed device in Microsoft Intune, specifying whether to preserve user data. Returns an empty 204 response on success. Required: managed_device_id.
msintune_managed_devices_logout_shared_apple_device_active_user
Log out the active user from a shared Apple managed device in Microsoft Intune. Returns an empty 204 response on success. Required: managed_device_id.
msintune_managed_devices_delete_user_from_shared_apple_device
Delete a specific user from a shared Apple managed device in Microsoft Intune by user principal name. Returns an empty 204 response on success. Required: managed_device_id.
msintune_managed_devices_sync_device
Trigger a device sync for a managed device in Microsoft Intune. Returns an empty 204 response on success. Required: managed_device_id.
msintune_managed_devices_windows_defender_scan
Trigger a Windows Defender scan on a managed device in Microsoft Intune. Pass quickScan as true for a quick scan or false for a full scan. Returns an empty 204 response on success. Required: managed_device_id.
msintune_managed_devices_windows_defender_update_signatures
Trigger a Windows Defender signature update on a managed device in Microsoft Intune. Returns an empty 204 response on success. Required: managed_device_id.
msintune_managed_devices_update_windows_device_account
Update the Windows device account on a managed device in Microsoft Intune. Accepts account credentials, password rotation, calendar sync, and Exchange server settings via the updateWindowsDeviceAccountActionParameter. Returns an empty 204 response on success. Required: managed_device_id.
msintune_managed_devices_disable
Disable a managed device in Microsoft Intune by managed_device_id. Returns an empty 204 response on success. Required: managed_device_id.
msintune_managed_devices_execute_action
Execute a remote action on one or more managed devices in Microsoft Intune. Returns the value object containing successfulDeviceIds, failedDeviceIds, notFoundDeviceIds, and notSupportedDeviceIds. Required: actionName, deviceIds.
managed_devices_initiate_on_demand_proactive_remediation
Initiate an on-demand proactive remediation on a Microsoft Intune managed device. Returns an empty 204 response on success. Required: managed_device_id, scriptPolicyId.
managed_devices_send_custom_notification_to_company_portal
Send a custom notification to the Company Portal app on Microsoft Intune managed devices. Returns an empty 204 response on success. Required: notificationTitle, notificationBody.
list_all_msintune_detected_apps
List detected apps discovered by Microsoft Intune. Returns: @odata.type, id, displayName, version, sizeInByte, deviceCount, publisher, platform.type, id, displayName, version, sizeInByte, deviceCount, publisher, platform.
get_single_msintune_detected_app_by_id
Get a single detected app in Microsoft Intune by id. Returns: @odata.type, id, displayName, version, sizeInByte, deviceCount, publisher, platform, value.type, id, displayName, version, sizeInByte, deviceCount, publisher, platform, value. Required: id.
create_a_msintune_detected_app
Create a new detected app in Microsoft Intune. Returns: @odata.type, id, displayName, version, sizeInByte, deviceCount, publisher, platform.
delete_a_msintune_detected_app_by_id
Delete a detected app in Microsoft Intune by id. Returns an empty 204 response on success. Required: id.
update_a_msintune_detected_app_by_id
Update a detected app in Microsoft Intune by id. Returns: @odata.type, id, displayName, version, sizeInByte, deviceCount, publisher, platform, value. Required: id.
list_all_msintune_device_compliance_policies
List device compliance policies in Microsoft Intune. Returns: @odata.type, id, createdDateTime, description, lastModifiedDateTime, displayName, version.
get_single_msintune_device_compliance_policy_by_id
Get a single device compliance policy in Microsoft Intune by id. Returns: @odata.type, id, createdDateTime, description, lastModifiedDateTime, displayName, version, value. Required: id.
msintune_device_compliance_policies_assign
Assign a device compliance policy in Microsoft Intune to specified targets. Returns a value collection of deviceCompliancePolicyAssignment objects, each including @odata.type, id, and target with targetType and entraObjectId. Required: device_compliance_policy_id, assignments.
msintune_device_compliance_policies_schedule_actions_for_rules
Schedule compliance actions for rules on a device compliance policy in Microsoft Intune. Returns an empty 204 response on success. Required: device_compliance_policy_id, deviceComplianceScheduledActionForRules.
list_all_msintune_device_configurations
List device configurations in Microsoft Intune. Returns: @odata.type, id, lastModifiedDateTime, createdDateTime, description, displayName, version.
get_single_msintune_device_configuration_by_id
Get a single device configuration in Microsoft Intune by id. Returns: @odata.type, id, lastModifiedDateTime, createdDateTime, description, displayName, version, value. Required: id.
msintune_device_configurations_assign
Assign a device configuration in Microsoft Intune to specified targets by providing a collection of assignments. Returns: value. Required: device_configuration_id, assignments.
msintune_device_configurations_get_oma_setting_plain_text_value
Retrieve the plain text value of an OMA setting for a device configuration in Microsoft Intune. Returns: value. Required: device_configuration_id, secretReferenceValueId.
list_all_msintune_mobile_apps
List mobile apps managed in Microsoft Intune. Returns a collection of mobileApp objects including id, displayName, description, publisher, largeIcon, createdDateTime, lastModifiedDateTime, isFeatured, publishingState, and more.
get_single_msintune_mobile_app_by_id
Get a single mobile app in Microsoft Intune by id. Returns the mobileApp object including id, displayName, description, publisher, largeIcon, createdDateTime, lastModifiedDateTime, isFeatured, publishingState, and more. Required: id.
msintune_mobile_apps_assign
Assign a mobile app in Microsoft Intune to target groups with a specified install intent and assignment settings. Returns an empty 204 response on success. Required: mobile_app_id.
create_a_msintune_mobile_app
Create a new Win32 LOB app in Microsoft Intune. Returns the created win32LobApp object including id, displayName, description, publisher, createdDateTime, lastModifiedDateTime, publishingState, installCommandLine, applicableArchitectures, rules, installExperience, returnCodes, msiInformation, and more.
msintune_mobile_apps_enable_applicable_architectures
Enable applicable architectures for a Win32 LOB app in Microsoft Intune. Accepts an applicableArchitectures value in the request body. Returns an empty 204 response on success. Required: mobile_app_id.
list_all_msintune_mobile_app_assignments
List the group assignments for a Microsoft Intune mobile app. Returns each assignment's id, intent (available, required, uninstall, or availableWithoutEnrollment), target (the assigned group), and settings (per-platform install settings). Required: mobile_app_id.
get_single_msintune_mobile_app_assignment_by_id
Get a single group assignment for a Microsoft Intune mobile app by id. Returns: id, intent, target, settings. Required: mobile_app_id, id.
create_a_msintune_mobile_app_assignment
Create a new group assignment for a Microsoft Intune mobile app. Returns the created assignment: id, intent, target, settings (201 Created). Required: mobile_app_id, intent, target.
delete_a_msintune_mobile_app_assignment_by_id
Delete a group assignment for a Microsoft Intune mobile app. Returns an empty 204 response on success. Required: mobile_app_id, id.
update_a_msintune_mobile_app_assignment_by_id
Update an existing group assignment for a Microsoft Intune mobile app. Returns the updated assignment: id, intent, target, settings (200 OK). Required: mobile_app_id, id.
list_all_msintune_managed_app_protections
List managed app protection policies in Microsoft Intune. Returns: @odata.type, displayName, description, createdDateTime, lastModifiedDateTime, id, version, periodOfflineBeforeAccessCheck, periodOnlineBeforeAccessCheck, allowedInboundDataTransferSources, allowedOutboundDataTransferDestinations, organizationalCredentialsRequired, allowedOutboundClipboardSharingLevel, dataBackupBlocked,…
get_single_msintune_managed_app_protection_by_id
Get a single managed app protection policy in Microsoft Intune by id. Returns: @odata.type, displayName, description, createdDateTime, lastModifiedDateTime, id, version, periodOfflineBeforeAccessCheck, periodOnlineBeforeAccessCheck, allowedInboundDataTransferSources, allowedOutboundDataTransferDestinations, organizationalCredentialsRequired, allowedOutboundClipboardSharingLevel,…
msintune_managed_app_protections_target_apps
Target apps for a managed app protection policy in Microsoft Intune by assigning a collection of managed mobile apps. Returns an empty 204 response on success. Required: managed_app_policy_id, apps.
list_all_msintune_mobile_threat_defense_connectors
List all mobile threat defense connectors configured in Microsoft Intune. Returns: @odata.type, id, lastHeartbeatDateTime, partnerState, androidMobileApplicationManagementEnabled, iosMobileApplicationManagementEnabled, androidEnabled, iosEnabled, windowsEnabled, androidDeviceBlockedOnMissingPartnerData, iosDeviceBlockedOnMissingPartnerData, windowsDeviceBlockedOnMissingPartnerData,…
get_single_msintune_mobile_threat_defense_connector_by_id
Get a single mobile threat defense connector in Microsoft Intune by id. Returns: @odata.type, id, lastHeartbeatDateTime, partnerState, androidMobileApplicationManagementEnabled, iosMobileApplicationManagementEnabled, androidEnabled, iosEnabled, windowsEnabled, androidDeviceBlockedOnMissingPartnerData, iosDeviceBlockedOnMissingPartnerData, windowsDeviceBlockedOnMissingPartnerData,…
create_a_msintune_mobile_threat_defense_connector
Create a new mobile threat defense connector in Microsoft Intune. Returns the created connector including id, lastHeartbeatDateTime, partnerState, androidEnabled, iosEnabled, windowsEnabled, and partner compliance and MAM evaluation settings.
delete_a_msintune_mobile_threat_defense_connector_by_id
Delete a mobile threat defense connector in Microsoft Intune by id. Returns an empty 204 response on success. Required: id.
update_a_msintune_mobile_threat_defense_connector_by_id
Update the properties of a mobile threat defense connector in Microsoft Intune by id. Returns the updated connector including id, lastHeartbeatDateTime, partnerState, androidEnabled, iosEnabled, windowsEnabled, and partner compliance and MAM evaluation settings. Required: id.
list_all_msintune_windows_autopilot_device_identities
List Windows Autopilot device identities in Microsoft Intune. Returns: @odata.type, id, groupTag, purchaseOrderIdentifier, serialNumber, productKey, manufacturer, model, enrollmentState, lastContactedDateTime, addressableUserName, userPrincipalName, resourceName, skuNumber, systemFamily, azureActiveDirectoryDeviceId, managedDeviceId, displayName.type, id, groupTag, purchaseOrderIdentifier,…
get_single_msintune_windows_autopilot_device_identity_by_id
Get a single Windows Autopilot device identity by id in Microsoft Intune. Returns: @odata.type, id, groupTag, purchaseOrderIdentifier, serialNumber, productKey, manufacturer, model, enrollmentState, lastContactedDateTime, addressableUserName, userPrincipalName, resourceName, skuNumber, systemFamily, azureActiveDirectoryDeviceId, managedDeviceId, displayName, value.type, id, groupTag,…
create_a_msintune_windows_autopilot_device_identity
Create a new Windows Autopilot device identity in Microsoft Intune. Returns: @odata.type, id, groupTag, purchaseOrderIdentifier, serialNumber, productKey, manufacturer, model, enrollmentState, lastContactedDateTime, addressableUserName, userPrincipalName, resourceName, skuNumber, systemFamily, azureActiveDirectoryDeviceId, managedDeviceId, displayName.
delete_a_msintune_windows_autopilot_device_identity_by_id
Delete a Windows Autopilot device identity by id in Microsoft Intune. Returns an empty 204 response on success. Required: id.
windows_autopilot_device_identities_assign_user_to_device
Assign a user to a Windows Autopilot device in Microsoft Intune by providing the user principal name and addressable user name. Returns an empty 204 response on success. Required: windows_autopilot_device_identity_id.
windows_autopilot_device_identities_unassign_user_from_device
Unassign the user from a Windows Autopilot device in msintune. Returns an empty 204 response on success. Required: windows_autopilot_device_identity_id.
windows_autopilot_device_identities_update_device_properties
Update properties on a Windows Autopilot device in msintune, including user principal name, addressable user name, group tag, and display name. Returns an empty 204 response on success. Required: windows_autopilot_device_identity_id.
msintune_windows_autopilot_device_identities_delete_devices
Delete Windows Autopilot devices by serial numbers in msintune. Returns a collection of deleted device state objects including serialNumber, deviceRegistrationId, deletionState, and errorMessage. Required: serialNumbers.
list_all_msintune_group_policy_configurations
List group policy configurations in Microsoft Intune. Returns: @odata.type, id, createdDateTime, description, displayName, lastModifiedDateTime, version.
get_single_msintune_device_compliance_setting_state_by_id
Get a single device compliance setting state from Microsoft Intune, nested under a device compliance policy setting state summary. Returns: @odata.type, id, setting, settingName, deviceId, deviceName, userId, userEmail, userName, userPrincipalName, deviceModel, state, complianceGracePeriodExpirationDateTime, value. Required: device_compliance_policy_setting_state_summary_id, id. Requires an…
list_all_msintune_managed_apps
List managed apps in Microsoft Intune, returning properties and relationships of each managedApp object. Returns: @odata.type, id, displayName, description, publisher, largeIcon, createdDateTime, lastModifiedDateTime, isFeatured, privacyInformationUrl, informationUrl, owner, developer, notes, publishingState, appAvailability, version.type, id, displayName, description, publisher, largeIcon,…
create_a_msintune_android_device_owner_compliance_policy
Create an Android Device Owner compliance policy in Microsoft Intune by posting to the device compliance policies endpoint. Returns the created policy including id, displayName, description, version, passwordRequired, deviceThreatProtectionEnabled, passwordRequiredType, storageRequireEncryption, and other compliance and security settings. Required: @odata.type (set to…
create_a_msintune_windows_10_custom_configuration
Create a new Windows 10 custom configuration in Microsoft Intune with custom OMA settings. Returns: @odata.type, id, lastModifiedDateTime, createdDateTime, description, displayName, version, omaSettings. Required: @odata.type, displayName. The omaSettings collection can contain a maximum of 1000 elements.
list_all_msintune_device_management_scripts
List device management scripts in Microsoft Intune. Returns: id, displayName, description, scriptContent, createdDateTime, lastModifiedDateTime, runAsAccount, enforceSignatureCheck, fileName, roleScopeTagIds, runAs32Bit.
get_single_msintune_device_management_script_by_id
Get a single device management script in Microsoft Intune by id. Returns: id, displayName, description, scriptContent, createdDateTime, lastModifiedDateTime, runAsAccount, enforceSignatureCheck, fileName, roleScopeTagIds, runAs32Bit. Required: id.
create_a_msintune_device_management_script
Create a new device management script in Microsoft Intune. Returns the created script including id, displayName, description, scriptContent, fileName, runAsAccount, enforceSignatureCheck, runAs32Bit, roleScopeTagIds, createdDateTime, and lastModifiedDateTime.
delete_a_msintune_device_management_script_by_id
Delete a device management script in Microsoft Intune by id. Returns an empty 204 response on success. Required: id.
update_a_msintune_device_management_script_by_id
Update the properties of a device management script in Microsoft Intune by id. Returns the updated script including id, displayName, description, scriptContent, fileName, runAsAccount, enforceSignatureCheck, runAs32Bit, roleScopeTagIds, createdDateTime, and lastModifiedDateTime. Required: id.
msintune_device_management_scripts_assign
Assign a Microsoft Intune device management script to target groups by providing a collection of assignment objects. Returns an empty 204 response on success. Required: device_management_script_id.
list_all_msintune_role_scope_tags
List role scope tags in Microsoft Intune. Returns: @odata.type, id, displayName, description, isBuiltIn.type for each tag.
get_single_msintune_role_scope_tag_by_id
Get a single role scope tag in Microsoft Intune by id. Returns: @odata.type, id, displayName, description, isBuiltIn, value.type. Required: id.
create_a_msintune_role_scope_tag
Create a new role scope tag in Microsoft Intune. Returns: @odata.type, id, displayName, description, isBuiltIn.type. Required: displayName.
delete_a_msintune_role_scope_tag_by_id
Delete a role scope tag in Microsoft Intune by id. Returns an empty 204 response on success. Required: id.
update_a_msintune_role_scope_tag_by_id
Update the properties of a role scope tag in Microsoft Intune by id. Returns: @odata.type, id, displayName, description, isBuiltIn.type. Required: id.
msintune_role_scope_tags_assign
Assign a role scope tag in Microsoft Intune to specified assignment targets. Returns a collection of roleScopeTagAutoAssignment objects, each containing id and target. Required: role_scope_tag_id.
list_all_msintune_device_management_intents
List device management intents in Microsoft Intune. Returns: @odata.type, id, displayName, description, isAssigned, isMigratingToConfigurationPolicy, lastModifiedDateTime, templateId, roleScopeTagIds.
get_single_msintune_device_management_intent_by_id
Get a single device management intent by id in Microsoft Intune. Returns: @odata.type, id, displayName, description, isAssigned, isMigratingToConfigurationPolicy, lastModifiedDateTime, templateId, roleScopeTagIds. Required: id.
create_a_msintune_device_management_intent
Create a new device management intent in Microsoft Intune. Returns the created intent including id, displayName, description, isAssigned, templateId, and roleScopeTagIds.
delete_a_msintune_device_management_intent_by_id
Delete a device management intent by id in Microsoft Intune. Returns an empty 204 response on success. Required: id.
update_a_msintune_device_management_intent_by_id
Update a device management intent by id in Microsoft Intune. Returns the updated intent including id, displayName, description, isAssigned, templateId, and roleScopeTagIds. Required: id.
msintune_device_management_intents_update_settings
Update settings for a device management intent in msintune by applying a new collection of settings. Returns an empty 204 response on success. Required: device_management_intent_id.
msintune_device_management_intents_migrate_to_template
Migrate a device management intent in msintune from its current template to a new template. Returns an empty 204 response on success. Required: device_management_intent_id.
msintune_device_management_intents_create_copy
Create a copy of an existing device management intent in Microsoft Intune. Returns the copied deviceManagementIntent object including id, displayName, description, isAssigned, isMigratingToConfigurationPolicy, lastModifiedDateTime, templateId, and roleScopeTagIds. Required: device_management_intent_id.
msintune_device_management_intents_assign
Assign a Microsoft Intune device management intent (a settings catalog / template-based configuration profile) to one or more groups. Returns an empty 204 response on success. Required: device_management_intent_id, assignments.
msintune_device_management_intents_compare
Compare a Microsoft Intune device management intent's current settings against a template's settings. Returns a 200 OK with one deviceManagementSettingComparison entry per compared setting: id, displayName, definitionId, currentValueJson, newValueJson, comparisonResult. Required: device_management_intent_id, templateId.
msintune_device_management_intents_get_customized_settings
Get the settings on a Microsoft Intune device management intent that have been customized away from their default values. Returns a 200 OK with one deviceManagementIntentCustomizedSetting entry per customized setting: definitionId, defaultJson, customizedJson. Required: device_management_intent_id.
list_all_msintune_reusable_policy_settings
List device management reusable policy settings in Microsoft Intune. Returns: id, displayName, description, settingDefinitionId, settingInstance, createdDateTime, lastModifiedDateTime, version, referencingConfigurationPolicyCount.
get_single_msintune_reusable_policy_setting_by_id
Get a single device management reusable policy setting in Microsoft Intune by id. Returns: id, displayName, description, settingDefinitionId, settingInstance, createdDateTime, lastModifiedDateTime, version, referencingConfigurationPolicyCount. Required: id.
create_a_msintune_reusable_policy_setting
Create a new device management reusable policy setting in Microsoft Intune. Returns the created setting object including id, displayName, description, settingDefinitionId, settingInstance, createdDateTime, lastModifiedDateTime, version, and referencingConfigurationPolicyCount.
delete_a_msintune_reusable_policy_setting_by_id
Delete a deviceManagementReusablePolicySetting in msintune by id. Returns an empty 204 response on success. Required: id.
update_a_msintune_reusable_policy_setting_by_id
Update the properties of a deviceManagementReusablePolicySetting in msintune by id. Returns: id, displayName, description, settingDefinitionId, settingInstance, createdDateTime, lastModifiedDateTime, version, referencingConfigurationPolicyCount. Required: id.
msintune_reusable_policy_settings_clone
Clone a Microsoft Intune device management reusable policy setting, producing a new copy of the original. Returns the cloned setting including id, displayName, description, settingDefinitionId, settingInstance, createdDateTime, lastModifiedDateTime, version, and referencingConfigurationPolicyCount. Required: device_management_reusable_policy_setting_id.
list_all_msintune_intune_branding_profiles
List Intune branding profiles in Microsoft Intune. Returns: @odata.type, id, profileName, profileDescription, isDefaultProfile, createdDateTime, lastModifiedDateTime, displayName, themeColor, showLogo, showDisplayNameNextToLogo, themeColorLogo, lightBackgroundLogo, landingPageCustomizedImage, contactITName, contactITPhoneNumber, contactITEmailAddress, contactITNotes, onlineSupportSiteUrl,…
get_single_msintune_intune_branding_profile_by_id
Get a single Intune branding profile by id in Microsoft Intune. Returns: id, error. Required: id.
create_a_msintune_intune_branding_profile
Create a new Intune branding profile. Returns: @odata.type, id, displayName, version, sizeInByte, deviceCount, publisher, platform.
delete_a_msintune_intune_branding_profile_by_id
Delete an Intune branding profile by id. Returns an empty 204 response on success. Required: id.
update_a_msintune_intune_branding_profile_by_id
Update the properties of an Intune branding profile by id. Returns: id, error. Required: id.
msintune_intune_branding_profiles_assign
Assign group assignments to an Intune branding profile in Microsoft Intune. The request body contains an assignments collection of intuneBrandingProfileAssignment objects, each with a target group. Returns an empty 204 response on success. Required: intune_branding_profile_id.
list_all_msintune_managed_device_cleanup_rules
List managed device cleanup rules in Microsoft Intune. Returns: @odata.type, id, displayName, description, deviceCleanupRulePlatformType, lastModifiedDateTime, deviceInactivityBeforeRetirementInDays.type, id, displayName, description, deviceCleanupRulePlatformType, lastModifiedDateTime, deviceInactivityBeforeRetirementInDays.
get_single_msintune_managed_device_cleanup_rule_by_id
Get a single managed device cleanup rule in Microsoft Intune by id. Returns: @odata.type, id, displayName, description, deviceCleanupRulePlatformType, lastModifiedDateTime, deviceInactivityBeforeRetirementInDays.type, id, displayName, description, deviceCleanupRulePlatformType, lastModifiedDateTime, deviceInactivityBeforeRetirementInDays. Required: id.
create_a_msintune_managed_device_cleanup_rule
Create a new managed device cleanup rule in Microsoft Intune. Returns: @odata.type, id, displayName, description, deviceCleanupRulePlatformType, lastModifiedDateTime, deviceInactivityBeforeRetirementInDays.type, id, displayName, description, deviceCleanupRulePlatformType, lastModifiedDateTime, deviceInactivityBeforeRetirementInDays.
delete_a_msintune_managed_device_cleanup_rule_by_id
Delete a managed device cleanup rule in Microsoft Intune by id. Returns an empty 204 response on success. Required: id.
update_a_msintune_managed_device_cleanup_rule_by_id
Update the properties of a managed device cleanup rule in Microsoft Intune by id. Returns: @odata.type, id, displayName, description, deviceCleanupRulePlatformType, lastModifiedDateTime, deviceInactivityBeforeRetirementInDays.type, id, displayName, description, deviceCleanupRulePlatformType, lastModifiedDateTime, deviceInactivityBeforeRetirementInDays. Required: id.
list_all_msintune_device_custom_attribute_shell_scripts
List device custom attribute shell scripts in Microsoft Intune. Returns: @odata.type, id, customAttributeName, customAttributeType, displayName, description, scriptContent, createdDateTime, lastModifiedDateTime, runAsAccount, fileName, roleScopeTagIds.type, id, customAttributeName, customAttributeType, displayName, description, scriptContent, createdDateTime, lastModifiedDateTime, runAsAccount,…
get_single_msintune_device_custom_attribute_shell_script_by_id
Get a single device custom attribute shell script by id in Microsoft Intune. Returns: @odata.type, id, customAttributeName, customAttributeType, displayName, description, scriptContent, createdDateTime, lastModifiedDateTime, runAsAccount, fileName, roleScopeTagIds.type, id, customAttributeName, customAttributeType, displayName, description, scriptContent, createdDateTime, lastModifiedDateTime,…
create_a_msintune_device_custom_attribute_shell_script
Create a new device custom attribute shell script in Microsoft Intune. Returns the created script object including id, displayName, customAttributeName, customAttributeType, scriptContent, runAsAccount, and other script properties.
delete_a_msintune_device_custom_attribute_shell_script_by_id
Delete a device custom attribute shell script by id in Microsoft Intune. Returns an empty 204 response on success. Required: id.
update_a_msintune_device_custom_attribute_shell_script_by_id
Update the properties of a device custom attribute shell script by id in Microsoft Intune. Returns the updated script object including id, displayName, customAttributeName, customAttributeType, scriptContent, runAsAccount, and other script properties. Required: id.
msintune_device_custom_attribute_shell_scripts_assign
Assign a device custom attribute shell script to target groups in msintune. The request body contains an assignments array of deviceManagementScriptAssignment objects specifying the target groups. Returns an empty 204 response on success. Required: device_custom_attribute_shell_script_id.
list_all_msintune_managed_device_encryption_states
List managed device encryption states in Microsoft Intune. Returns: @odata.type, id, userPrincipalName, deviceType, osVersion, tpmSpecificationVersion, deviceName, encryptionReadinessState, encryptionState, encryptionPolicySettingState, advancedBitLockerStates, fileVaultStates, policyDetails.type, id, userPrincipalName, deviceType, osVersion, tpmSpecificationVersion, deviceName,…
get_single_msintune_managed_device_encryption_state_by_id
Get a single managed device encryption state by id in Microsoft Intune. Returns: @odata.type, id, userPrincipalName, deviceType, osVersion, tpmSpecificationVersion, deviceName, encryptionReadinessState, encryptionState, encryptionPolicySettingState, advancedBitLockerStates, fileVaultStates, policyDetails.type, id, userPrincipalName, deviceType, osVersion, tpmSpecificationVersion, deviceName,…
create_a_msintune_managed_device_encryption_state
Create a new managed device encryption state in Microsoft Intune. Returns: @odata.type, id, displayName, version, sizeInByte, deviceCount, publisher, platform.
delete_a_msintune_managed_device_encryption_state_by_id
Delete a managed device encryption state by id in Microsoft Intune. Returns an empty 204 response on success. Required: id.
update_a_msintune_managed_device_encryption_state_by_id
Update the properties of a managed device encryption state by id in Microsoft Intune. Returns: @odata.type, id, userPrincipalName, deviceType, osVersion, tpmSpecificationVersion, deviceName, encryptionReadinessState, encryptionState, encryptionPolicySettingState, advancedBitLockerStates, fileVaultStates, policyDetails.type, id, userPrincipalName, deviceType, osVersion, tpmSpecificationVersion,…
list_all_msintune_user_experience_analytics_device_scopes
List user experience analytics device scope configurations in Microsoft Intune. Returns: @odata.type, id, deviceScopeName, ownerId, isBuiltIn, enabled, status, parameter, operator, valueObjectId, value, createdDateTime, lastModifiedDateTime.
get_single_msintune_user_experience_analytics_device_scope_by_id
Get a single user experience analytics device scope configuration in Microsoft Intune by id. Returns the full device scope object including id, deviceScopeName, ownerId, isBuiltIn, enabled, status, parameter, operator, valueObjectId, value, createdDateTime, and lastModifiedDateTime. Required: id.
user_experience_analytics_device_scopes_trigger_device_scope_act
Trigger an action (such as re-evaluation) on a Microsoft Intune user experience analytics device scope. Returns a 200 OK with a deviceScopeActionResult indicating the outcome: deviceScopeAction, deviceScopeId, status, and failedMessage if it failed. Required: actionName, deviceScopeId.
list_all_msintune_operation_approval_policies
List operation approval policies in Microsoft Intune. Returns: @odata.type, id, displayName, description, lastModifiedDateTime, policyType, policyPlatform, policySet, approverGroupIds.type, id, displayName, description, lastModifiedDateTime, policyType, policyPlatform, policySet, approverGroupIds.
get_single_msintune_operation_approval_policy_by_id
Get a single operation approval policy by id in Microsoft Intune. Returns: @odata.type, id, displayName, description, lastModifiedDateTime, policyType, policyPlatform, policySet, approverGroupIds.type, id, displayName, description, lastModifiedDateTime, policyType, policyPlatform, policySet, approverGroupIds. Required: id.
create_a_msintune_operation_approval_policy
Create a new operation approval policy in Microsoft Intune. Returns: @odata.type, id, displayName, description, lastModifiedDateTime, policyType, policyPlatform, policySet, approverGroupIds, version, sizeInByte, deviceCount, publisher, platform.type, id, displayName, description, lastModifiedDateTime, policyType, policyPlatform, policySet, approverGroupIds. Required: displayName, policySet,…
delete_a_msintune_operation_approval_policy_by_id
Delete an operation approval policy in Microsoft Intune by id. Returns an empty 204 response on success. Required: id.
update_a_msintune_operation_approval_policy_by_id
Update the properties of an operation approval policy in Microsoft Intune by id. Returns the updated policy object including id, displayName, description, lastModifiedDateTime, policyType, policyPlatform, policySet, and approverGroupIds. Required: id.
operation_approval_policies_retrieve_approvable_operations
Retrieve the approvable operations for a specific operation approval policy in Microsoft Intune. Returns a collection of operationApprovalPolicySet objects including @odata.type, policyType, and policyPlatform. Required: operation_approval_policy_id.
operation_approval_policies_retrieve_operations_requiring_approv
Retrieve the operations requiring approval for a specific operation approval policy in Microsoft Intune. Returns a collection of operationApprovalPolicySet objects including @odata.type, policyType, and policyPlatform. Required: operation_approval_policy_id.
list_all_msintune_windows_driver_update_profiles
List Windows driver update profiles in Microsoft Intune. Returns: @odata.type, id, displayName, description, approvalType, deviceReporting, newUpdates, deploymentDeferralInDays, createdDateTime, lastModifiedDateTime, roleScopeTagIds, inventorySyncStatus.type, id, displayName, description, approvalType, deviceReporting, newUpdates, deploymentDeferralInDays, createdDateTime, lastModifiedDateTime,…
get_single_msintune_windows_driver_update_profile_by_id
Get a single Windows driver update profile by id in Microsoft Intune. Returns: @odata.type, id, displayName, version, sizeInByte, deviceCount, publisher, platform. Required: id.
create_a_msintune_windows_driver_update_profile
Create a new Windows driver update profile in Microsoft Intune. Returns the created profile including id, displayName, description, approvalType, deviceReporting, newUpdates, deploymentDeferralInDays, createdDateTime, lastModifiedDateTime, roleScopeTagIds, and inventorySyncStatus. Required: displayName.
delete_a_msintune_windows_driver_update_profile_by_id
Delete a Windows driver update profile by id in Microsoft Intune. Returns an empty 204 response on success. Required: id.
update_a_msintune_windows_driver_update_profile_by_id
Update the properties of a Windows driver update profile by id in Microsoft Intune. Returns the updated profile including id, displayName, description, approvalType, deviceReporting, newUpdates, deploymentDeferralInDays, createdDateTime, lastModifiedDateTime, roleScopeTagIds, and inventorySyncStatus. Required: id.
msintune_windows_driver_update_profiles_assign
Assign group assignments to a Windows driver update profile in Microsoft Intune. Returns an empty 204 response on success. Required: windows_driver_update_profile_id.
msintune_windows_driver_update_profiles_execute_action
Execute a bulk action (approve, decline, or schedule) on drivers within a Microsoft Intune Windows driver update profile's inventory. Returns a 200 OK with a bulkDriverActionResult listing which driver ids succeeded, failed, or were not found. Required: windows_driver_update_profile_id, actionName, driverIds.
msintune_windows_driver_update_profiles_sync_inventory
Sync the driver inventory of a Windows Driver Update Profile in Microsoft Intune. Returns an empty 204 response on success. Required: windows_driver_update_profile_id.
list_all_msintune_dep_onboarding_settings
List DEP onboarding settings in Microsoft Intune. Returns a collection of depOnboardingSetting objects including id, appleIdentifier, tokenName, tokenType, tokenExpirationDateTime, syncedDeviceCount, and lastModifiedDateTime.
get_single_msintune_dep_onboarding_setting_by_id
Get a single DEP onboarding setting by id in Microsoft Intune. Returns the full depOnboardingSetting object including id, appleIdentifier, tokenName, tokenType, tokenExpirationDateTime, lastModifiedDateTime, and syncedDeviceCount. Required: id.
create_a_msintune_dep_onboarding_setting
Create a new DEP onboarding setting in Microsoft Intune. Returns the created depOnboardingSetting object including id, appleIdentifier, tokenName, tokenType, tokenExpirationDateTime, and syncedDeviceCount.
delete_a_msintune_dep_onboarding_setting_by_id
Delete a DEP onboarding setting by id in Microsoft Intune. Returns an empty 204 response on success. Required: id.
update_a_msintune_dep_onboarding_setting_by_id
Update the properties of a DEP onboarding setting by id in Microsoft Intune. Returns the updated depOnboardingSetting object including id, appleIdentifier, tokenName, tokenType, tokenExpirationDateTime, and syncedDeviceCount. Required: id.
msintune_dep_onboarding_settings_get_encryption_public_key
Get the encryption public key for a DEP onboarding setting in Microsoft Intune, used to encrypt the Apple Device Enrollment Program token. Returns: value. Required: dep_onboarding_setting_id.
msintune_dep_onboarding_settings_generate_encryption_public_key
Generate a new encryption public key for a DEP onboarding setting in Microsoft Intune, used to encrypt the Apple Device Enrollment Program token. Returns: value. Required: dep_onboarding_setting_id.
msintune_dep_onboarding_settings_upload_dep_token
Upload a new Device Enrollment Program (DEP) token to an existing DEP onboarding setting in Microsoft Intune. Returns an empty 204 response on success. Required: dep_onboarding_setting_id.
dep_onboarding_settings_sync_with_apple_device_enrollment_progra
Sync an Intune DEP onboarding setting with the Apple Device Enrollment Program to pull the latest devices from Apple DEP. Returns an empty 204 response on success. Required: dep_onboarding_setting_id.
list_all_msintune_enrollment_profiles
List enrollment profiles in Microsoft Intune. Returns: @odata.type, id, displayName, description, requiresUserAuthentication, configurationEndpointUrl, enableAuthenticationViaCompanyPortal, requireCompanyPortalOnSetupAssistantEnrolledDevices.
list_all_msintune_imported_device_identities
List imported device identities registered with Microsoft Intune (devices pre-registered by IMEI, serial number, or manufacturer/model/serial before enrollment). Returns each identity's id, importedDeviceIdentifier, importedDeviceIdentityType, description, enrollmentState, platform, createdDateTime, lastModifiedDateTime, lastContactedDateTime.
get_single_msintune_imported_device_identity_by_id
Get a single imported device identity by id. Returns: id, importedDeviceIdentifier, importedDeviceIdentityType, description, enrollmentState, platform, createdDateTime, lastModifiedDateTime, lastContactedDateTime. Required: id.
create_a_msintune_imported_device_identity
Create (pre-register) a single imported device identity in Microsoft Intune. Returns the created identity (201 Created).
delete_a_msintune_imported_device_identity_by_id
Delete an imported device identity by id. Returns an empty 204 response on success. Required: id.
update_a_msintune_imported_device_identity_by_id
Update an existing imported device identity by id. Returns the updated identity (200 OK). Required: id.
msintune_imported_device_identities_import_device_identity_list
Bulk-import a list of device identities into Microsoft Intune in a single call. Returns a 200 OK with one importedDeviceIdentityResult per submitted identity, each carrying a status flag indicating whether that individual item succeeded. Required: importedDeviceIdentities.
msintune_imported_device_identities_search_existing_identities
Check which of a submitted list of device identities already exist as imported device identities in Microsoft Intune. Returns a 200 OK with the subset of submitted identities that were found to already exist. Required: importedDeviceIdentities.
list_all_msintune_android_device_owner_enrollment_profiles
List androidDeviceOwnerEnrollmentProfiles in Microsoft Intune. Returns: @odata.type, accountId, id, displayName, description, enrollmentMode, enrollmentTokenType, createdDateTime, lastModifiedDateTime, tokenValue, tokenCreationDateTime, tokenExpirationDateTime, enrolledDeviceCount, enrollmentTokenUsageCount, qrCodeContent, qrCodeImage, roleScopeTagIds, configureWifi, wifiSsid, wifiPassword,…
get_android_device_owner_enrollment_profile_by_id
Get a single androidDeviceOwnerEnrollmentProfile by id in Microsoft Intune. Returns: @odata.type, id, displayName, value. Required: id.
create_a_msintune_android_device_owner_enrollment_profile
Create a new androidDeviceOwnerEnrollmentProfile in Microsoft Intune. Returns the created profile including id, accountId, displayName, enrollmentMode, enrollmentTokenType, createdDateTime, lastModifiedDateTime, and Wi-Fi configuration properties.
delete_a_msintune_android_device_owner_enrollment_profile_by_id
Delete an androidDeviceOwnerEnrollmentProfile by id in Microsoft Intune. Returns an empty 204 response on success. Required: id.
update_a_msintune_android_device_owner_enrollment_profile_by_id
Update the properties of an androidDeviceOwnerEnrollmentProfile by id in Microsoft Intune. Returns the updated profile including id, accountId, displayName, enrollmentMode, enrollmentTokenType, lastModifiedDateTime, configureWifi, wifiSsid, wifiSecurityType, and deviceNameTemplate. Required: id.
msintune_android_device_owner_enrollment_profiles_revoke_token
Revoke the enrollment token for an Android device owner enrollment profile in Microsoft Intune. Returns an empty 204 response on success. Required: android_device_owner_enrollment_profile_id.
msintune_android_device_owner_enrollment_profiles_create_token
Create a new enrollment token for an Android device owner enrollment profile in Microsoft Intune. Returns an empty 204 response on success. Required: android_device_owner_enrollment_profile_id.
device_app_management_sync_microsoft_store_for_business_apps
Sync the Intune account with Microsoft Store for Business to trigger an application sync. Returns an empty 204 response on success.
list_all_msintune_device_app_management
Get the Intune deviceAppManagement singleton object, which contains Microsoft Store for Business onboarding and sync configuration. Returns: @odata.type, id, isEnabledForMicrosoftStoreForBusiness, microsoftStoreForBusinessLanguage, microsoftStoreForBusinessLastCompletedApplicationSyncTime, microsoftStoreForBusinessLastSuccessfulSyncDateTime, microsoftStoreForBusinessPortalSelection.type.
msintune_device_app_management_bulk_update
Update properties of the Intune deviceAppManagement singleton object, including Microsoft Store for Business sync and portal selection settings. Returns: @odata.type, id, isEnabledForMicrosoftStoreForBusiness, microsoftStoreForBusinessLanguage, microsoftStoreForBusinessLastCompletedApplicationSyncTime, microsoftStoreForBusinessLastSuccessfulSyncDateTime, microsoftStoreForBusinessPortalSelection,…
list_all_msintune_mobile_app_troubleshooting_events
List mobile app troubleshooting events in Microsoft Intune. Returns: @odata.type, id, eventDateTime, correlationId, troubleshootingErrorDetails, eventName, additionalInformation, managedDeviceIdentifier, userId, applicationId, history.
get_single_msintune_mobile_app_troubleshooting_event_by_id
Get a mobile app troubleshooting event by id in Microsoft Intune. Returns: @odata.type, id, eventDateTime, correlationId, troubleshootingErrorDetails, eventName, additionalInformation, managedDeviceIdentifier, userId, applicationId, history. Required: id.
create_a_msintune_mobile_app_troubleshooting_event
Create a mobile app troubleshooting event in Microsoft Intune. Returns the created event including id, eventDateTime, correlationId, applicationId, userId, and troubleshootingErrorDetails.
delete_a_msintune_mobile_app_troubleshooting_event_by_id
Delete a mobile app troubleshooting event by id in Microsoft Intune. Returns an empty 204 response on success. Required: id.
update_a_msintune_mobile_app_troubleshooting_event_by_id
Update a mobile app troubleshooting event by id in Microsoft Intune. Returns the updated event including id, eventDateTime, correlationId, applicationId, userId, and troubleshootingErrorDetails. Required: id.
list_all_msintune_privilege_management_elevation_requests
List privilege management elevation requests in Microsoft Intune EPM. Returns: @odata.type, id, requestedByUserId, requestedOnDeviceId, requestedByUserPrincipalName, deviceName, requestCreatedDateTime, requestLastModifiedDateTime, requestJustification, applicationDetail, status, reviewCompletedByUserId, reviewCompletedByUserPrincipalName, reviewCompletedDateTime, requestExpiryDateTime,…
get_single_msintune_privilege_management_elevation_request_by_id
Get a single privilege management elevation request in Microsoft Intune EPM by id. Returns: @odata.type, id, keepEnrollmentData, keepUserData, macOsUnlockCode, obliterationBehavior, persistEsimDataPlan. Required: id.
msintune_privilege_management_elevation_requests_approve
Approve a pending privilege management elevation request in Microsoft Intune EPM. Returns the updated elevation request including id, status, reviewCompletedByUserId, reviewCompletedByUserPrincipalName, reviewCompletedDateTime, and reviewerJustification. Required: privilege_management_elevation_request_id.
msintune_privilege_management_elevation_requests_deny
Deny a pending privilege management elevation request in Microsoft Intune EPM. Returns the updated elevation request including id, status, reviewCompletedByUserId, reviewCompletedByUserPrincipalName, reviewCompletedDateTime, and reviewerJustification. Required: privilege_management_elevation_request_id.
msintune_privilege_management_elevation_requests_revoke
Revoke an approved privilege management elevation request in Microsoft Intune EPM. Returns the updated elevation request including id, status, reviewCompletedByUserId, reviewCompletedByUserPrincipalName, reviewCompletedDateTime, and reviewerJustification. Required: privilege_management_elevation_request_id.
list_all_msintune_me
Get the current authenticated user's profile in Microsoft Intune via the Microsoft Graph /me endpoint. Returns: id, value.
list_all_msintune_mobile_app_install_summary
Get the install status summary for a Microsoft Intune mobile app across all assigned devices and users: counts of installed, failed, not applicable, not installed, and pending-install, broken out by device and by user. Required: mobile_app_id.
list_all_msintune_groups
List Microsoft Entra ID (Azure AD) groups in the tenant — Microsoft 365 groups, security groups, and distribution groups. Returns each group's core attributes by default: id, displayName, description, mail, mailEnabled, mailNickname, groupTypes, securityEnabled, visibility, createdDateTime, expirationDateTime, and more. Additional properties are available via $select.
get_single_msintune_group_by_id
Get a single Microsoft Entra ID group by id. Returns the default property set unless $select is used. Required: id.
create_a_msintune_group
Create a new Microsoft Entra ID group — a Microsoft 365 group, security group, or dynamic group depending on the properties supplied. Returns the created group's default properties (201 Created). Required: displayName, mailEnabled, mailNickname, securityEnabled.
update_a_msintune_group_by_id
Update a Microsoft Entra ID group's properties. Supply only the fields that should change. Returns an empty 204 response on success in most cases (200 OK with a small set of specific properties, e.g. hideFromAddressLists). Required: id.
delete_a_msintune_group_by_id
Delete a Microsoft Entra ID group. Returns an empty 204 response on success. Required: id.
list_all_msintune_users
List Microsoft Entra ID (Azure AD) user accounts in the tenant. By default only a limited property set is returned: businessPhones, displayName, givenName, id, jobTitle, mail, mobilePhone, officeLocation, preferredLanguage, surname, userPrincipalName. Request additional properties via $select.
get_single_msintune_user_by_id
Get a single Microsoft Entra ID user by id or userPrincipalName. Returns the default property set unless $select is used. Required: id.
create_a_msintune_user
Create a new Microsoft Entra ID user. Returns the created user (201 Created). Required: accountEnabled, displayName, mailNickname, userPrincipalName, passwordProfile.
update_a_msintune_user_by_id
Update a Microsoft Entra ID user's properties. Supply only the fields that should change. Returns an empty 204 response on success. Required: id.
delete_a_msintune_user_by_id
Delete a Microsoft Entra ID user. Returns an empty 204 response on success. Required: id.
list_all_msintune_organization
Get the calling tenant's organization profile from Microsoft Entra ID. Always returns a single-item collection — the tenant has exactly one organization object. Returns: id (tenant id), displayName, businessPhones, city, country, countryLetterCode, createdDateTime, defaultUsageLocation, preferredLanguage, tenantType, technicalNotificationMails, directorySizeQuota, and more.
get_single_msintune_organization_by_id
Get the tenant's organization object by id. Since a tenant has exactly one organization object, this returns the same data as the list method scoped by id. Returns: id, displayName, businessPhones, city, country, tenantType, directorySizeQuota, and more. Required: id (the tenant/organization id).
update_a_msintune_organization_by_id
Update the tenant's organization properties. Only a small subset of properties are writable — most organization fields are directory-managed and read-only. Returns an empty 204 response on success. Required: id.
list_all_msintune_role_definitions
List Microsoft Intune role-based access control (RBAC) role definitions — the built-in and custom roles that determine what actions an Intune administrator can perform. Returns each definition's id, displayName, description, rolePermissions (allowed and not-allowed resource actions), and isBuiltIn.
list_all_msintune_role_assignments
List the role assignments for a Microsoft Intune RBAC role definition — the groups and scopes that a given role has been assigned to. Returns each assignment's id, displayName, description, and resourceScopes (the Entra ID group ids the assignment's scope is limited to). Required: role_definition_id.
list_all_msintune_resource_operations
List the resource operations available in Microsoft Intune — the individual permission strings (e.g. Microsoft.Intune/MobileApps/Read) that can be granted or denied within a role definition's rolePermissions. Use this to discover valid values when constructing a custom role definition.
How it works
From Microsoft Intune account to governed MCP endpoint
Connect
Link a Microsoft Intune account through Elaichi's hosted connect flow. Credentials are vaulted — nobody, including the AI, ever sees them.
Compose
The connection becomes a toolbox instantly. Curate which Microsoft Intune tools are exposed, rename them, or freeze arguments.
Mint
Mint a personal MCP endpoint on that toolbox and paste it into Claude, Cursor, or any MCP client — governed by roles, restrictions, and audit logs.
Give every teammate a governed MCP server
Start a 14-day Gold trial — connect a product, curate a toolbox, and paste an endpoint into Claude or Cursor in minutes.