-
-
Notifications
You must be signed in to change notification settings - Fork 31
Home
IntuneCD or, Intune Continuous Delivery as it stands for is a Python package that is used to back up, update and document configurations in Intune. It was created with running it from a CI/CD pipeline in mind. Using this approach we get complete history of which configurations have been changed and what setting has been changed.
The main function is to back up configurations from Intune to a Git repository from a DEV environment and if any configurations has changed, push them to PROD Intune environment.
When running IntuneCD in a pipeline with a Git repo, the flow of backing up and updating configurations looks like this:
flowchart LR
A[Change in DEV] --> B[Backup pipeline] --> C[Git repo] --> D{Change Approved?};
D -- Yes --> E[Update pipeline] --> F[PROD];
D -- No --> G[End];
Above, it is assumed that the main branch of the repository is protected so that a Pull Request is required for the changes to be merged into the main branch from the backup pipeline. If the change is approved and merged, the update pipeline will automatically run and push the changed to the PROD environment. If not approved, no change will be pushed.
| Payload | Back up | Update | Document | Create | Remove | Audit | Notes |
|---|---|---|---|---|---|---|---|
| Apple Push Notification | 🎉 | 🎉 | 🎉 | ||||
| Apple Volume Purchase Program tokens | 🎉 | 🎉 | 🎉 | ||||
| Application Configuration Policies | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | |
| Application Protection Policies | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | |
| Applications | 🎉 | 🎉 | 🎉 | ||||
| Compliance Policies | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | |
| Conditional Access | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | Assignments are not updated currently |
| Device Categories | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | |
| Device Configurations | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | For custom macOS and iOS configurations, mobileconfigs are backed up |
| Device Management Settings | 🎉 | 🎉* | 🎉 | 🎉 | Interactive authentication is currently required to update these settings | ||
| Group Policy Configurations | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | For custom ADMX, the presentation value will not be added when creating the configuration |
| Enrollment profiles | 🎉 [^1] | 🎉 | 🎉 | 🎉 [^2] | 🎉 [^3] | 🎉 | |
| Enrollment Status Page | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | ||
| Endpoint Security | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | Security Baselines Antivirus Disk Encryption Firewall Endpoint Detection and Response Attack Surface Reduction Account Protection |
| Filters | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | ||
| Managed Google Play | 🎉 | 🎉 | 🎉 | ||||
| Notification Templates | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | |
| Proactive Remediation | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | |
| Partner Connections | 🎉 | 🎉 | 🎉 | Compliance Management Remote Assistance |
|||
| Shell Scripts | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | |
| Custom Attributes | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | |
| Powershell Scripts | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | |
| Settings Catalog Policies | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | ||
| Enrollment Configurations | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | Enrollment platform restrictions Enrollment device limit Windows Hello For Business |
| Windows Driver Updates | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | |
| Windows Feature Updates | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | |
| Windows Quality Updates | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | |
| Roles | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | Only custom roles are managed |
| Scope Tags | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | |
| Activation Lock Bypass Codes | 🎉 | ||||||
| Custom Compliance Scripts | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 | 🎉 |
[^1]: Only Apple Business Manager and Windows Autopilot profiles are backed up. [^2]: Only Windows Autopilot profiles are created. [^3]: Only Windows Autopilot profiles are removed.
When this tool tries to update configurations, it matches the display name. Therefore, the display name from DEV must match in PROD.
Updating Windows Update Rings configurations is currently not supported, the tool can however create update rings if they don't exist.