Microsoft Intune MCP server for AI agents and assistants

Replace every assignment for the named app.

Replace every assignment for the named app config.

Replace the complete assignment target set for one compliance policy; use assignment CRUD tools to manage a single assignment relationship.

Replace all group, user, device, collection, exclusion, or scope-tag assignments for an Intune device configuration.

Replace the complete assignment set for one device enrollment configuration with the supplied assignment targets.

Associate one user, identified by the supplied user names, with one Windows Autopilot device identity; no other device identity is changed.

Permanently unregister the Windows Autopilot device identities matching the supplied serial numbers.

Clean a Windows device addressed as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`, removing user-installed Win32 apps and restoring policy-managed apps and settings.

Clean a Windows device addressed through its detected-app membership and associated user, removing user-installed Win32 apps and restoring policy-managed apps and settings.

Clean a Windows device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, removing user-installed Win32 apps and restoring policy-managed apps and settings.

Commit an uploaded content file to a specific Intune mobile-app content version using its encryption metadata.

Create an Intune Android line-of-business app record for deploying an uploaded APK package.

Create a tenant-wide Intune app category that can be attached to mobile apps.

Create an Intune iOS managed-app configuration that delivers app settings to targeted devices.

Create one Intune app deployment assignment with an install intent and target, without replacing sibling assignments.

Attach an existing tenant-wide Intune category to a specific mobile app.

Create mobileAppContent through the provider-required microsoft.

Create a Windows Universal AppX contained-app entry under a specific generic content version; use the committed-contained-app create tool for the app-level committed route.

Create a contained-app entry on a Windows Universal AppX app's committedContainedApps route, independent of a specific content-version route.

Create a legacy Android compliance policy with its required scheduled block action embedded in the initial request.

Create one device-and-user compliance observation under a setting summary, not aggregate setting counts.

Create a managed-device record under a specific detected app's managed-devices relationship.

Record a Windows malware detection and its severity, execution, remediation, and threat state beneath a device reached from a detected app.

Create a device log-collection request under the managed device reached from a detected app.

Submit Microsoft Graph's documented discriminator-only request to create a user relationship beneath the managed device reached from a detected app.

Create a managed-device record under a user reached through a detected app and one of its devices.

Create an Android custom device configuration with OMA settings in Intune.

Create one group, user, device, collection, exclusion, or scope-tag assignment for an Intune device configuration.

Create one target assignment on a device enrollment configuration for a group, collection, all devices, or all licensed users.

Create one enrollment limit configuration that caps how many devices targeted users may enroll.

Create a persisted Microsoft Intune report export job.

Stage one imported Windows Autopilot device identity in Intune from its serial number, hardware identifier, and optional assignment metadata.

Create a diagnostic log-collection request for a device addressed as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`.

Create a diagnostic log-collection request for a device addressed through its detected-app membership and associated user.

Create a diagnostic log-collection request through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route.

Create mobileAppContent in a managed mobile line-of-business app context through the provider-required microsoft.

Create mobileAppContent in a mobile line-of-business app context through the provider-required microsoft.

Delete an Intune Android line-of-business app record used for APK deployment.

Delete a tenant-wide Intune app category, not merely one app's category relationship.

Delete an Intune iOS managed-app configuration used to deliver app settings.

Delete one target assignment from an Intune mobile-app configuration.

Delete one device deployment-status record from an Intune mobile-app configuration.

Delete one user deployment-status record from an Intune mobile-app configuration.

Delete one install-intent target assignment from an Intune mobile app.

Detach an Intune category from a specific mobile app without deleting the tenant-wide category.

Delete mobileAppContent through the provider-required microsoft.

Delete a Windows Universal AppX contained-app entry from a specific generic content version, not the app-level committed route.

Delete an uploaded content file from a specific Intune mobile-app content version.

Permanently unregister one Windows Autopilot device identity without wiping the physical device.

Delete a contained-app entry from a Windows Universal AppX app's committedContainedApps route, not a specific content version.

Delete one legacy Android compliance policy and its device requirements.

Delete one device-and-user compliance observation under a setting summary.

Delete one setting-and-platform compliance count summary.

Delete a detected application record.

Delete a device addressed as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`; this removes its Intune record and can trigger Retire or Wipe.

Deletes a windowsDeviceMalwareState.

Deletes a deviceLogCollectionResponse.

Remove the user relationship record under the specified detected-app managed-device route.

Delete a device addressed through its detected-app membership and associated user; this removes its Intune record and can trigger Retire or Wipe.

Permanently delete an Android custom device configuration from Intune; this does not wipe devices.

Permanently delete one assignment from an Intune device configuration; this does not delete or wipe devices.

Permanently remove one target assignment from a device enrollment configuration without deleting the configuration or wiping devices.

Permanently delete one enrollment limit configuration without wiping or unenrolling any device.

Permanently delete one Intune report export-job resource selected by ID; this does not delete or wipe devices.

Permanently delete one staged imported Windows Autopilot device identity without wiping the physical device.

Delete a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route.

Delete mobileAppContent in a managed mobile line-of-business app context through the provider-required microsoft.

Delete mobileAppContent in a mobile line-of-business app context through the provider-required microsoft.

Delete a user and that user's data from a shared Apple device addressed as a detected app's managed-device member.

Delete a user and that user's data from a shared Apple device addressed through a detected app and associated user.

Delete a user and that user's data from a shared Apple device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route.

Disable Lost Mode for a device addressed as a detected app's managed-device member, removing the recovery lock-screen details.

Disable Lost Mode for a device addressed through its detected-app membership and associated user, removing the recovery lock-screen details.

Disable Lost Mode through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, removing the recovery lock-screen message and contact information.

Enable applicable processor architectures for the named Win32 app.

Get one Intune Android line-of-business app and its deployment metadata by app ID.

Get one tenant-wide Intune app category; use GET_APPS_CATEGORIES for a category through a specific app's categories route.

Get one Intune iOS managed-app configuration and its delivered settings by configuration ID.

Get one target assignment for a specific Intune mobile-app configuration.

Get one device's deployment status for a specific Intune mobile-app configuration.

Get aggregate per-device deployment outcome counts for a specific Intune mobile-app configuration.

Get one user's deployment status for a specific Intune mobile-app configuration.

Get aggregate per-user deployment outcome counts for a specific Intune mobile-app configuration.

Get one Intune mobile-app assignment, including its install intent, target, and settings.

Get one category through a specific mobile app's categories route; use GET_APP_CATEGORY for the tenant-wide category route.

Read mobileAppContent through the provider-required microsoft.

Get one Windows Universal AppX contained app from a specific generic content version; use the committed-contained-app get tool for the app-level committed route.

Retrieve one Windows Autopilot device identity, including its hardware, enrollment, and assigned-user properties.

Query cached Intune report data by ID, with optional column selection, grouping, ordering, search, and paging.

Get one contained app from a Windows Universal AppX app's committedContainedApps route; use the content-version contained-app get tool for a specific version.

Get tenant-wide device counts by compliance-policy state; use a policy device status overview for one policy.

Get aggregate compliant, noncompliant, error, and conflict device counts for one policy; use device statuses for individual records.

Get aggregate compliant, noncompliant, error, and conflict user counts for one policy; use user statuses for individual rollups.

Get one legacy Android compliance policy and its device requirement settings; use LIST_COMPLIANCE_POLICIES to find its ID.

Query noncompliance details organized by Intune compliance policy; use the summary sibling for aggregated policy results.

Query summarized noncompliance results organized by Intune compliance policy; use the detail sibling for non-summary results.

Query noncompliance results organized by compliance setting rather than by compliance policy.

Get one device-and-user compliance observation under a setting summary; use LIST_COMPLIANCE_SETTING_STATES to find its ID.

Get one setting-and-platform compliance count summary; use LIST_COMPLIANCE_SETTING_SUMMARIES to find its ID.

Query noncompliance details organized by Intune configuration policy; use the summary sibling for aggregated policy results.

Query summarized noncompliance results organized by Intune configuration policy; use the detail sibling for non-summary results.

Query noncompliance results organized by configuration setting rather than by configuration policy.

Retrieve one Intune detected-app inventory record by ID, including its platform, publisher, version, size, and device-count metadata.

Get one device as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`, returning exactly id, deviceName, operatingSystem, osVersion, complianceState, managementState, and lastSyncDateTime.

Retrieve one malware-state record under a detected app's managed device, including threat identity, severity, execution state, remediation state, detection count, and timestamps.

Retrieve the category assigned to a managed device reached through a detected app, including the category ID and display metadata.

Retrieve one device log-collection request reached through a detected app and managed device, including status, timestamps, initiator, expiration, and log size.

Retrieve one user relationship attached to a managed device reached through a detected app.

Retrieve Windows protection health for a managed device reached through a detected app, including malware protection, scan, signature, reboot, engine, and tamper-protection status.

Get one device through its detected-app membership and associated user, returning exactly id, deviceName, operatingSystem, osVersion, complianceState, managementState, and lastSyncDateTime.

Get one Android custom device configuration and its OMA settings by ID.

Get aggregate pending, successful, failed, and not-applicable device counts for an Intune device configuration.

Get aggregate pending, successful, failed, and not-applicable user counts for an Intune device configuration.

Retrieve the Intune device configuration activity report for device-scoped activity, returned as report content.

Get tenant-wide device counts by deployment state across Intune device configurations.

Retrieve the Intune device configuration activity report for user-scoped activity, returned as report content.

Query settings associated with Intune device-management intents; use the contributing-profiles sibling to identify profiles per setting.

Retrieve only the tenant's Microsoft Graph reports-root container metadata, such as its root ID and OData type.

Query Intune noncompliance results organized by device rather than by policy or setting.

Query device compliance status organized by policy; use the policy-settings sibling for setting-level status.

Query device compliance status organized by policy setting; use the policies sibling for policy-level status.

Query device compliance status organized by setting without selecting a specific compliance-policy hierarchy.

Query detailed device status organized by compliance policy; use the policy summary sibling for summarized status.

Query devices that have no compliance policy, for identifying gaps in policy coverage.

Retrieve one device enrollment configuration of any subtype by its Microsoft Graph ID.

Retrieve one Intune report export job by ID to inspect its current properties and relationships.

Query the named Intune historical report with optional projection, grouping, ordering, search, paging, and filtering.

Retrieve one staged imported Windows Autopilot device identity, including its hardware identifier, assignment, and import state.

Query the Intune profiles contributing to each device-management intent setting; use the intent-settings sibling for settings rather than profiles.

Get one managed device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, returning exactly id, deviceName, operatingSystem, osVersion, complianceState, managementState, and lastSyncDateTime.

Return detailed managed-device enrollment failures, with optional row offset, limit, filter, and continuation token.

Return the most frequent managed-device enrollment failures for the optional reporting period.

Retrieve the tenant-wide Intune managed-device overview: enrollment totals plus operating-system and Exchange access-state distributions.

Read mobileAppContent in a managed mobile line-of-business app context through the provider-required microsoft.

Read mobileAppContent in a mobile line-of-business app context through the provider-required microsoft.

Query noncompliance results across both device and setting dimensions in one report.

Query summarized device status organized by compliance policy; use the policy detail sibling for detailed status.

Query metadata for Intune policy noncompliance reporting; use report siblings when row or summary data is needed.

Query policy noncompliance details; use the policy summary sibling for aggregated results or metadata sibling for report metadata.

Query summarized policy noncompliance results; use the policy detail sibling for non-summary results.

Query device compliance status organized by both policy and platform; use policy-only siblings when platform is not a needed dimension.

Query detailed device status organized by compliance-policy setting; use the setting summary sibling for summarized status.

Query summarized device status organized by compliance-policy setting; use the setting detail sibling for detailed status.

Query filter metadata for an Intune report before constructing a filtered report request.

Query setting-level noncompliance results when no compliance- or configuration-specific setting family is required.

Submit the supplied Windows Autopilot device identities together for import processing in Intune.

List tenant-wide Intune app categories available for organizing mobile apps.

List Intune iOS managed-app configurations that deliver settings to targeted apps and devices.

List the group or device targets assigned to a specific Intune mobile-app configuration.

List per-device deployment statuses for a specific Intune mobile-app configuration.

List per-user deployment statuses for a specific Intune mobile-app configuration.

List dependency and supersedence relationships between Intune mobile apps.

List Intune Android line-of-business apps used to deploy uploaded APK packages.

List install-intent target assignments for a specific Intune mobile app.

List categories attached to a specific Intune mobile app; use LIST_APP_CATEGORIES for the tenant-wide category collection.

List mobileAppContent versions through the provider-required microsoft.

List Windows Universal AppX contained apps under a specific generic content version; use the committed-contained-app list tool for the app-level committed route.

List Windows Autopilot device identities one page at a time, including their hardware, enrollment, and assigned-user properties.

List contained apps on a Windows Universal AppX app's committedContainedApps route; use the content-version contained-app list tool for a specific version.

List legacy Android compliance policies that define device security and password requirements.

List individual target assignment relationships under one compliance policy; use ASSIGN_COMPLIANCE_POLICY to replace the complete target set.

List per-setting device-count rollups under one compliance policy, distinct from individual device statuses.

List individual device evaluation statuses under one compliance policy; use the device status overview for aggregate counts.

List individual user compliance rollups under one policy; use the user status overview for aggregate counts.

List individual device-and-user compliance observations under one setting summary, not aggregate setting counts.

List setting-and-platform summaries of device compliance counts; use compliance setting states for individual device and user observations.

List paginated malware-state records beneath a detected app's managed device, including threat severity, execution and remediation states, detection counts, and timestamps.

List managed devices associated with the named detected app.

List paginated log-collection requests for a managed device reached through a detected app, returning request statuses, timestamps, initiators, expiration, and sizes for monitoring or ID lookup.

List paginated user relationships for a managed device reached through a detected app.

List applications detected on managed devices in Microsoft Intune.

List managed devices through the named detected-app and user relationships.

List all Intune device configurations across configuration subtypes.

List the group, user, device, collection, exclusion, and scope-tag assignments for an Intune device configuration.

List per-setting deployment-state counts for an Intune device configuration.

List per-user deployment statuses for an Intune device configuration.

List device enrollment configurations of every subtype one page at a time, including limit, enrollment-status-page, Windows Hello, and platform-restriction configurations.

List one device enrollment configuration's target assignments one page at a time.

List Intune report export jobs so an agent can select a job to inspect, update, or delete.

List staged imported Windows Autopilot device identities one page at a time, including each identity's import state.

List managed-device records.

List mobileAppContent through the documented microsoft.

List mobileAppContent through the concrete microsoft.

Asynchronously request location for a device addressed as a detected app's managed-device member.

Asynchronously request location for a device addressed through its detected-app membership and associated user.

Asynchronously request device location through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route.

Log out the active user from a shared Apple device addressed as a detected app's managed-device member.

Log out the active user from a shared Apple device addressed through a detected app and associated user.

Log out the active user from a shared Apple device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route.

Reboot a device addressed as a detected app's managed-device member.

Reboot a device addressed through its detected-app membership and associated user.

Reboot a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route.

Remotely lock a device addressed as a detected app's managed-device member, blocking the active user.

Remotely lock a device addressed through its detected-app membership and associated user, blocking the active user.

Remotely lock a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, blocking the active user until unlock.

Retire all devices from management for this user.

Request a Microsoft Defender scan for a Windows device addressed as a detected app's managed-device member.

Request a Microsoft Defender scan for a Windows device addressed through its detected-app membership and associated user.

Request a Microsoft Defender scan through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route.

Retire a device addressed as a detected app's managed-device member, unenrolling it and removing company-managed data while preserving personal data.

Retire a device addressed through its detected-app membership and associated user, unenrolling it and removing company-managed data while preserving personal data.

Retire a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, unenrolling it and removing company-managed data while preserving personal data.

Apply the supplied complete rule-action schedule to one compliance policy; use scheduled-rule-action tools to manage one schedule resource.

Set one enrollment limit configuration's precedence position for users targeted by multiple configurations.

Shut down a device addressed as a detected app's managed-device member.

Shut down a device addressed through its detected-app membership and associated user.

Shut down a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route.

Request an immediate policy sync for a device addressed as a detected app's managed-device member.

Request an immediate policy sync for a device addressed through its detected-app membership and associated user.

Request an immediate Intune policy sync through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route.

Removes the assigned user from the Autopilot device identity, disrupting its user-targeted provisioning association.

Update deployment metadata for an Intune Android line-of-business app.

Update a tenant-wide Intune app category's properties, independent of any one app relationship.

Update the settings or metadata of an Intune iOS managed-app configuration.

Update one target assignment for a specific Intune mobile-app configuration.

Update one device's deployment-status record for a specific Intune mobile-app configuration.

Update one user's deployment-status record for a specific Intune mobile-app configuration.

Update one Intune mobile-app assignment's target or settings.

Update a category through a specific mobile app's categories route; use UPDATE_APP_CATEGORY for the tenant-wide route.

Update mobileAppContent through the provider-required microsoft.

Update a Windows Universal AppX contained-app entry under a specific generic content version; use the committed-contained-app update tool for the app-level committed route.

Update a contained-app entry on a Windows Universal AppX app's committedContainedApps route; use the content-version update tool for an entry owned by a specific version.

Update device security or password requirements on one legacy Android compliance policy.

Update one enforcement action or delay within a scheduled compliance rule-action container.

Update one device-and-user compliance observation under a setting summary, not its aggregate counts.

Update aggregate device compliance counts for one setting and platform, not an individual device setting state.

Request a Defender security-intelligence update for a Windows device addressed as a detected app's managed-device member.

Request a Defender security-intelligence update for a Windows device addressed through its detected-app membership and associated user.

Request a Microsoft Defender security-intelligence update through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route.

Update a detected application's properties.

Update ownership classification, administrator-friendly name, or notes for a device addressed as a detected app's managed-device member.

Update supplied threat identity, severity, execution, remediation, detection-count, category, URL, or timestamp fields on a known malware-state record beneath a detected app's managed device.

Submit Microsoft Graph's documented discriminator-only device-category PATCH for a managed device reached through a detected app.

Update supplied status, identity, timing, initiator, expiration, size, or enrollment metadata on a known log-collection request reached through a detected app and managed device; returns the updated request.

Submit Microsoft Graph's documented discriminator-only PATCH for the existing user relationship reached through a detected app and managed device.

Update supplied Windows protection health fields for a managed device reached through a detected app, such as malware protection, scan, signature, reboot, engine, product, or tamper status.

Update ownership classification, administrator-friendly name, or notes for a device addressed through its detected-app membership and associated user.

Update the name, description, version, or OMA settings of an Android custom device configuration in Intune.

Update only the supplied user principal name, addressable user name, group tag, or display name on one Windows Autopilot device identity.

Replace the target of one assignment on a device enrollment configuration.

Update only the supplied limit, priority, version, name, or description on one enrollment limit configuration.

Update the supplied properties of one Intune report export job selected by ID.

Update a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, changing its ownership classification, administrator-friendly name, or notes.

Update mobileAppContent in a managed mobile line-of-business app context through the provider-required microsoft.

Update mobileAppContent in a mobile line-of-business app context through the provider-required microsoft.

Check whether Windows enrollment auto-discovery is configured for one domain and return Microsoft Graph's Boolean result.

Wipe a device addressed as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`.

Wipe a device addressed through its detected-app membership and associated user.

Wipe a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route.