mirror of
https://github.com/satishsinghi-gh/MDM-ODA.git
synced 2026-08-05 16:17:47 +00:00
Add files via upload
This commit is contained in:
satishsinghi-gh
+22957
File diff suppressed because it is too large
Load Diff
@@ -2,7 +2,7 @@
|
||||
|
||||
**Live Analytics, Insights & Actions for Entra ID and Intune**
|
||||
|
||||
[](https://github.com/satishsinghi-gh/mdm-oda/releases)
|
||||
[](https://github.com/satishsinghi-gh/mdm-oda/releases)
|
||||
[](https://learn.microsoft.com/en-us/powershell/)
|
||||
[](https://learn.microsoft.com/en-us/dotnet/desktop/wpf/)
|
||||
[](https://learn.microsoft.com/en-us/graph/)
|
||||
@@ -119,6 +119,8 @@ MDM-ODA is a PowerShell & WPF based plug-n-play tool for Entra & Intune on-deman
|
||||
|
||||
|
||||
*Hardware, OS, compliance, encryption, and registration details from a single query*
|
||||
|
||||
*Filters include Platform, Ownership, Manufacturer/Model, Compliance and **Intune Enrolled only** (limits results to devices with an Intune record — honored by both Get Device Info and Get All Device Info). Inputs accept UPNs, device names, serial numbers, Intune Device IDs, and both Entra Device IDs and Entra Device Object IDs. With Platform/Ownership filters set, Get All Device Info enumerates server-side so only matching devices are queried.*
|
||||
</details>
|
||||
|
||||
<details>
|
||||
@@ -193,7 +195,7 @@ MDM-ODA is a PowerShell & WPF based plug-n-play tool for Entra & Intune on-deman
|
||||
<summary><strong>Bulk Autopilot Registration</strong> — Register hardware hashes to Autopilot from CSVs (NEW in V0.81)</summary>
|
||||
|
||||
|
||||
*Register devices to Windows Autopilot in bulk from hardware hash CSV files (Get-WindowsAutopilotInfo format). Select CSVs from this PC (multi-select) or from an Azure Blob container via SAS URL. A Group Tag inside a CSV wins; the typed Group Tag fills the blanks. Staged workflow: select the source, click Bulk Register, review the full validation summary (blank serials, invalid hashes and duplicate serials are flagged and skipped), then Confirm to execute. Per-device results with real HTTP status, and a single Autopilot sync is triggered after posting. Import-only — existing Autopilot registrations are never modified.*
|
||||
*Register devices to Windows Autopilot in bulk from hardware hash CSV files (Get-WindowsAutopilotInfo format). Select CSVs from this PC (multi-select) or from an Azure Blob container via SAS URL. **Optional mapping sheet** (CSV or XLSX with Serial Number + Group Tag columns): when your folder or container holds mixed hashes destined for multiple Group Tags, attach one mapping sheet and every serial gets its correct tag automatically — no manual segregation, no multiple upload rounds. Tag precedence: mapping sheet (by serial, then by the SerialNumber.csv file name) > Group Tag column inside the hash CSV > the typed Group Tag. The validation workflow also checks the tenant and flags serials **already registered in Autopilot** (with their current tag) — those are skipped, not re-posted. Staged workflow with full validation summary and explicit confirmation; per-device results (Registered / Failed / Skipped - Already Registered / Skipped - No Mapping); one Autopilot sync after posting. Import-only — existing registrations are never modified.*
|
||||
</details>
|
||||
|
||||
<details>
|
||||
@@ -203,6 +205,20 @@ MDM-ODA is a PowerShell & WPF based plug-n-play tool for Entra & Intune on-deman
|
||||
*Check Windows Autopilot registration status for UPNs, Entra Device IDs, Serial Numbers, or Groups (one per line). Queries Autopilot directly — devices registered in Autopilot but not yet enrolled in Intune are still reported. Output columns: Input, Serial Number, Device Name, Autopilot Registered (Yes/No), Group Tag, and Intune Enrolled (Yes/No, verified independently against Intune). Full table toolbar with keyword filter, copy and XLSX export.*
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><strong>Autopilot De-Registration</strong> — Remove devices from Autopilot, backup-first (NEW in V0.816)</summary>
|
||||
|
||||
|
||||
*Removes devices from Windows Autopilot — the Autopilot identity only; Intune enrollment and the Entra device object are never touched. Inputs: UPNs, device names, serial numbers, Entra Device/Object IDs, Intune Device IDs, or Groups. **Workflow:** enter the input list, click De-Register Devices, choose a mandatory backup target (local folder or Azure Blob SAS), then review the categorized validation summary — devices still enrolled in Intune are flagged CAUTION, devices not registered in Autopilot are informational, and Autopilot-registered non-enrolled devices are safe. When enrolled devices are present the dialog offers Proceed Anyway / Skip Intune Enrolled Devices / Cancel. **Safeguards:** a full Get Device Info property backup (plus a Result column) is written BEFORE anything is removed — if the backup fails, nothing is de-registered; non-Windows and Personal-owned devices are skipped automatically; resolution uses precise per-device lookups (no tenant-wide scans).*
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><strong>Bulk Device Removal</strong> — Guarded deletion from Intune or Entra (NEW in V0.816)</summary>
|
||||
|
||||
|
||||
*Deletes devices from Intune OR from Entra — two deliberately separate actions, never both at once. Inputs: Entra Device IDs, Entra Device Object IDs, or Intune Device IDs, with Platform / Ownership / Intune Enrolled filters. **Workflow:** select a mandatory VALIDATION GROUP (searchable picker — the delete buttons stay disabled until one is chosen); only direct members of that group are ever deleted, everything else is skipped and flagged with a reason; review the confirmation summary and proceed. **Safeguards:** a mandatory device-info backup (full Get Device Info properties + Result column) goes to a local folder or Azure Blob BEFORE any deletion — no backup, no delete; Delete from Entra auto-skips devices still enrolled in Intune (no override) and first backs up each device's BitLocker recovery keys to Azure Key Vault (secret Name = Key ID, Content Type = device name; only Key IDs are logged, never key material) — a device whose key backup fails is not deleted. Results: Removed from Intune / Removed from Entra / Failed / Skipped with reason.*
|
||||
</details>
|
||||
|
||||
## Productivity Features
|
||||
|
||||
<details>
|
||||
@@ -230,6 +246,12 @@ MDM-ODA is a PowerShell & WPF based plug-n-play tool for Entra & Intune on-deman
|
||||
|
||||
|
||||
*Installation progress and status reporting*
|
||||
|
||||
|
||||
*Module installs and updates always run in the launch prerequisite workflow with explicit consent — never mid-operation*
|
||||
|
||||
|
||||
*After module changes the tool relaunches in a fresh session so updated modules load cleanly; older module versions are removed automatically on install/update*
|
||||
</details>
|
||||
|
||||
### Additional Productivity Controls
|
||||
@@ -305,7 +327,10 @@ Only needed if you use the corresponding operation:
|
||||
| Permission | Required by |
|
||||
|---|---|
|
||||
| `DeviceManagementConfiguration.ReadWrite.All` | Policy Import (create policies/scripts), Policy Cleanup (delete policies) |
|
||||
| `DeviceManagementServiceConfig.ReadWrite.All` | Policy Import of classic Autopilot Deployment Profiles and Enrollment Status Pages; Bulk Autopilot Registration (hardware hash import) |
|
||||
| `DeviceManagementServiceConfig.ReadWrite.All` | Policy Import of classic Autopilot Deployment Profiles and Enrollment Status Pages; Bulk Autopilot Registration (hardware hash import); Autopilot De-Registration |
|
||||
| `DeviceManagementManagedDevices.ReadWrite.All` | Bulk Device Removal — Delete from Intune |
|
||||
| `Device.ReadWrite.All` | Bulk Device Removal — Delete from Entra |
|
||||
| `BitlockerKey.Read.All` | Bulk Device Removal — BitLocker key backup to Key Vault before Entra deletion (plus Key Vault secret-set RBAC on the vault) |
|
||||
| `DeviceManagementManagedDevices.PrivilegedOperations.All` | Run Remediation (on-demand remediation) and Bulk Sync (device sync remote actions) |
|
||||
|
||||
> **Note:** The documented least-privileged permissions for group write operations are `Group.ReadWrite.All` and `GroupMember.ReadWrite.All`. However, based on testing, group owners with scoped Intune RBAC roles can perform all write operations with only the read-only scopes above. If you want to guarantee write access regardless of ownership, add `Group.ReadWrite.All` and `GroupMember.ReadWrite.All`.
|
||||
@@ -324,6 +349,31 @@ ms-appx-web://Microsoft.AAD.BrokerPlugin/{Client-ID}
|
||||
|
||||
Replace `{Client-ID}` with your actual Application (client) ID from Entra.
|
||||
|
||||
## Changelog — V0.816
|
||||
|
||||
### New Features
|
||||
|
||||
**Autopilot De-Registration**
|
||||
- Remove devices from Windows Autopilot (identity only — Intune and Entra objects untouched) with a mandatory pre-removal device-info backup (local or Blob)
|
||||
- Categorized validation: CAUTION (still Intune-enrolled) / informational (not in Autopilot) / safe — with Proceed Anyway / Skip Intune Enrolled / Cancel
|
||||
- Auto-skips non-Windows and Personal-owned devices; precise per-device lookups (no tenant-wide scans)
|
||||
|
||||
**Bulk Device Removal**
|
||||
- Two deliberately separate guarded actions: Delete from Intune, Delete from Entra
|
||||
- Mandatory validation group — only its direct members are ever deleted; mandatory device-info backup before deletion
|
||||
- Delete from Entra: auto-skips Intune-enrolled devices and backs up BitLocker recovery keys to Azure Key Vault first (Key IDs logged, never key material; no key backup = no deletion)
|
||||
|
||||
**Bulk Autopilot Registration — mapping sheet**
|
||||
- Optional CSV/XLSX mapping (Serial Number + Group Tag columns): mixed hashes for multiple Group Tags can live in one folder/Blob and each serial gets its correct tag automatically — no manual segregation
|
||||
- Validation now flags serials already registered in Autopilot (with current tag) and skips them; results marked Registered / Skipped - Already Registered / Skipped - No Mapping
|
||||
|
||||
### Improvements
|
||||
|
||||
- **Get Device Info:** new "Intune Enrolled only" filter (both Run and Run All); Entra Device IDs input type added; with Platform/Ownership filters, Get All Device Info now enumerates server-side — only matching devices are queried
|
||||
- **Module handling:** all module installs/updates run in the launch prerequisite workflow with consent, and older module versions are removed automatically
|
||||
- **Dual device-ID inputs everywhere:** every device-ID input accepts both the Entra Device ID and the Entra Object ID, with automatic translation for Intune-bound queries
|
||||
- **Serial number matching:** portal-parity contains fallback across all serial inputs (handles leading zeros and vendor prefixes/suffixes)
|
||||
|
||||
## Changelog — V0.81
|
||||
|
||||
### New Features
|
||||
|
||||
+78
-7
@@ -563,7 +563,7 @@
|
||||
<body>
|
||||
<nav>
|
||||
<div class="container">
|
||||
<div class="logo">MDM-ODA</div><span style="color:#5DC98B;font-size:0.75rem;font-weight:500;margin-left:0.5rem;">v0.81</span>
|
||||
<div class="logo">MDM-ODA</div><span style="color:#5DC98B;font-size:0.75rem;font-weight:500;margin-left:0.5rem;">v0.816</span>
|
||||
</div>
|
||||
</nav>
|
||||
|
||||
@@ -571,7 +571,7 @@
|
||||
<div class="container">
|
||||
<div class="hero-badge">Intune & Entra ID Automation</div>
|
||||
<h1>MDM On-Demand Actions <span style="color:#FFD700;font-size:0.85em;">⚡</span></h1>
|
||||
<p>Live Analytics, Insights & Actions</p><p style="font-size:0.9rem;opacity:0.85;margin-top:0.5rem;">Version 0.81</p>
|
||||
<p>Live Analytics, Insights & Actions</p><p style="font-size:0.9rem;opacity:0.85;margin-top:0.5rem;">Version 0.816</p>
|
||||
<div class="hero-meta">
|
||||
Written by <a href="https://www.linkedin.com/in/satish-singhi-791163167/">Satish Singhi</a> — July 2026 |
|
||||
<a href="https://github.com/satishsinghi-gh/mdm-oda">GitHub Repository</a>
|
||||
@@ -594,7 +594,7 @@
|
||||
<li><a href="#safeguards">Safety, Validation & Auth Design</a></li>
|
||||
<li><a href="#getting-started">Getting Started</a></li>
|
||||
<li><a href="#roadmap">Roadmap</a></li>
|
||||
<li><a href="#changelog">Changelog — V0.81</a></li>
|
||||
<li><a href="#changelog">Changelog — V0.816</a></li>
|
||||
</ol>
|
||||
</div>
|
||||
|
||||
@@ -722,7 +722,7 @@
|
||||
|
||||
<h3>Device Info</h3>
|
||||
<p>
|
||||
Comprehensive User & Device info from Entra & Intune based on UPNs, Serial Numbers, Object IDs and even User/Device Groups (recursive object detection). Uses filters for Platform & Ownership. Shows 30+ fields including Entra/Intune device details, OS info, ownership, activity ranges, Autopilot status, and user info.
|
||||
Comprehensive User & Device info from Entra & Intune based on UPNs, Serial Numbers, Object IDs and even User/Device Groups (recursive object detection). Uses filters for Platform & Ownership. Shows 30+ fields including Entra/Intune device details, OS info, ownership, activity ranges, Autopilot status, and user info. Filters now also include <strong>Intune Enrolled only</strong> (honored by both Get Device Info and Get All Device Info), Manufacturer/Model and Compliance; inputs accept both Entra Device IDs and Entra Device Object IDs; and with Platform/Ownership filters set, Get All Device Info enumerates server-side so only matching devices are queried.
|
||||
</p>
|
||||
<figure>
|
||||
<img src="device-info.png" alt="Device Info interface">
|
||||
@@ -815,7 +815,7 @@
|
||||
|
||||
<h3>Bulk Autopilot Registration <span style="display:inline-block;background:#10b981;color:white;font-size:0.65em;padding:2px 8px;border-radius:10px;vertical-align:middle;margin-left:8px;">NEW in V0.81</span></h3>
|
||||
<p>
|
||||
Register devices to Windows Autopilot in bulk from hardware hash CSV files (Get-WindowsAutopilotInfo format: Device Serial Number, Windows Product ID, Hardware Hash, optional Group Tag). Select CSVs from this PC (multi-select) or from an Azure Blob container via a SAS URL. A Group Tag inside a CSV wins; the typed Group Tag fills the blanks. The workflow is staged and safe: select the source, click <strong>Bulk Register</strong>, review the validation summary — blank serials, invalid hashes and duplicate serials are flagged and skipped — then explicitly confirm. Each device posts with real HTTP status reporting, and a single Autopilot sync is triggered after the batch. Import-only: existing Autopilot registrations are never modified.
|
||||
Register devices to Windows Autopilot in bulk from hardware hash CSV files (Get-WindowsAutopilotInfo format: Device Serial Number, Windows Product ID, Hardware Hash, optional Group Tag). Select CSVs from this PC (multi-select) or from an Azure Blob container via a SAS URL. <strong>Optional mapping sheet:</strong> attach a CSV or XLSX with Serial Number + Group Tag columns and mixed hashes destined for multiple Group Tags can live together in one folder or container — every serial receives its correct tag automatically (mapping wins; CSV tag column next; the typed tag fills blanks), eliminating manual segregation and repeated uploads. The validation workflow also checks the tenant and flags serials <strong>already registered in Autopilot</strong> with their current Group Tag — those are skipped rather than re-posted. Staged and safe: select the source, click <strong>Bulk Register</strong>, review the validation summary — blank serials, invalid hashes, duplicates, unmapped and already-registered serials are all flagged — then explicitly confirm. Per-device results (Registered / Failed / Skipped - Already Registered / Skipped - No Mapping), and a single Autopilot sync is triggered after the batch. Import-only: existing Autopilot registrations are never modified.
|
||||
</p>
|
||||
<figure>
|
||||
<img src="bulk-autopilot-registration.png" alt="Bulk Autopilot Registration interface">
|
||||
@@ -830,6 +830,24 @@
|
||||
<img src="get-autopilot-status.png" alt="Get Autopilot Status interface">
|
||||
<figcaption>Autopilot registration and Intune enrollment at a glance</figcaption>
|
||||
</figure>
|
||||
|
||||
<h3>Autopilot De-Registration <span style="display:inline-block;background:#10b981;color:white;font-size:0.65em;padding:2px 8px;border-radius:10px;vertical-align:middle;margin-left:8px;">NEW in V0.816</span></h3>
|
||||
<p>
|
||||
Removes devices from Windows Autopilot — the Autopilot identity only; Intune enrollment and the Entra device object are never touched. Input UPNs, device names, serial numbers, Entra Device/Object IDs, Intune Device IDs, or Groups. The workflow is backup-first: choose a mandatory backup target (local folder or Azure Blob SAS), then review a categorized summary — devices still enrolled in Intune are flagged <strong>CAUTION</strong>, devices not registered in Autopilot are informational, and registered non-enrolled devices are safe. When enrolled devices are present the confirmation offers <strong>Proceed Anyway / Skip Intune Enrolled Devices / Cancel</strong>. A full Get Device Info property backup (plus a Result column) is written BEFORE anything is removed — if the backup fails, nothing is de-registered. Non-Windows and Personal-owned devices are skipped automatically, and resolution uses precise per-device lookups rather than tenant-wide scans.
|
||||
</p>
|
||||
<figure>
|
||||
<img src="autopilot-deregistration.png" alt="Autopilot De-Registration interface">
|
||||
<figcaption>Backup-first Autopilot removal with categorized review and enrollment safeguards</figcaption>
|
||||
</figure>
|
||||
|
||||
<h3>Bulk Device Removal <span style="display:inline-block;background:#10b981;color:white;font-size:0.65em;padding:2px 8px;border-radius:10px;vertical-align:middle;margin-left:8px;">NEW in V0.816</span></h3>
|
||||
<p>
|
||||
Deletes devices from Intune OR from Entra — two deliberately separate actions, never both at once. Inputs are ID-based only (Entra Device IDs, Entra Device Object IDs, Intune Device IDs) with Platform, Ownership and Intune Enrolled filters. A mandatory <strong>validation group</strong> gates everything: the delete buttons stay disabled until a group is selected, and only its <em>direct members</em> are ever deleted — every other input is skipped and flagged with a reason. Both actions require a device-info backup (full Get Device Info properties + Result column) to a local folder or Azure Blob BEFORE deletion: no backup, no delete. <strong>Delete from Entra</strong> adds two more safeguards: devices still enrolled in Intune are auto-skipped with no override, and each device's BitLocker recovery keys are backed up to Azure Key Vault first (secret Name = Key ID, Content Type = device name; only Key IDs are ever logged) — a device whose key backup fails is not deleted.
|
||||
</p>
|
||||
<figure>
|
||||
<img src="bulk-device-removal.png" alt="Bulk Device Removal interface">
|
||||
<figcaption>Validation-group-gated deletion with mandatory backups and BitLocker key escrow to Key Vault</figcaption>
|
||||
</figure>
|
||||
</section>
|
||||
|
||||
<section id="productivity">
|
||||
@@ -929,6 +947,15 @@
|
||||
<img src="prereq-handling-2.png" alt="Prerequisite Check and Installation - Part 2">
|
||||
<figcaption>Installation progress and status reporting</figcaption>
|
||||
</figure>
|
||||
<p style="margin-top:0.75rem;">Module handling follows a strict policy: every module install or update happens in the launch prerequisite workflow with explicit consent — never in the middle of an operation — and older versions of a module are removed automatically after an install or update. After module changes the tool relaunches in a fresh session so the updated modules load cleanly.</p>
|
||||
<figure>
|
||||
<img src="prereq-modules-consent.png" alt="Module installation consent">
|
||||
<figcaption>Explicit consent before any module install or update</figcaption>
|
||||
</figure>
|
||||
<figure>
|
||||
<img src="prereq-relaunch.png" alt="Relaunch notification">
|
||||
<figcaption>Fresh-session relaunch after module changes; older versions removed automatically</figcaption>
|
||||
</figure>
|
||||
</section>
|
||||
|
||||
<section id="permissions">
|
||||
@@ -1013,7 +1040,19 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code>DeviceManagementServiceConfig.ReadWrite.All</code></td>
|
||||
<td>Policy Import of classic Autopilot Deployment Profiles and Enrollment Status Pages; Bulk Autopilot Registration (hardware hash import)</td>
|
||||
<td>Policy Import of classic Autopilot Deployment Profiles and Enrollment Status Pages; Bulk Autopilot Registration (hardware hash import); Autopilot De-Registration</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code>DeviceManagementManagedDevices.ReadWrite.All</code></td>
|
||||
<td>Bulk Device Removal — Delete from Intune</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code>Device.ReadWrite.All</code></td>
|
||||
<td>Bulk Device Removal — Delete from Entra</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code>BitlockerKey.Read.All</code></td>
|
||||
<td>Bulk Device Removal — BitLocker key backup to Key Vault before Entra deletion (plus Key Vault secret-set RBAC)</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code>DeviceManagementManagedDevices.PrivilegedOperations.All</code></td>
|
||||
@@ -1118,7 +1157,39 @@
|
||||
</section>
|
||||
|
||||
<section id="changelog">
|
||||
<h2>Changelog — V0.81</h2>
|
||||
<h2>Changelog — V0.816</h2>
|
||||
|
||||
<h3>New Features</h3>
|
||||
|
||||
<h4>Autopilot De-Registration</h4>
|
||||
<ul>
|
||||
<li>Remove devices from Windows Autopilot (identity only — Intune and Entra objects untouched) with a mandatory pre-removal device-info backup (local or Blob)</li>
|
||||
<li>Categorized validation: CAUTION (still Intune-enrolled) / informational (not in Autopilot) / safe — with Proceed Anyway / Skip Intune Enrolled / Cancel</li>
|
||||
<li>Auto-skips non-Windows and Personal-owned devices; precise per-device lookups (no tenant-wide scans)</li>
|
||||
</ul>
|
||||
|
||||
<h4>Bulk Device Removal</h4>
|
||||
<ul>
|
||||
<li>Two deliberately separate guarded actions: Delete from Intune, Delete from Entra</li>
|
||||
<li>Mandatory validation group — only its direct members are ever deleted; mandatory device-info backup before deletion</li>
|
||||
<li>Delete from Entra: auto-skips Intune-enrolled devices and backs up BitLocker recovery keys to Azure Key Vault first (Key IDs logged, never key material; no key backup = no deletion)</li>
|
||||
</ul>
|
||||
|
||||
<h4>Bulk Autopilot Registration — mapping sheet</h4>
|
||||
<ul>
|
||||
<li>Optional CSV/XLSX mapping (Serial Number + Group Tag columns): mixed hashes for multiple Group Tags in one folder/Blob, each serial tagged correctly — no manual segregation</li>
|
||||
<li>Validation flags serials already registered in Autopilot (with current tag) and skips them; results marked Registered / Skipped - Already Registered / Skipped - No Mapping</li>
|
||||
</ul>
|
||||
|
||||
<h3>Improvements</h3>
|
||||
<ul>
|
||||
<li>Get Device Info: "Intune Enrolled only" filter (Run + Run All); Entra Device IDs input type; server-side enumeration when Platform/Ownership filters are set</li>
|
||||
<li>Module handling: installs/updates only in the launch prerequisite workflow with consent; older module versions removed automatically</li>
|
||||
<li>Dual device-ID inputs everywhere — Entra Device ID or Object ID accepted, with automatic translation for Intune-bound queries</li>
|
||||
<li>Serial matching: portal-parity contains fallback across all serial inputs (leading zeros, vendor prefixes/suffixes)</li>
|
||||
</ul>
|
||||
|
||||
<h3>Previous Release — V0.81</h3>
|
||||
|
||||
<h3>New Features</h3>
|
||||
|
||||
|
||||
Reference in New Issue
Block a user