# MDM On-Demand Actions (MDM-ODA) ⚡
**Live Analytics, Insights & Actions for Entra ID and Intune**
[](https://github.com/satishsinghi-gh/mdm-oda/releases)
[](https://learn.microsoft.com/en-us/powershell/)
[](https://learn.microsoft.com/en-us/dotnet/desktop/wpf/)
[](https://learn.microsoft.com/en-us/graph/)
[](https://satishsinghi-gh.github.io/MDM-ODA/)
---
## Overview
MDM-ODA is a PowerShell & WPF based plug-n-play tool for Entra & Intune on-demand operations. Built with attention to detail for the granular challenges faced by support teams, enabling project teams to get reliable, meaningful, up-to-date insights and reports on the go. Built with safeguards to prevent accidental actions, keeping Zero Trust and least privilege as top priority.
> For a full deep-dive into the tool's design, architecture, and security model, visit the [MDM-ODA Blog](https://satishsinghi-gh.github.io/MDM-ODA/).
### Project Mission
- Maximize operational efficiency
- Automate variety of on-demand actions that need to be performed on the go
- Deliver a thoughtful, well-crafted experience that IT professionals genuinely enjoy using
- Bring together data from different portals/pages using a single page — no browser tab madness
- Surface actionable insights directly — no Excel exports, no manual pivot tables, just immediate clarity for faster triage
- Automate bulk actions on-demand that are natively not possible
- Reduce human errors using validation workflows
- Save hours of efforts and endless fatigue caused by repetitive tasks
- No manual setup needed, no admin rights needed — just plug and play
- Make Click-Ops great again
## Highlights
| | |
|---|---|
| **Lightweight & Powerful** | Enterprise-grade functionality built entirely on native Windows components — PowerShell 7 and WPF. Zero third-party dependencies, zero licensing. All data is live from Microsoft Graph — no Power BI refresh cycles, no stale dashboards. |
| **Security & Guardrails** | Delegated auth flow for least privilege — use your Tenant & Client ID. Validation & preview before each write action. Live verbose logging for transparency. No admin rights required. |
| **Productivity** | Complex on-demand actions with minimum effort. In-page live table output with flexibility to select cells, copy individual cell/row/all, or export to XLSX. |
## Features — Group Management
Search Entra Objects — Keyword search across multiple Entra object types from a single page
*Search across Users, Groups, Devices, and Service Principals with real-time filtering*
List Group Members — List members from multiple groups with a single click
*Query members from multiple groups simultaneously with comprehensive details*
Object Membership — Find group membership for bulk items (Users/Devices/Groups)
*Bulk lookup of group membership across users, devices, and groups*
Find Groups by Owners — Enter UPNs, get all groups they own
*Identify all groups owned by specific users with detailed ownership insights*
Create Group — Create Security/M365 Group with bulk owners, members, or dynamic query from a single page
*Streamlined group creation with owners, members, and dynamic rules — no CSV, no browser navigation*
Set Bulk Owners on Bulk Groups — Assign multiple owners to multiple groups in one operation
*Bulk owner assignment across multiple groups with validation*
Add User Devices to Groups — Enter UPNs, auto-resolve their registered devices and add to groups
*Device-to-group assignment driven by user identity*
Find Common/Distinct Groups — Compare group memberships across multiple objects
*Identify overlapping and unique group memberships for users, devices, or groups*
Compare Groups — Side-by-side comparison of group properties and memberships
*Detailed group comparison with property and membership diff*
### Additional Group Management
- **Rename Bulk Groups** — Rename multiple groups at once
- **Update Dynamic Membership Rules** — Modify dynamic queries on existing groups
- **Delete Empty Groups** — Safely remove groups with zero members (with confirmation)
## Features — Device Management
Device Info — Comprehensive device details from Entra and Intune in one view
*Hardware, OS, compliance, encryption, and registration details from a single query*
Intune Policy Assignments — View all policies assigned to a device through its group memberships
*Policy assignment overview with group context*
*Detailed policy breakdown with assignment intent and filter evaluation*
*Full policy assignment landscape across configuration profiles, compliance, and apps*
## Productivity Features
Session Notes — Built-in notepad for each session with timestamp and context
*Take notes during operations without leaving the tool*
Verbose Logging & Keyword Filter — Real-time operation logging with search
*Filter logs by keyword for quick troubleshooting*
*Detailed operation logs with timestamps*
Prerequisite Handling — Automatic detection and installation of dependencies
*Automatic detection of system prerequisites*
*Installation progress and status reporting*
### Additional Productivity Controls
- **Clear Inputs** — Clear the page and start fresh with a single click
- **Stop Operation** — Cancel ongoing operations at any time without waiting for completion
- **Feedback** — Built-in feedback mechanism to report issues or suggest improvements
## Security & Auth Design
MDM-ODA uses the OAuth 2.0 delegated flow exclusively — the app never holds standalone permissions. Every API call executes in the context of the signed-in user, meaning the effective permission is always the intersection of what the app registration allows and what the user's Entra/Intune roles permit. The recommended configuration uses **read-only API scopes** for everyday operations. Write permissions are only needed when performing create, update, or delete operations.
Every write action follows a strict validation-before-commit workflow: the tool validates input format, checks for duplicates, resolves object identifiers, and presents a structured preview of pending changes. Only after the user explicitly confirms does the operation execute.
> For the full architecture diagram and detailed auth flow, see the [blog](https://satishsinghi-gh.github.io/MDM-ODA/).
## Prerequisites
1. **Windows 11** with WPF (built-in, no additional installation needed)
2. **PowerShell 7** — handled automatically by the script (auto-installs via winget if missing). The orchestrator can be launched from a standard PowerShell 5.1 host — it detects the running version, locates or installs PS7, and re-launches itself in the PS7 runtime automatically
3. **Internet Connectivity** — required for PowerShell Gallery modules and Microsoft Graph API
4. **No Admin Rights Required** — MDM-ODA runs in user context
5. **Code Signing & WDAC** — if WDAC or script execution policies are enforced, code signing adjustments may be needed
## Getting Started
```powershell
# 1. Clone the repository
git clone https://github.com/satishsinghi-gh/mdm-oda.git
# 2. Configure credentials (optional) — pre-populate your Tenant ID and Client ID
# in the script, or enter them manually at launch
# 3. Launch the downloaded script — no parameters, no admin rights needed
.\MDM-ODA.ps1
# 4. Authenticate with your Entra credentials and start using the tool
```
### What's Included
- Fully functional PowerShell 7 script with embedded WPF UI
- Automatic prerequisite detection and installation
- Microsoft Graph SDK integration for reliable API calls
- Real-time verbose logging to local file system
- Validation workflows for write operations
- Export to Excel (XLSX) capability
- Complete source code and documentation
## Permissions
### Delegated App Permissions
| Permission | Purpose |
|---|---|
| `User.Read` | Sign-in and read current user profile (/me for PIM checks) |
| `User.Read.All` | Resolve UPN inputs and read user properties across all functions |
| `Group.Read.All` | Read group properties, list groups, read types and membership rules |
| `GroupMember.Read.All` | List group members and query member counts |
| `Directory.Read.All` | TransitiveMemberOf for PIM role detection and object membership |
| `Device.Read.All` | Resolve devices, read properties, query registered users |
| `DeviceManagementConfiguration.Read.All` | Read Intune config profiles and policies for assignment lookups |
| `DeviceManagementManagedDevices.Read.All` | Query managed devices by Azure AD device ID or serial number |
| `DeviceManagementRBAC.Read.All` | Read Intune RBAC settings (role assignments and role definitions) |
| `offline_access` | Maintain refresh token for persistent session |
> **Note:** The documented least-privileged permissions for group write operations are `Group.ReadWrite.All` and `GroupMember.ReadWrite.All`. However, based on testing, group owners with scoped Intune RBAC roles can perform all write operations with only the read-only scopes above. If you want to guarantee write access regardless of ownership, add `Group.ReadWrite.All` and `GroupMember.ReadWrite.All`.
### User Permissions
Entra built-in roles or custom RBAC roles determine which specific resources a user can access. The app permissions set the API surface ceiling, but Intune RBAC and group ownership scope the actual access. **Group Owners** is sufficient for most group management operations. For comprehensive device and policy insights, users may benefit from **Intune Reader** or **Intune Administrator** roles depending on scope.
### Web Application Redirect URI
For WAM (Web Account Manager) based authentication, configure the following redirect URI in your Entra app registration:
```
ms-appx-web://Microsoft.AAD.BrokerPlugin/{Client-ID}
```
Replace `{Client-ID}` with your actual Application (client) ID from Entra.
## Roadmap
MDM-ODA is actively evolving. Here's what's planned for upcoming releases:
- **Input-Based Bulk Actions** — Sync, Remediation (excluding destructive actions like Wipe/Delete)
- **Comprehensive Update Insights** — Quality Updates, Feature Updates, Driver Updates
- **Application Landscape** — Platforms, Assignments, Deployment States, Filters, App Creation Workflows
- **Defender Integration** — Timeline Events, Advanced Hunting, Vulnerability State, Software Inventory
- **Advanced Policy Management Actions** — Targeted modifications, cloning, bulk assignment management
- **Advanced Dynamic Group Query Builder** — Visual query builder with syntax validation and preview
- **Log Analytics Integration** — Extended Hardware Inventory and Audit data from Log Analytics
## Author
**Satish Singhi**
> [!WARNING]
> **Disclaimer:** This tool is provided "as-is" without warranty of any kind, express or implied. The author assumes no liability for any damages arising from its use. Always validate operations in a non-production environment before deploying to production tenants.
## License
This project is licensed under the [MIT License](LICENSE).