Intune Preflight runs entirely in your browser. To read your tenant it needs one read-only app registration in your own Entra directory — you create it, you own it, and you can remove it at any time. Nothing is installed and no client secret is ever created.
You need an account in your tenant that can consent to Graph permissions on behalf of the organisation — Global Administrator, Privileged Role Administrator or Cloud Application Administrator.
An Intune Administrator alone cannot grant this consent. That is Entra's rule, not ours — every permission below is admin-consent-only, even though all of them are read-only.
You only do this once per tenant. Everyone else on your team just needs the client ID it produces.
Open Azure Cloud Shell and pick PowerShell. It is already signed in as you and already has what it needs, so there is nothing to install. Paste this whole block and press enter.
Connect-MgGraph -Scopes "Application.ReadWrite.All"
$displayName = "Intune Preflight"
$redirectUri = "https://kevinmalinoski.github.io/intune-preflight/app/"
$wanted = @(
"DeviceManagementConfiguration.Read.All",
"Group.Read.All",
"DeviceManagementServiceConfig.Read.All",
"DeviceManagementScripts.Read.All",
"DeviceManagementApps.Read.All"
)
$graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
$ids = $graphSp.Oauth2PermissionScopes | Where-Object { $wanted -contains $_.Value }
$app = New-MgApplication -DisplayName $displayName `
-SignInAudience "AzureADMyOrg" `
-Spa @{ RedirectUris = @($redirectUri) } `
-RequiredResourceAccess @(@{
ResourceAppId = $graphSp.AppId
ResourceAccess = @($ids | ForEach-Object { @{ Id = $_.Id; Type = "Scope" } })
})
New-MgServicePrincipal -AppId $app.AppId | Out-Null
Start-Sleep -Seconds 5
$tenant = (Get-MgContext).TenantId
$encoded = [System.Uri]::EscapeDataString($redirectUri)
Write-Host ""
Write-Host "TENANT_ID = $tenant"
Write-Host "CLIENT_ID = $($app.AppId)"
Write-Host ""
Write-Host "Consent URL:" -ForegroundColor Cyan
Write-Host "https://login.microsoftonline.com/$tenant/adminconsent?client_id=$($app.AppId)&redirect_uri=$encoded"
It prints two IDs and a consent link. Keep that output open — you need it in step 3.
https://kevinmalinoski.github.io/intune-preflight/app/Open the consent link the script printed. You will see exactly what you are approving — five read-only permissions, nothing else. Read them, then accept.
| Permission | What it reads |
|---|---|
| DeviceManagementConfiguration.Read.All | Configuration profiles, Compliance policies, Settings Catalog, Administrative Templates, Assignment Filters |
| Group.Read.All | Group names, and the dynamic membership rules behind them |
| DeviceManagementServiceConfig.Read.All | Windows Autopilot deployment profiles |
| DeviceManagementScripts.Read.All | Platform Scripts — Windows PowerShell and macOS shell |
| DeviceManagementApps.Read.All | Apps and their assignments — what is Required, Available or set to Uninstall |
Open the app. On first run it asks for the Directory (tenant) ID and Application (client) ID the script printed. Paste them in and sign in with your admin account.
You sign in as yourself, so the tool reads exactly what you could already read — no more. If your Intune role is limited by scope tags, the preflight is limited the same way. For most admins that is the whole tenant; for a scoped admin it is their part of it.
There is no server behind this page. Your tenant's data goes from Microsoft Graph straight into your browser tab and is gone when you close it. It is never sent anywhere else, and there is no telemetry.
Your app registration predates the Apps view and is missing its permission. In the Entra portal, open the registration, go to API permissions, add DeviceManagementApps.Read.All as a Delegated Microsoft Graph permission, and click Grant admin consent. Then end the session here and sign in again.
The address registered in step 1 has to match this site exactly, character for character — including the trailing slash. Check your app registration's Authentication page reads https://kevinmalinoski.github.io/intune-preflight/app/ and that it is listed under Single-page application.
The redirect URI was registered under Web instead of Single-page application. It is the single most common slip. Delete it and re-add it under the SPA platform — the script does this correctly, so this usually means it was added by hand in the portal.
Step 2 did not complete. Re-open the consent link the script printed, and make sure you are signed in as an account that can consent for the organisation. In the portal, all five permissions should show Granted with a green check.
Some tenants require a compliant or managed device before Graph will issue a token. If that is your policy, this page cannot work around it — and shouldn't. Use the self-hosted build instead, which authenticates as an application rather than as you.
Most likely your Intune role is scoped by scope tags, so you are seeing your slice rather than the whole tenant. That is working as intended — the token is bounded by your own permissions. The self-hosted build uses application credentials and is unscoped.
Delete the app registration in Entra, or remove the enterprise application under Enterprise applications. That revokes the consent with it. Nothing else was ever created in your tenant, and nothing was written at any point.
Three minutes to connect, or no setup at all if you just want to look around first.