PowerShell

Create Microsoft Intune Remote Help RBAC Roles and Groups automatically with PowerShell

by

Introduction

Microsoft Intune Remote Help uses role-based access control (RBAC). Intune includes built-in roles like Help Desk Operator and School Administrator that provide Remote Help access.

The Help Desk Operator and School Administrator roles include full Remote Help permissions along with additional rights, such as wiping or retiring devices and assigning apps or policies. If an account with these roles is compromised, the attacker gains access beyond remote assistance capabilities.

Microsoft recommends custom RBAC roles to implement least-privilege access. Creating them manually in the Intune admin center requires defining permissions, creating the role, setting up security groups, and assigning scope – typically around 30 minutes for all four roles given no mistakes are made.

This PowerShell script creates four custom roles and corresponding security groups in under 10 seconds:

  • Level 1 Support – View-only access
  • Level 2 Support – Full control (without elevation)
  • Senior Techs – Elevation permission (for UAC/admin actions)
  • Device Teams – Unattended access (for Android dedicated devices)

Each role contains only the Remote Help permissions required for its tier and no additional device management permissions.

Read more…

Intune Assignment Struggles: Got Devices, Need Users? Got Users, Need Devices? PowerShell to the Rescue

by

Introduction

If you work with device management – whether Intune or ConfigMgr – you’ve hit this scenario:

  • You have a group of users, but you need to target their devices. Not just any devices they log into, but those specific devices.
  • Or you have a device group, but you need to reach the users – send them notifications or deploy user-context apps or configurations.

The problem is simple: You’re given one object type, but you need the other. A user group when you need devices. A device group when you need users. Manual cross-referencing through the portal is tedious and doesn’t scale.

Coming from ConfigMgr with on-prem AD? You’re used to very flexible collection queries that could say ‘all devices of users in the Finance group located in the London OU’.

This script handles some of the translation for Intune. Point it at your source groups (containing either users or devices), and it populates your target group with whichever object type you actually need. Add OS version filtering if you want to narrow it down – like notifying users whose devices are below a certain iOS version or assigning policies to Windows devices owned by specific teams.

The best part? The script detects Azure Automation and uses managed identity authentication, so you can schedule it as a runbook to keep your groups updated automatically. 🙂

Read more…

Deploying and configuring uBlock Origin Lite with PowerShell and Microsoft Intune

by

Introduction

Ad blocking is often dismissed as a convenience feature for users tired of intrusive banners and pop-ups. But in 2025 – almost 2026 – it’s time to reframe the conversation: ad blocking is a fundamental security control every organization should implement.

Malvertising has become an extremely effective attack vector. Threat actors exploit legitimate ad networks to deliver malware, phishing sites, and exploit kits – even on trusted websites. Tracking scripts in ads also collect sensitive data, creating privacy and compliance risks.

The good news? Ad blocking is free, proven security you can deploy today. Installing uBlock Origin Lite is easy. Configuring it at scale for an enterprise? That’s the challenging part. In this post, I’ll show you how I solved that challenge with a comprehensive PowerShell script that centrally configures uBlock Origin Lite across managed browsers using Microsoft Intune.

Read more…

Notifying users on Windows when an iOS update is required – Microsoft Intune, Automation Account and Toast Notification Script combined

by

Introduction

Your users carry iPhones but spend most of their workday on Windows devices. When Apple releases an iOS update, Intune can flag non-compliance – but the built-in notifications on iOS are often overlooked and don’t have the same visibility or urgency as alerts on a user’s primary work device.

The solution: cross-platform automation. By combining two PowerShell solutions – one that monitors iOS versions in Microsoft Intune and maintains dynamic user groups, and another that delivers branded Windows toast notifications – you can automatically alert Windows users when their iOS devices need updating.

Read more…

BIG ANNOUNCEMENT: Toast Notification Script v3 is here!

by

Introduction

I’ve completely REWRITTEN my popular Toast Notification Script from the ground up – now exclusively for Microsoft Intune!

What’s new:

  • Built specifically for Intune Remediations
  • Enhanced logging & smart detection logic
  • Personalized user greetings
  • Multiple notification scenarios

Perfect for:

  • Weekly reminders/messages
  • Pending reboot notifications
  • Company Portal integration
  • Custom organizational messages

Ready to deploy? Get it now: https://github.com/imabdk/Toast-Notification-Script

Temp. documentation down below. 🙂

Read more…

Building a Break-Glass Local Admin Solution for Windows 11 using Intune and Defender for Endpoint

by

Introduction

I’ve been in situations where I needed local admin access to a device, and I needed it *now*. Users couldn’t log in, LAPS wouldn’t retrieve passwords, or domain connectivity and trust had failed. You’re staring at a locked device with no way in, and waiting isn’t an option.

Modern endpoint management is fantastic until it isn’t. We’ve eliminated persistent local admin accounts, embraced cloud authentication, and deployed LAPS – all best practices. But what happens when all of those fail simultaneously?

This post documents the break-glass solution I built for those “need it now” scenarios: a remotely deployable emergency local administrator account using Intune Remediations, with monitoring through Microsoft Defender for Endpoint.

💡 By default, remediations run on a schedule. However, you can run remediations on-demand in Intune, which triggers the scripts to execute instantly (almost) on targeted devices via Windows Notification Service (WNS). This is critical for true emergencies when you can’t wait.

Read more…

Automating ‘Have I Been Pwned’ Breach Checks for Entra ID Groups using PowerShell

by

Introduction

In today’s digital landscape, data breaches are unfortunately common. As security-conscious professionals, we need to be proactive about monitoring whether our users’ credentials have been compromised. That’s why I built an automated PowerShell tool that checks Entra ID (Azure AD) group members against the Have I Been Pwned database.

The tool generates professional HTML and PDF reports that are perfect for security audits, compliance documentation, and executive briefings – making it easy to communicate breach findings to both technical and non-technical audiences.

Also, it was Friday evening, and I needed a fun project to wrap up the week – turns out automating security checks is a pretty good way to spend it! 😀

Read more…

Auditing Password Reuse in On-Premises Active Directory with PowerShell and DSInternals

by

Introduction

Password reuse among privileged accounts represents one of the most critical security vulnerabilities in on-premises Active Directory environments.

When multiple privileged accounts share the same password, a single compromise can cascade across your entire infrastructure.

In this post, I’ll demonstrate how to audit your Active Directory environment for shared passwords using PowerShell and the DSInternals module.

Read more…

How to manage the new Microsoft 365 companion apps rolling out to Windows 11

by

Introduction

Microsoft is introducing new Microsoft 365 companion apps to Windows 11 devices as part of a broader integration effort. These apps may be installed automatically unless you opt out, but you can also choose to install them early for testing.

In this post, I’ll walk through how to manage the rollout: opting out of auto-installation, installing manually, uninstalling if needed, disabling automatic startup, and pinning the apps to your taskbar for quick access.

Read more…

Automating Sysmon installation and configuration with PowerShell

by

Introduction

In today’s fast-paced digital world, quick response to security incidents is crucial. Sysmon (System Monitor) from Microsoft’s Sysinternals suite is an essential tool for detailed system monitoring and security analysis. However, traditional installation can be time-consuming, especially in urgent situations.

This blog post introduces a PowerShell script that automates the download, extraction, and installation of Sysmon, along with applying a pre-configured setup. This rapid deployment ensures your systems are monitored and protected within minutes, enhancing your incident response capabilities and maintaining a strong security posture.

Read more…