AzClean Baselines: Intune configuration as code with drift reports

Export Intune policy to JSON, commit it, and get told exactly which property drifted, however deeply nested.

What this solves

The Intune portal will show you a policy's current state. It will not reliably show you what that state was last month, which of two hundred settings someone changed, or when.

Settings catalog policies make that worse rather than better. A change three levels into a nested object is invisible unless you already know where to look, and "compliance is at 94%" tells you nothing about which setting moved. Meanwhile the policy called Win10 baseline TEST has been assigned to All Devices since 2023 and nobody is quite sure what is in it.

Committing the JSON turns all of that into a diff.

How it works

Three commands, and the middle one is git commit.

# Export every configuration and compliance policy to JSON
Export-AzCleanBaseline -Path ./baselines -IncludeAssignments

# Compare live state against what is committed
Compare-AzCleanBaseline -Path ./baselines -Format Markdown

The comparison walks nested objects rather than comparing whole blobs, so the output names the property rather than telling you the policy differs:

POLICY  Mondra | Win10 Baseline  (deviceConfiguration)
  ~ firewallRules[2].localPortRanges   "3389"  ->  "3389,5985"
  ~ passwordMinimumLength              12      ->  8
  + smartScreenBlockOverrideForFiles   (added) true

POLICY  MacOS | Platform SSO  (settingsCatalog)
  ~ authenticationMethod               "Password"  ->  "SmartCard"

2 policies drifted, 4 properties changed

Assignments are exported too, because a policy that is correct and assigned to nobody is a different problem from one that is wrong.

Configuration evidence as a side effect

If anyone is asking you for configuration management evidence, this produces it without extra work. A timestamped diff showing what changed, when, and that somebody looked, is materially better than a screenshot of a portal blade taken the week before an audit.

That applies whether or not you are chasing a certificate. Microsoft's Intune policy documentation covers the policy types this exports.

AzClean Detections does the equivalent job for cloud configuration in Sentinel. Baselines catches an Intune policy property changing; Detections catches a Conditional Access policy or a storage account changing. The two together cover endpoint and cloud drift, and neither requires the other.

Questions

Does it change anything in Intune?

No. It exports and compares. Applying a baseline back to Intune is deliberately not part of it, because a tool that can overwrite device policy across a fleet is a different risk category from one that reads.

What permissions does it need?

DeviceManagementConfiguration.Read.All for export, and directory read for assignment names. Certificate authentication on an app registration is supported and preferable to a client secret.

Will it work with settings catalog policies?

That is the case it exists for. Legacy device configuration profiles are easy to diff; settings catalog policies with deeply nested objects are the ones where manual comparison stops being feasible.

Can I run it on a schedule?

Yes, and that is the intended use. Export, commit, compare, and report only when something moved. It exits non-zero when it cannot reach Graph, so a scheduled run that fails does not look like a run that found nothing.

Does it handle multiple tenants?

Each run targets one tenant. Consultants managing several typically keep one repository per client, which also keeps the evidence separated.