Intune configuration as code: export what your tenant actually has, commit it, and get told when it drifts. The drift report is the product. Most Intune packs sell you policy templates. The harder problem is that once policies are in place they get edited in the portal by whoever has a ticket open, and nothing tells you. This names the exact property that changed, down through nested structures: Baseline | Windows 10/11 Compliance bitLockerEnabled: True -> False passwordMinimumLength: 8 -> 4 secureBootEnabled: True -> - Rogue | Someone Made This Not in baseline It detects values changed, properties added or removed, policies missing from the tenant, and policies present but not in your baseline. -FailOnDrift exits non-zero so it works as a CI gate, and the comparison runs entirely offline on the JSON with no Graph connection needed. Exports that actually diff. Ids, timestamps and version counters are stripped, so two exports of an unchanged tenant are byte-identical. Without that everything looks like drift and the report is worthless. Covers compliance policies, device configuration profiles and settings catalog policies, including the settings catalog settings that the parent Graph call omits. Starter compliance baselines for Windows 10/11, macOS, iOS/iPadOS and Android work profile, each carrying the scheduledActionsForRule block a create call is rejected without. Starting points, not a standard - review minimum OS versions and grace periods before assigning. TRAPS.md documents the Intune and Graph behaviours that cost real time to find. The first one to read: changing any field on a macOS compliance policy that enforces a password can force a password change on every assigned Mac. Not just password fields. No warning, no undo. Read-only throughout - nothing in this pack writes to Intune. PowerShell 5.1 or 7+. Lifetime updates.