by ACloud.Solutions
AzClean Baselines: Intune Config & Drift
Intune configuration as code. Export what your tenant actually has, commit it, and get told exactly which property drifted.
PowerShell 5.1 or 7+ · Graph read scope to export · nothing in this pack writes to Intune
AzClean Baselines // Drift report by ACloud.Solutions ------------------------------------ [*] Baseline: 4 policy/policies Current: 4 [!] 7 difference(s) across 4 policy/policies: Baseline | iOS/iPadOS Compliance Missing from tenant Baseline | macOS Compliance scheduledActionsForRule[0] .scheduledActionConfigurations[1] .gracePeriodHours: 72 -> 0 Baseline | Windows 10/11 Compliance bitLockerEnabled: True -> False passwordMinimumLength: 8 -> 4 secureBootEnabled: True -> - Rogue | Someone Made This Not in baseline
Templates are the easy half
Most Intune packs sell you policy templates. The harder problem is what happens next: policies get edited in the portal by whoever had a ticket open, and nothing tells you. This reports on that.
Names the exact property
Down through nested structures, so you get scheduledActionsForRule[0].scheduledActionConfigurations[1].gracePeriodHours, not "something changed".
Exports that actually diff
Ids, timestamps and version counters are stripped, so two exports of an unchanged tenant are byte-identical. Without that, everything looks like drift.
A gate for CI
-FailOnDrift exits non-zero against a committed baseline. The comparison is entirely offline on the JSON, so it needs no Graph connection to run.
What it covers
Compliance policies, device configuration profiles and settings catalog policies, plus the traps that cost real time to find.
Five kinds of drift
Value changed, property added, property removed, policy missing from the tenant, and policy present but not in your baseline.
Settings catalog handled properly
That endpoint pages at 25 while ignoring $top and $filter, and keeps its settings on a child endpoint the parent call omits. Both are handled.
Four starter baselines
Windows 10/11, macOS, iOS/iPadOS and Android work profile, each carrying the scheduledActionsForRule block a create call is rejected without.
TRAPS.md
The behaviours you only learn by hitting them. Read it before you edit a macOS compliance policy.
Read-only
Neither script writes to Intune. The drift report tells you what changed; what you do about it is yours.
Commit it
JSON on disk means your device configuration lives in source control and reviews like code.
Pick your licence
Same files in every tier. What changes is what you are allowed to do with them. Lifetime updates on all three, with no subscription and no renewal.
Single Organisation
For your own estate
$59
one-time · lifetime updates
- Everything in the pack
- Your own tenants and subsidiaries
- Modify it freely, commercial use included
- Lifetime updates
Consultant
For client engagements
$149
one-time · lifetime updates
- Everything in Single Organisation
- Baseline and report on client Intune tenants
- Hand clients the drift reports
Redistribution
For building on
$599
one-time · lifetime updates
- Everything in Consultant
- Embed it in what you sell
- Ship to any number of your customers
A licence to build on, not to resell as-is.
Get RedistributionNot sure which tier? Ask us.
Questions
Four worth reading before you buy.
What is the macOS trap?
If a macOS compliance policy has passwordRequired set to true, changing any field on it can force every assigned Mac to prompt its user for a new password. Not just password fields; renaming the policy is enough. No warning, no undo. TRAPS.md explains how to work around it.
Are the baselines a standard?
No, and the licence says so explicitly. They are starting points, not certified against any scheme and not tuned to your estate. Review minimum OS versions and grace periods before assigning anything, because a compliance policy that blocks devices is a production change.
What happens if I rename a policy?
It reads as a removal plus an addition. Policies are matched on display name because ids are stripped to make exports diffable, and without ids a rename is indistinguishable from a swap. Re-baseline after an intentional rename.
What permissions do I need?
DeviceManagementConfiguration.Read.All on Graph to export. The comparison needs nothing but the JSON files, so it runs in CI with no Azure credentials at all.
Find out what changed while you were not looking
Export, commit, compare. Read-only throughout.