A Windows-native control plane for Microsoft Intune / Entra device management — a Rust + WinUI 3 client over a hard-forked .NET Graph engine, with a persistent, searchable audit / drift time-machine and a human-gated automation layer on top. MIT licensed.
intunecommander.com · Download the beta
IntuneCommander started as a .NET 10 + React desktop app plus an ic.exe CLI (the v0.x
releases). v1.0 replaces that shell with a native Rust / WinUI 3 client and a .NET
sidecar — same brand, same Graph engine — plus a time-machine, a diagnostics suite, and automation
layers the old app never had.
Where the code lives: v1 is being finalized on the
v1branch and will become the default branch shortly. Thismainbranch still holds the legacy v0.x .NET/React app, preserved in thev0.xtags and this repo's history.
Status: first public beta —
v1.0.0-beta.1. Full CRUD across ~42 surfaces, the time-machine, and the diagnostics suite are implemented. Grab a signed build from Releases.
- ~42 Intune/Entra surfaces — a consistent view → edit → clone → delete → assign flow, with a diff-preview + confirm gate before every write (full CRUD on ~29 writable surfaces).
- A time-machine — audit timeline, field-level drift, full-text search, point-in-time restore.
- Bulk & lifecycle — backup/export, gated import/restore, bulk app assignment, CIS/OIB baseline compare, Conditional Access → PowerPoint.
- Diagnostics — CMTrace/IME logs, dsregcmd, Event Log, Sysmon, Secure Boot, timeline correlation, one-click collector. All local, no sign-in.
- Platform layer — GitOps plan/apply, a blast-radius simulator, a queryable tenant digital twin, continuous posture scoring, multi-tenant fleet, and Maester (CIS/SCuBA/EIDSCA) checks.
- Human-gated automation — proposals land in an approval inbox with the diff + blast-radius; nothing auto-applies.
⚠️ Writes hit your live tenant — there is no sandbox. A diff-preview → confirm gate protects every change, but a confirmed change is real. Start on low-risk surfaces (Scope Tags, Device Categories). Conditional Access is read-only by design.
A two-process desktop app: a thin Rust / WinUI 3 client talks to a local .NET 10 sidecar over
loopback. All Graph/Intune coverage lives in the sidecar; the client is data-driven. A single
contract/openapi.yaml is the source of truth for the DTOs both sides share, and two storage layers
back it — an append-only audit/drift time-machine (SQLite + Lucene) and a read-through blob cache.
Full architecture, build, and release detail lives in the
v1 branch README.
Signed installers for Windows 11 (ARM64 primary + x64) — MSI + MSIX, code-signed with Azure Trusted Signing — are on the Releases page. Requires the Windows App SDK runtime; the .NET runtime is bundled.
MIT — see LICENSE. The forked Graph engine derives from the MIT-licensed
IntuneManagement by Micke-K.