From f0c18b34872e697c312d4184d066de574639b40e Mon Sep 17 00:00:00 2001 From: Adam Date: Thu, 16 Jul 2026 13:47:10 -0400 Subject: [PATCH] docs: refresh README for the v1.0 Rust/WinUI rewrite MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace the v0.x .NET/React README with a bridging README that leads with the v1.0 story (Rust + WinUI 3 client over a .NET Graph sidecar, time-machine, diagnostics, human-gated automation). Links point only at things that exist today — Releases, intunecommander.com, and the v1 branch — so nothing 404s until the v1 code merges to main. Co-Authored-By: Claude Opus 4.8 --- README.md | 185 +++++++++++++++--------------------------------------- 1 file changed, 51 insertions(+), 134 deletions(-) diff --git a/README.md b/README.md index 76225d0..5a50e53 100644 --- a/README.md +++ b/README.md @@ -1,154 +1,71 @@ -# Intune Commander +# IntuneCommander -![Intune Logo](docs/images/logo_small.png) +![Intune Commander](docs/images/logo_small.png) -Intune Commander is a desktop application for managing Microsoft Intune configurations across Commercial, GCC, GCC-High, and DoD cloud environments. It is a ground-up remake of the PowerShell-based [IntuneManagement](https://github.com/Micke-K/IntuneManagement) tool, rebuilt as a compiled .NET application with a modern React frontend. +> A Windows-native control plane for **Microsoft Intune / Entra device management** — a Rust + +> WinUI 3 client over a hard-forked .NET Graph engine, with a persistent, searchable **audit / drift +> time-machine** and a human-gated automation layer on top. **MIT licensed.** -> **Early release.** The desktop UI currently covers a small number of Intune workspaces (see [What's Built](#whats-built)). The backend Core library and CLI support 30+ object types, and additional UI workspaces are being added incrementally. Contributions welcome! +**[intunecommander.com](https://intunecommander.com)** · **[Download the beta](https://github.com/adamgell/IntuneCommander/releases)** -## Installation +--- -### MSI Installer (recommended) +## v1.0 is a ground-up rewrite -1. Go to the [**GitHub Releases**](https://github.com/adamgell/IntuneCommander/releases) page -2. Download **`IntuneCommander-{version}-x64.msi`** -3. Run the MSI — installs to `C:\Program Files\Intune Commander\` with a Start Menu shortcut -4. The CLI tool (`ic.exe`) is included and added to your system PATH automatically +IntuneCommander started as a **.NET 10 + React** desktop app plus an `ic.exe` CLI (the **`v0.x`** +releases). **v1.0** replaces that shell with a **native Rust / WinUI 3 client** and a **.NET +sidecar** — same brand, same Graph engine — plus a time-machine, a diagnostics suite, and automation +layers the old app never had. -The MSI and all executables are code-signed via Azure Trusted Signing. +> **Where the code lives:** v1 is being finalized on the +> **[`v1` branch](https://github.com/adamgell/IntuneCommander/tree/v1)** and will become the default +> branch shortly. This `main` branch still holds the legacy v0.x .NET/React app, preserved in the +> `v0.x` tags and this repo's history. -### MSIX Package +> **Status:** first public beta — **`v1.0.0-beta.1`**. Full CRUD across ~42 surfaces, the +> time-machine, and the diagnostics suite are implemented. Grab a signed build from +> **[Releases](https://github.com/adamgell/IntuneCommander/releases)**. -An **`IntuneCommander-{version}-x64.msix`** is also available on the Releases page. This is the format used for eventual Microsoft Store distribution. For direct sideload installation the signing certificate must be trusted on your machine. +--- -### Standalone CLI +## What it does -If you only need the CLI tool, download **`ic.exe`** from the same release page. It's a self-contained single-file executable — no installation required. +- **~42 Intune/Entra surfaces** — a consistent view → edit → clone → delete → + assign flow, with a diff-preview + confirm gate before every write (full CRUD on ~29 writable + surfaces). +- **A time-machine** — audit timeline, field-level drift, full-text search, point-in-time restore. +- **Bulk & lifecycle** — backup/export, gated import/restore, bulk app assignment, CIS/OIB baseline + compare, Conditional Access → PowerPoint. +- **Diagnostics** — CMTrace/IME logs, dsregcmd, Event Log, Sysmon, Secure Boot, timeline + correlation, one-click collector. All local, no sign-in. +- **Platform layer** — GitOps plan/apply, a blast-radius simulator, a queryable tenant digital twin, + continuous posture scoring, multi-tenant fleet, and Maester (CIS/SCuBA/EIDSCA) checks. +- **Human-gated automation** — proposals land in an approval inbox with the diff + blast-radius; + nothing auto-applies. -> **Platform note:** Windows only. The desktop app requires WebView2 Runtime (pre-installed on Windows 10 April 2018+ and all Windows 11 machines). - -## What's Built - -### Desktop App (React + WPF/WebView2) - -- **Login & Profile Management** — multi-tenant profiles with encrypted local storage, auto-reconnect on startup -- **Overview Dashboard** — device compliance metrics at a glance -- **Settings Catalog Workspace** — master-detail view with policy list, full metadata, resolved group assignments, and human-readable settings grouped by category -- **Detection & Remediation Workspace** — device health scripts with deployment status and monitoring -- **Global Search** — instant search across all 25+ cached Intune object types from the top bar, grouped by category - -### CLI (`ic.exe`) - -- `ic export` — bulk export Intune configurations to JSON (compatible with the original PowerShell tool's format) -- `ic import` — import configurations with `--dry-run` for offline validation -- `ic diff` — compare two export snapshots and generate markdown reports -- `ic list` — list objects of a given type from your tenant -- `ic profile` — manage saved connection profiles -- `ic alert` — check for policy drift -- `ic completion` — shell completions for PowerShell/bash/zsh - -### Backend (Core Library) - -The Core library has full Graph API service coverage for 30+ Intune object types — the services are built and tested, but most are not yet wired into the desktop UI. The CLI uses them directly. - -## Not Yet Built (Roadmap) - -The following features have backend support in the Core library but **do not have a desktop UI workspace yet**: - -- Device Configurations, Compliance Policies, Endpoint Security, Administrative Templates -- Conditional Access (including PowerPoint export) -- Applications, App Protection Policies, App Configuration Policies -- Enrollment Configurations, Autopilot Profiles -- Assignment Filters, Policy Sets, Scope Tags, Role Definitions -- Named Locations, Authentication Strengths/Contexts, Terms of Use -- Intune Branding, Azure Branding, Feature Updates -- Dynamic Groups, Assigned Groups -- Bulk export/import UI (available via CLI only) - -## Getting Started - -### Prerequisites - -- .NET 10 SDK -- Node.js 20+ and npm -- Visual Studio 2022, JetBrains Rider, or VS Code with C# Dev Kit -- An Entra ID app registration with Microsoft Graph permissions - -### Build & Run - -```bash -# Build all .NET projects -dotnet build - -# Run unit tests -dotnet test - -# Run the desktop app (React + WPF/WebView2) -cd intune-commander-react && npm install && npm run dev # Start Vite dev server -dotnet run --project src/Intune.Commander.DesktopReact # Launch WPF host (loads from localhost:5173) -``` - -### App Registration - -1. Go to **Azure Portal > Entra ID > App Registrations > New registration** -2. Set **Redirect URI** to `http://localhost:45132` (Mobile and desktop applications) -3. Add `Microsoft Graph > Delegated > DeviceManagementConfiguration.ReadWrite.All` and related Intune scopes -4. Grant admin consent - -For **Government clouds** (GCC-High, DoD), register separate apps in the respective Azure portals. - -### Profile Management - -Intune Commander stores connection details as **profiles** (tenant ID, client ID, cloud, auth method). Profiles are encrypted locally and never leave your machine. - -A ready-to-use template is available at [`.github/profile-template.json`](.github/profile-template.json). - -| Auth Method | Description | -|-------------|-------------| -| **Interactive** (default) | Browser popup with persistent token cache | -| **Device Code** | Code-based flow for environments without browser access | -| **Client Secret** | Unattended service principal authentication | - -Valid `cloud` values: `Commercial`, `GCC`, `GCCHigh`, `DoD` - -## Technology Stack - -| Component | Technology | -|-----------|-----------| -| Runtime | .NET 10, C# 12 | -| UI | React 19, TypeScript 5.7, Vite 6.3, Zustand 5.0 | -| Desktop Host | WPF + Microsoft.Web.WebView2 | -| Authentication | Azure.Identity 1.17.x | -| Graph API | Microsoft.Graph.Beta 5.130.x-preview | -| Cache | LiteDB 5.0.x (AES-encrypted) | -| Installer | Master Packager Dev (MSI + MSIX) | -| Testing | xUnit (200+ tests) | +> ⚠️ **Writes hit your live tenant — there is no sandbox.** A diff-preview → confirm gate +> protects every change, but a confirmed change is real. Start on low-risk surfaces (Scope Tags, +> Device Categories). Conditional Access is read-only by design. ## Architecture -``` -src/ - Intune.Commander.Core/ # Business logic, 30+ Graph API services - Intune.Commander.DesktopReact/ # WPF + WebView2 host (thin shell) - Intune.Commander.CLI/ # Command-line interface (ic.exe) - Intune.Commander.Installer/ # Master Packager Dev package (MSI + MSIX) -intune-commander-react/ # React 19 + TypeScript frontend -tests/ - Intune.Commander.Core.Tests/ # xUnit tests (200+ cases) -``` - -The React frontend communicates with .NET services through a typed async bridge (`ic/1` protocol) over WebView2's `postMessage` channel. The WPF host is intentionally thin — React owns all UI rendering and state. - -See [CLAUDE.md](CLAUDE.md) for full architectural decisions. - -## Acknowledgments +A two-process desktop app: a thin **Rust / WinUI 3** client talks to a local **.NET 10 sidecar** over +loopback. All Graph/Intune coverage lives in the sidecar; the client is data-driven. A single +`contract/openapi.yaml` is the source of truth for the DTOs both sides share, and two storage layers +back it — an append-only audit/drift time-machine (SQLite + Lucene) and a read-through blob cache. -This project is a ground-up remake of [Micke-K/IntuneManagement](https://github.com/Micke-K/IntuneManagement). -Additional thanks to Merill Fernando for [idPowerToys](https://github.com/merill/idPowerToys). +Full architecture, build, and release detail lives in the +[**`v1` branch README**](https://github.com/adamgell/IntuneCommander/tree/v1#architecture). -Intune Commander is packaged using [Master Packager Dev \(mpdev\)](https://www.masterpackager.com/developer). It produces both MSI and MSIX installers for x64 and ARM64, with Azure Trusted Signing integrated for signed release builds. +## Install +Signed installers for **Windows 11** (**ARM64** primary + **x64**) — MSI + MSIX, code-signed with +Azure Trusted Signing — are on the **[Releases](https://github.com/adamgell/IntuneCommander/releases)** +page. Requires the +[Windows App SDK runtime](https://learn.microsoft.com/windows/apps/windows-app-sdk/downloads); the +.NET runtime is bundled. -## Contributing +## License -See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines on submitting pull requests, code standards, and development workflow. +**MIT** — see [`LICENSE`](./LICENSE). The forked Graph engine derives from the MIT-licensed +[IntuneManagement](https://github.com/Micke-K/IntuneManagement) by Micke-K.