intune-mcp-server by nelladath for Intune: score
D 47 Provisional Not reviewed Not tested
intune-mcp-server by nelladath is a community MCP server for Intune with 85 read, 10 write and 13 destructive tools. It does not have a read-only mode and its access requirements are unknown; its provisional OpsMCP grade is D (47%), last checked 16 Oct 2026.
MCP Server for Microsoft Intune management via Microsoft Graph API
Tool capability partly scored. Access not scored. 2 of 4 factors scored.
Can it change or delete things?
Yes. The extracted tools include at least one destructive tool, so it can change or delete things.
| Tool | Class |
|---|---|
add_group_member Add a member to a group.
from the name (add) | Write |
add_group_owner Add an owner to a group.
from the name (add) | Write |
assign_app_to_group No description was extracted.
from the name | Unknown |
assign_directory_role No description was extracted.
from the name | Unknown |
assign_license Assign a license to a user.
from the name | Unknown |
assign_manager No description was extracted.
from the name | Unknown |
bulk_add_to_group No description was extracted.
from the name (add) | Write |
bulk_assign_licenses No description was extracted.
from the name | Unknown |
bulk_create_users No description was extracted.
from the name (create) | Write |
bulk_sync_devices No description was extracted.
from the name | Unknown |
create_device_category Create a new device category.
from the name (create) | Write |
create_dynamic_security_group Create a dynamic security group with automatic membership based on a rule.
from the name (create) | Write |
create_microsoft365_group Create a new Microsoft 365 group.
from the name (create) | Write |
create_security_group Create a new security group.
from the name (create) | Write |
create_user Create a new user in Entra ID.
from the name (create) | Write |
delete_app_registration Delete an app registration. Requires confirm=True.
from the name (delete) | Destructive |
delete_device_from_all Delete a device from both Intune AND Entra ID. Requires confirm=True.
from the name (delete) | Destructive |
delete_entra_device Delete a device from Entra ID (Azure AD). Requires confirm=True.
from the name (delete) | Destructive |
delete_group Delete a group.
from the name (delete) | Destructive |
delete_intune_device Delete a device from Intune (not just retire, but fully delete). Requires confirm=True.
from the name (delete) | Destructive |
delete_user Delete a user from Entra ID.
from the name (delete) | Destructive |
disable_conditional_access_policy Disable a Conditional Access policy.
from the name | Unknown |
disable_enterprise_app Disable an enterprise application.
from the name | Unknown |
disable_entra_device Disable a device in Entra ID.
from the name | Unknown |
disable_user Disable a user account (blocks sign-in).
from the name | Unknown |
dismiss_risky_user Dismiss the risk for a user (mark as false positive).
from the name | Unknown |
enable_conditional_access_policy Enable a Conditional Access policy.
from the name | Unknown |
enable_enterprise_app Enable an enterprise application.
from the name | Unknown |
enable_entra_device Enable a device in Entra ID.
from the name | Unknown |
enable_user Enable a user account.
from the name | Unknown |
get_app_details Get detailed information about a specific app.
from the name (get) | Read |
get_app_installation_status Get installation status for a specific app.
from the name (get) | Read |
get_app_permissions Get all permissions granted to an enterprise application.
from the name (get) | Read |
get_app_registration Get comprehensive details of an app registration including permissions and credentials.
from the name (get) | Read |
get_cloud_pc_details Get detailed information about a specific Cloud PC.
from the name (get) | Read |
get_cloud_pc_overview Get an overview of all Cloud PCs in the tenant.
from the name (get) | Read |
get_compliance_policy_status Get deployment status for a specific compliance policy.
from the name (get) | Read |
get_conditional_access_policy Get detailed information about a specific Conditional Access policy.
from the name (get) | Read |
get_credentials_expiring_soon Get all app registrations with credentials expiring within specified days.
from the name (get) | Read |
get_deleted_users List deleted users (recoverable within 30 days).
from the name (get) | Read |
get_detected_malware_on_device Get detected malware and protection state for a specific device.
from the name (get) | Read |
get_device_compliance_report Get overall device compliance summary across all managed devices.
from the name (get) | Read |
get_device_configuration_status Get deployment status for a specific configuration profile.
from the name (get) | Read |
get_device_details No description was extracted.
from the name (get) | Read |
get_device_hardware_inventory No description was extracted.
from the name (get) | Read |
get_device_health_script Get details of a proactive remediation script.
from the name (get) | Read |
get_device_health_script_status Get the status summary for a proactive remediation script.
from the name (get) | Read |
get_device_installed_apps No description was extracted.
from the name (get) | Read |
get_device_management_script Get details of a specific PowerShell script including the script content.
from the name (get) | Read |
get_device_network_info No description was extracted.
from the name (get) | Read |
get_device_protection_overview Get overall device protection status overview.
from the name (get) | Read |
get_device_threat_state Get threat state for all managed Windows devices including Defender status.
from the name (get) | Read |
get_direct_reports No description was extracted.
from the name (get) | Read |
get_directory_audit_logs Get directory audit logs.
from the name (get) | Read |
get_directory_role_members Get members of a specific directory role.
from the name (get) | Read |
get_enterprise_app Get comprehensive details of an enterprise application including permissions and assignments.
from the name (get) | Read |
get_entra_device Get details of a specific Entra ID device.
from the name (get) | Read |
get_global_admins Get all Global Administrator role members.
from the name (get) | Read |
get_group Get details of a specific group.
from the name (get) | Read |
get_group_members Get all members of a group.
from the name (get) | Read |
get_group_owners Get owners of a group.
from the name (get) | Read |
get_hardware_inventory_report Get hardware inventory summary for all managed devices.
from the name (get) | Read |
get_intune_overview No description was extracted.
from the name (get) | Read |
get_license_usage_report Get license usage summary across the tenant.
from the name (get) | Read |
get_noncompliant_devices No description was extracted.
from the name (get) | Read |
get_organization_info Get organization/tenant information.
from the name (get) | Read |
get_risk_detections Get risk detections from Identity Protection.
from the name (get) | Read |
get_risky_users Get users flagged as risky by Identity Protection.
from the name (get) | Read |
get_script_device_status Get the deployment status of a script across devices.
from the name (get) | Read |
get_security_baseline_status Get deployment status for a security baseline profile.
from the name (get) | Read |
get_security_defaults_status Get the status of security defaults for the tenant.
from the name (get) | Read |
get_service_health Get Microsoft 365 service health status.
from the name (get) | Read |
get_service_issues Get current and recent service issues.
from the name (get) | Read |
get_sign_in_logs Get sign-in logs with optional filtering.
from the name (get) | Read |
get_stale_devices_report No description was extracted.
from the name (get) | Read |
get_subscriptions Get all subscribed SKUs (licenses) for the tenant.
from the name (get) | Read |
get_tenant_domains Get all domains associated with the tenant.
from the name (get) | Read |
get_user Get details of a user by ID or UPN.
from the name (get) | Read |
get_user_authentication_methods Get all authentication methods registered for a user.
from the name (get) | Read |
get_user_devices Get all managed devices for a specific user.
from the name (get) | Read |
get_user_licenses Get license assignments for a user.
from the name (get) | Read |
get_user_mfa_status Get MFA status and registered methods for a user.
from the name (get) | Read |
get_windows_malware_report Get Windows malware information detected across devices.
from the name (get) | Read |
list_app_protection_policies List mobile app protection policies (MAM).
from the name (list) | Read |
list_app_registrations List all app registrations with credential expiry information.
from the name (list) | Read |
list_autopilot_devices List all Windows Autopilot devices.
from the name (list) | Read |
list_autopilot_profiles List all Windows Autopilot deployment profiles.
from the name (list) | Read |
list_available_licenses List all available licenses (SKUs) in the tenant.
from the name (list) | Read |
list_cloud_pcs List all Cloud PCs in the tenant.
from the name (list) | Read |
list_compliance_policies List all device compliance policies.
from the name (list) | Read |
list_conditional_access_policies List all Conditional Access policies.
from the name (list) | Read |
list_configuration_profiles List all device configuration profiles.
from the name (list) | Read |
list_device_categories List all device categories.
from the name (list) | Read |
list_device_health_scripts List all proactive remediation scripts (device health scripts).
from the name (list) | Read |
list_device_management_scripts List all PowerShell scripts deployed through Intune.
from the name (list) | Read |
list_directory_roles List all active directory roles.
from the name (list) | Read |
list_enrollment_restrictions List device enrollment restrictions.
from the name (list) | Read |
list_enterprise_apps List enterprise applications (service principals). Filter by type: Application, ManagedIdentity, Legacy.
from the name (list) | Read |
list_entra_devices List all devices registered in Entra ID (Azure AD).
from the name (list) | Read |
list_gallery_images List available gallery images for Cloud PC provisioning.
from the name (list) | Read |
list_groups List Azure AD groups.
from the name (list) | Read |
list_managed_devices No description was extracted.
from the name (list) | Read |
list_mobile_apps List all mobile apps in Intune.
from the name (list) | Read |
list_named_locations List all named locations used in Conditional Access.
from the name (list) | Read |
list_provisioning_policies List all Cloud PC provisioning policies.
from the name (list) | Read |
list_security_baseline_profiles List all deployed security baseline profiles.
from the name (list) | Read |
list_security_baselines List all security baseline templates available.
from the name (list) | Read |
list_users List all users in the tenant.
from the name (list) | Read |
offboard_user No description was extracted.
from the name | Unknown |
onboard_user No description was extracted.
from the name | Unknown |
remote_lock_device Remotely lock a managed device.
from the name | Unknown |
remove_all_app_assignments No description was extracted.
from the name (remove) | Destructive |
remove_group_member Remove a member from a group.
from the name (remove) | Destructive |
remove_license Remove a license from a user.
from the name (remove) | Destructive |
remove_manager No description was extracted.
from the name (remove) | Destructive |
rename_device No description was extracted.
from the name | Unknown |
reprovision_cloud_pc Reprovision a Cloud PC. This will reset it to its original state.
from the description (reset) | Destructive |
reset_user_password Reset a user's password.
from the name (reset) | Destructive |
restart_cloud_pc Restart a Cloud PC.
from the name | Unknown |
restart_device Restart a managed device remotely.
from the name | Unknown |
restore_deleted_user Restore a deleted user.
from the name | Unknown |
retire_device Retire a managed device (removes company data, keeps personal data). Requires confirm=True.
from the description (removes) | Destructive |
revoke_user_sessions Revoke all refresh tokens for a user (forces re-authentication).
from the name | Unknown |
search_app_registrations Search for app registrations by name.
from the name (search) | Read |
search_apps Search for apps by name.
from the name (search) | Read |
search_devices No description was extracted.
from the name (search) | Read |
search_enterprise_apps Search for enterprise applications by name.
from the name (search) | Read |
search_entra_devices Search for devices in Entra ID by display name.
from the name (search) | Read |
search_groups Search for groups by name.
from the name (search) | Read |
search_users Search for users by name.
from the name (search) | Read |
sync_device Trigger a sync for a managed device.
from the name | Unknown |
test_connection No description was extracted.
from the name | Unknown |
update_user Update user properties.
from the name (update) | Write |
wipe_device Wipe a managed device. THIS IS A DESTRUCTIVE ACTION - requires confirm=True.
from the name | Unknown |
Score
47 of 100 points (47%). A factor that was not scored counts as 0 of its full weight.
| Factor | Points | Full weight | Status |
|---|---|---|---|
| Tool capability | 24 | 35 | Partly scored |
| Access | unknown | 25 | Not scored |
| Maintenance | 12 | 20 | Scored |
| Publisher | 11 | 20 | Scored |
Tool capability
85 read, 10 write, 13 destructive, 26 unknown.
Access
| Part | Value | Points | Where this came from |
|---|---|---|---|
| Scope | unknown | unknown | unknown |
| Where it runs | unknown | unknown | unknown |
| Credentials | unknown | unknown | unknown |
Maintenance
| Part | Value | Points |
|---|---|---|
| Last commit | 75 days | 6 of 8 |
| Releases | no releases | 0 of 6 |
| Issues | 1 closed / 1 issues (1.00) | 6 of 6 |
Publisher
| Part | Value | Points | Where this came from |
|---|---|---|---|
| Who publishes it | Individual | 3 of 8 | GitHub owner type is User (nelladath). |
| Registry listing | Not listed | 2 of 5 | No latest registry entry from search='intune-mcp-server' had repository github.com/nelladath/intune-mcp-server. |
| License | MIT | 4 of 4 | GitHub SPDX license MIT. |
| Stars | 12 | 1 of 2 | 12 GitHub stars. |
| Repository age | 283 days | 1 of 1 | Repository created 2026-01-06T16:37:55Z. |
What this score does not cover
This score is not a code audit and it is not a human review. It has not been hands-on tested. Nothing on this page is a certification.
Access needed
Environment variables: unknown. The registry entry does not list any.
Maintenance
- Archived
- no
- Last commit
- 2 Aug 2026 · e285e71
- Latest release
- no releases
- Issues
- 0 open · 1 closed
- Stars
- 12
- License
- MIT
- Repository created
- 6 Jan 2026
npm and PyPI
- npm
- No npm package in the registry entry.
- PyPI
- No PyPI package in the registry entry.
- Maintainers
- unknown
Install
pip install -e .Other Intune servers
- mcp-m365-mgmt by thiagogbeier
- IntuneRosetta-mcp by UniverseCitiz3n
- IntuneAssignmentChecker-MCP by ugurkocde
- microsoft-intune-mcp by veeemlab
Badge
Sources for this listing
github:intune mcp in:name,description