Intune is a unified endpoint management platform, and almost nobody runs it as one. Most estates keep SCCM for Windows, Jamf or nothing for Mac, and a separate MDM for phones — three toolchains drifting apart, with scripts holding the seams together.
I consolidate that onto one plane and then run it the way software is run: configuration-as-code, CI/CD across GitHub Actions and Azure DevOps, drift detection with attribution, staged rollout rings, and point-in-time restore — documented and handed off so your team owns it.
There are two ways to get configuration history out of a tenant.
One is a subscription. The other is a pipeline you own.
recurring licence cost — you own the pipeline outright, and it scales with your tenants rather than your headcount
Not a product you subscribe to — eight things that exist in your own repository, under your own control, after the engagement ends.
Applications and scripts deploy from declarative manifests, schema-validated before merge. Your team ships endpoint changes through pull requests and never opens the Intune console to do it.
Segregated release channels built on device categories — run an insider or pilot ring inside your production tenant with no second tenant and no extra licensing. Moving a device between channels is an attribute change, not a re-enrollment, so it takes seconds and never wipes the machine.
Every policy, profile, script, and app config backed up to JSON in your GitHub repo. Runs nightly, zero manual effort.
Know exactly who changed what in the Intune console — enriched from the Microsoft Graph audit log with UPN-level attribution.
Field-level diff reports in HTML and Excel. Filter by policy type, platform, author, or assignment group. Per-commit timelines.
If you do run separate tenants, compare Dev, Test, and Prod side by side. Deep-diff JSON configs, spot missing policies, flag assignment discrepancies.
Roll back to any git commit, tag, or branch. Dry-run mode previews every change. Environment approval gates protect production.
Drift alerts, pipeline results, and restore confirmations pushed directly to your Teams channels. Stay informed without the noise.
Four pipelines. One repo. Windows, macOS and iOS in the same place.
Nightly backup with audit-enriched drift detection
Field-level diff reports in HTML + Excel
Cross-environment deep JSON comparison
Dry-run, selective restore, approval gates
A scoped consulting engagement, priced to the project — not a subscription. You keep everything I build.
Assess your tenants, tooling, and goals; agree on outcomes and a fixed scope.
Stand up the config-as-code repo, CI/CD pipelines, and guardrails in your environment.
Runbooks and diagrams so the pipeline is understood — not a black box.
Train your team and transfer ownership — no lock-in, no ongoing dependency on me.
Tenant backup and reference snapshots run on IntuneCD, the open-source Intune backup engine. No reason to reinvent that, and you get a tool with a community behind it rather than something only I understand.
What I build on top is the part that isn’t available off the shelf: applications and scripts deployed declaratively, so your team ships endpoint changes through pull requests and never opens the Intune console to do it. Schema validation before merge, staged rollout rings with enforced canary caps, a blast-radius approval gate that halts on newly-broadened targeting, and drift detection between declared and live state — all running as GitHub Actions in your own repo, documented and handed off. Endpoint automation and infrastructure delivery, based in Seattle.
Let's scope your Intune DevOps pipeline. No vendor lock-in — just your policies, in your repo, under your control, run like software.