THE Intune Dashboard is a client-side only web app (static HTML/JS on GitHub Pages). There is no application backend. The browser talks directly to Microsoft identity endpoints, Microsoft Graph, and (optionally) Anthropic or OpenRouter for AI features.
| Path | What happens |
|---|---|
| Local tab | CSV / .reg files are parsed in the browser. They are not uploaded to any server. |
| Intune tab | After Microsoft sign-in, the browser calls graph.microsoft.com with a user-delegated token. Graph responses stay in page memory / session UI state. |
| Analyze / AI error analysis | Log snippets or error codes are sent from the browser to Anthropic or OpenRouter (depending on the key you configure). They do not pass through this project's servers. |
| MAA notification email | Optional: Graph POST /me/sendMail from your mailbox to approvers you configured. |
- Library: MSAL.js public client application.
- Token cache:
sessionStorage(notlocalStorage). Closing the browser tab ends the MSAL session; refresh tokens are not persisted across browser restarts by design. - Sign-in scopes: read-oriented delegated scopes only (devices, apps, scripts, configuration, Autopilot, BitLocker key metadata, Entra devices/users as documented in the README).
- Write scopes: requested just-in-time the first time you use a write action (app delete, MAA approve/complete, script auto-deploy, device wipe/delete, soft-delete restore, revoke/disable user, etc.). Read-only use never needs those scopes.
- App registration: multi-tenant public client embedded in the page. Tenant admins may need to grant admin consent for some scopes.
| Storage | Contents | Secrets? |
|---|---|---|
sessionStorage |
MSAL token cache; session AI cost counter | Auth tokens (session-scoped) |
localStorage (intuneDashboard:customers) |
MSP customer codes, emails, approver lists, script GUIDs | No tokens |
localStorage (intuneDash.claude) |
Optional Claude/OpenRouter API key + model choice | Yes — treat as a secret |
localStorage |
Theme preference; AI error-code response cache; last ~10 mail notification log entries | Cached AI text may include operational detail |
Clear site data for haavarstein.github.io (or your local origin) to wipe stored settings and keys.
- The key is kept in browser
localStorageso Analyze survives reloads. - Anything that can run script in the page origin (XSS, a malicious browser extension with site access) could read it.
- Recommendations: use a spend-capped personal key; do not paste an unrestricted org production key; rotate if the machine or browser profile may be shared; clear Settings if you are done with AI features.
- BitLocker: the app requests
BitlockerKey.ReadBasic.Alland uses it only for key metadata (e.g. whether a key is escrowed). Recovery key material is never fetched or rendered. - CSV exports / tables: device names, UPNs, serials, and similar operational data appear in the UI and in user-initiated downloads. Handle screenshots and exports per your customer agreements.
- MSP customer codes: Settings supports short codes so screenshots can avoid full customer names. Do not put real customer identifiers into public issues, docs, or example text.
Proactive Remediation scripts (software metering, AI agent scan, IME check-in) run on devices inside the customer tenant under Intune. Privacy limits for metering (e.g. user initial only, no window titles) are documented in scripts/README.md. Deploy only with customer approval and appropriate change control.
- API keys, tokens, real tenant/object IDs, real customer names/emails, or exported tenant data
- Local paths under
email/or.claude/(git-ignored; may contain real data)
Please report security issues privately:
- Prefer GitHub Security Advisories for this repository, or
- Contact the maintainer via their GitHub profile if advisories are unavailable.
Do not open a public issue that includes exploit details, tokens, or customer data.
- Scope and endpoint detail: README.md (“Connecting to Intune”)
- Third-party script licenses: scripts/THIRD_PARTY_NOTICES.md