Intune Assignment Checker MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| IAC_MCP_CLIENT_ID | No | Explicit override for the Microsoft Entra public client ID used for testing. | |
| IAC_MCP_TENANT_ID | No | Optional tenant GUID to pin guest or multi-tenant administrators. | |
| IAC_MCP_AUTO_SIGN_IN | No | Set to 'false' if model-triggered tool calls must return auth_required instead of opening a browser. | true |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get_connection_statusA | Checks local delegated Microsoft authentication without returning or logging any token. |
| search_policiesA | Searches supported Intune policy and application categories through internally generated Microsoft Graph /beta requests. Every record returns an id and categoryId; pass those values as policyId and category to get_policy_assignments. Display names are not unique: never silently choose one record when multiple results match. Search isAssigned values are Graph-reported hints; get_policy_assignments reconciles them against the assignment collection. Results can be RBAC-filtered for the signed-in administrator. |
| list_all_device_assignmentsA | Lists policies and applications that directly target All Devices. For questions about apps assigned to All Devices, set category to application. Results include policyId, app or policy name, application intent when available, assignment filters, pageSummary, coverage, and an opaque continuation cursor. resultCount, pageSummary, and graphUsage describe only the current tool call; follow nextCursor for complete coverage. |
| list_all_user_assignmentsA | Lists policies and applications that directly target All Users. For questions about apps assigned to All Users, set category to application. Results include policyId, app or policy name, application intent when available, assignment filters, pageSummary, coverage, and an opaque continuation cursor. resultCount, pageSummary, and graphUsage describe only the current tool call; follow nextCursor for complete coverage. |
| list_unassigned_policiesA | Lists supported Intune policies and applications whose assignment collection is empty. For unassigned apps, set category to application. Results include stable policy IDs, category IDs, platform metadata, pageSummary, explicit coverage, and an opaque continuation cursor. graphUsage describes only the current tool call; resultCount is the number of records on this page. |
| get_policy_assignmentsA | Returns normalized include, exclude, all-user, all-device, group, intent, and assignment-filter details for one supported policy. It never accepts a Graph URL or path. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 6 tools
Each tool has a clear, distinct purpose: auth check, search, two scoped listing tools (device vs user), unassigned listing, and per-policy details. The names and descriptions make boundaries obvious, with no overlapping responsibilities.
All tools use a consistent lowercase snake_case verb_noun pattern: get_*, search_*, list_*. Scoped variations (list_all_, list_unassigned_) are predictable and readable, with no mixed conventions.
6 tools is well-scoped for an Intune assignment checker, covering authentication, policy discovery, assignment scopes, and detailed lookups without bloat or redundancy.
The tool set covers all core read-only workflows: find policies, see All Device/All User assignments, identify unassigned policies, and inspect detailed assignments for a single policy. No obvious dead ends for the stated checker purpose.