Checks local delegated Microsoft authentication without returning or logging any token.

Searches supported Intune policy and application categories through internally generated Microsoft Graph /beta requests. Every record returns an id and categoryId; pass those values as policyId and category to get_policy_assignments. Display names are not unique: never silently choose one record when multiple results match. Search isAssigned values are Graph-reported hints; get_policy_assignments reconciles them against the assignment collection. Results can be RBAC-filtered for the signed-in administrator.

Lists policies and applications that directly target All Devices. For questions about apps assigned to All Devices, set category to application. Results include policyId, app or policy name, application intent when available, assignment filters, pageSummary, coverage, and an opaque continuation cursor. resultCount, pageSummary, and graphUsage describe only the current tool call; follow nextCursor for complete coverage.

Lists policies and applications that directly target All Users. For questions about apps assigned to All Users, set category to application. Results include policyId, app or policy name, application intent when available, assignment filters, pageSummary, coverage, and an opaque continuation cursor. resultCount, pageSummary, and graphUsage describe only the current tool call; follow nextCursor for complete coverage.

Lists supported Intune policies and applications whose assignment collection is empty. For unassigned apps, set category to application. Results include stable policy IDs, category IDs, platform metadata, pageSummary, explicit coverage, and an opaque continuation cursor. graphUsage describes only the current tool call; resultCount is the number of records on this page.

Returns normalized include, exclude, all-user, all-device, group, intent, and assignment-filter details for one supported policy. It never accepts a Graph URL or path.