intune-mcp-write

MCP server providing read-write access to Microsoft Intune device properties and group memberships via the Microsoft Graph API. Allows Claude (or any MCP client) to manage devices, update properties, trigger syncs, and modify group membership.

Prerequisites

• Node.js >= 18

• An Azure AD (Entra ID) app registration with delegated permissions

Related MCP server: Microsoft 365 Core MCP Server

Setup

1. Register the Azure AD App

Create a public client app in Entra ID with these delegated permissions:

• DeviceManagementManagedDevices.ReadWrite.All

• DeviceManagementManagedDevices.PrivilegedOperations.All

• Device.Read.All

• GroupMember.ReadWrite.All

• Directory.Read.All

• User.Read.All

Grant admin consent for all permissions.

Warning: PrivilegedOperations.All grants the ability to remotely wipe, retire, restart, and lock any managed device the authenticated user has Intune RBAC access to. Use Intune scope tags to limit which devices can be acted on.

Then create .env:

AZURE_CLIENT_ID=<your-app-client-id>
AZURE_TENANT_ID=<your-tenant-id>

To enable destructive actions (retire, wipe), also set:

ENABLE_DESTRUCTIVE_ACTIONS=true

2. Install and Build

npm install
npm run build

3. Authenticate

npm run auth

Follow the device code prompt to sign in with your Microsoft account.

4. Run

Stdio mode (for MCP clients like Claude Desktop):

npm start

HTTP mode (for web-based MCP clients):

npm run start:http

5. Claude Desktop Configuration

Add to your Claude Desktop config (claude_desktop_config.json):

{
  "mcpServers": {
    "intune-mcp-write": {
      "command": "node",
      "args": ["F:/Repositories/Intune MCP Write/dist/index.js"],
      "env": {
        "AZURE_CLIENT_ID": "<your-client-id>",
        "AZURE_TENANT_ID": "<your-tenant-id>"
      }
    }
  }
}

Tools

Device Read Operations

Device Write Operations

User Operations

Remote Device Actions

retire_device, wipe_device, and delete_device require ENABLE_DESTRUCTIVE_ACTIONS=true and a confirmDeviceName parameter that must match the device's actual display name.

Group Read Operations

Group Write Operations

Bulk Operations

Bulk operations run sequentially with a configurable delay (default 200ms) between API calls to avoid Graph API rate limits. Each returns per-item success/failure status.

Architecture

• Dual transport: Supports stdio (for direct MCP client integration) and HTTP/Streamable (Express-based with session management)

• GraphClient: Typed HTTP abstraction over Microsoft Graph with retry logic (3 retries for 401/429/5xx), exponential backoff, cursor-based pagination, and PUT support for $ref assignments

• Auth: MSAL device-code flow with token cache at ~/.intune-mcp-write/token-cache.json

• Logging: JSON structured logs to ~/.intune-mcp-write/logs/ with rotation (10MB max, 5 files)

Project Structure

src/
  index.ts              Entry point (stdio or HTTP transport)
  server.ts             MCP server factory, registers all tool modules
  graph.ts              GraphClient (GET/POST/PATCH/PUT/DELETE with retries, pagination)
  auth.ts               AuthManager (MSAL device-code flow, token cache)
  auth-cli.ts           CLI for interactive sign-in
  http.ts               Express-based HTTP/Streamable transport
  logger.ts             JSON file logger with rotation
  tools/
    device-properties.ts  Device read/write tools
    group-membership.ts   Group membership tools
    remote-actions.ts     Remote device actions (restart, lock, wipe, retire)
    user-operations.ts    User search and primary user management
    bulk-operations.ts    Bulk sync, rename, and group add tools
    errors.ts             Error formatting helpers
  __tests__/
    graph.test.ts         GraphClient unit tests
    errors.test.ts        Error helper unit tests
    remote-actions.test.ts  Remote action tool tests
    user-operations.test.ts  User operation tool tests
    device-properties-extended.test.ts  Category, delete tool tests
    group-membership.test.ts  User group operation tool tests
    bulk-operations.test.ts   Bulk operation tool tests

Known Limitations

• Dynamic groups cannot have members added/removed (Graph API constraint)

• No policy/profile assignment management

• No conditional access visibility

• Bulk operations use sequential calls — not Graph API $batch; optimize later if throughput becomes an issue