Claude for Intune: Policy Scripts and Troubleshooting

Claude can help Microsoft Intune administrators draft PowerShell scripts, review configuration profile settings, and work through device policy troubleshooting step by step. There is no Anthropic-built Intune integration; you paste evidence into Claude and apply the result in Intune yourself. Tools like fenbs keep approved changes and troubleshooting lessons in one place, so the next incident does not start from scratch.

Intune manages the device estate of an organization. A misconfigured policy or an untested script can affect every enrolled device in a group. Test everything in a non-production group or tenant before wider deployment, and keep a record of what was tested and what was observed.

What Claude can help with in Intune administration

• Drafting PowerShell detection and remediation scripts for Proactive Remediations (Endpoint analytics).
• Writing shell scripts for macOS and Linux device enrollment and configuration.
• Reviewing configuration profile JSON or XML for common errors.
• Explaining Intune Graph API calls and drafting PowerShell for reporting via Microsoft Graph.
• Troubleshooting enrollment errors by working through the sequence of events you supply.
• Drafting compliance policy logic and explaining the effect of each setting.

Drafting and reviewing PowerShell scripts

Describe the task in plain language: what the script should detect, what action it should take on remediation, and any constraints (for example, whether it should run in 32-bit or 64-bit context, what exit codes are expected). Claude will produce a draft with a detection script and a remediation script. Review the logic before deploying.

Write an Intune Proactive Remediation pair. Detection script: check whether the registry key HKLM:\Software\Contoso\Config exists and has a value named Version set to "2.1". If not, exit 1. Remediation script: create the key and set the value. Both scripts run as System in 64-bit context.

Test every script against a single enrolled test device before assigning it to a broader group. Check the Remediation status report in Intune after the first run to confirm the detection and remediation outcomes match your intent.

Troubleshooting device policy issues

When a policy does not apply as expected, gather the evidence first. Run mdm diagnostics on the affected device, check the device enrollment status page in the Intune admin center, and export the relevant Event Viewer logs from the DeviceManagement-Enterprise-Diagnostics-Provider channel. Paste that evidence into Claude and describe what you expected versus what happened.

Claude will suggest a sequence of steps to check. Work through each one and report back what you found. This iterative approach — supply evidence, get a hypothesis, check it, report back — is more reliable than asking for a complete solution without evidence. Claude cannot see your tenant; it works from what you describe.

Working with configuration profile exports

You can export a configuration profile from Intune as a JSON file from the device configuration blade. Paste the relevant section into Claude and ask it to explain each setting, identify settings that might conflict with another policy you supply, or check the profile against a CIS benchmark or DISA STIG excerpt you paste alongside it.

Claude works from what you paste. It cannot query your tenant, read your current policy list, or see device states. Supply the specific JSON or settings text rather than describing them in general terms.

Using the Microsoft Graph API with Claude

For reporting and automation tasks that go beyond the Intune admin center, the Microsoft Graph API provides programmatic access to device, policy, and compliance data. Give Claude the endpoint you need, describe what you want to retrieve or update, and ask for a PowerShell example using the Microsoft.Graph PowerShell SDK. Verify the required permission scopes against Microsoft's Graph permissions reference before registering an app registration.

How to do this with fenbs

1. Create a free account and add a project for your Intune environment.
2. Record approved script versions and their test results as Decisions and rules entries, noting the date and the test scope.
3. Add troubleshooting lessons after each resolved issue: the symptom, root cause, and fix.
4. Track open tasks — scripts awaiting testing, policies under review, or open incidents — on the board.
5. Before each change window, review the board for any open decisions or lessons that affect the planned changes.

Managing compliance policies

Compliance policies in Intune define what a healthy device looks like and drive conditional access decisions. When a compliance policy is behaving unexpectedly — marking devices non-compliant when they should pass, or not triggering remediation — paste the policy settings you exported and the affected device's compliance state details from the Intune admin center. Ask Claude to work through which setting is most likely causing the state and what the expected evaluation sequence is.

For organizations building toward a CIS or NIST benchmark, Claude can help map a benchmark control to the corresponding Intune compliance policy setting when you paste the relevant benchmark section alongside your current policy. This is a drafting step; a security team member should review the mapping before applying it to production devices.

What Claude cannot do for Intune

Claude cannot connect to your Intune tenant, read device states, or test a script against a real device. It works from text you supply. For policies that affect the full device estate, Claude is a drafting and reasoning aid; human review and staged deployment are what make the result safe. See what is Claude AI for an overview of Claude's capabilities and limits.