Assignments are a graph — groups nest, filters narrow, includes and excludes fight. Every other tool shows you flat lists. IntuneGraph makes the graph the data model, so the questions admins actually ask become simple queries.
Scan the whole tenant for assignment hygiene problems: dead config, empty and deleted target groups, include/exclude collisions, and mixed device/user targeting.
PS> Find-IntuneOrphan BrokenGroupReference High Old CRM (targets a deleted group) IncludeExcludeCollision High Legacy VPN Profile (included AND excluded) EmptyTarget Warning Kiosk Lockdown (empty group)
Resolve every policy, app and script that targets a device or user, with the exact group path that causes each — through nesting, filters and include/exclude.
PS> Get-IntuneTarget -Identity DEV-FIN-01 Workload Status Via Win11 Security Baseline Applies DEV-FIN-01 -> SG-Finance -> SG-AllStaff Win Compliance AppliesPreFilter DEV-FIN-01 -> All Devices (F-CorpOwned) LOB Finance App Applies DEV-FIN-01 -> SG-Finance
Preview the impact of a membership change before you make it — exactly which workloads a device or user gains or loses, resolved through nesting and exclusions.
PS> Get-IntuneBlastRadius -Group SG-Finance -WhatIfAddMember KIOSK-01 Adding 'KIOSK-01' to 'SG-Finance': Gains 3 workload(s), loses 0.
The bundled Contoso demo tenant runs entirely in your browser. Drag nodes, zoom, click for details. The whole tool works offline against demo data — so you can evaluate it (and contribute to it) without ever touching a real tenant.
Not another config-backup tool — the relationship-and-impact layer. The excellent tools below solve adjacent problems; use them together.
| IntuneGraph | Assignment Checker | IntuneCD | Portal | |
|---|---|---|---|---|
| “What applies to X” list | ● | ● | — | |
| Membership path (why) | ● | — | — | |
| Blast-radius / change impact | ● | — | — | |
| Assignment hygiene checks | ● | ◐ | — | |
| Interactive graph | ● | — | — | |
| Config backup / as-code | — | — | ● |
Install-Module IntuneGraph -Scope CurrentUser Import-Module IntuneGraph Export-IntuneGraph -DemoData -PassThru | Show-IntuneGraph -Open
Connect-IntuneGraph Export-IntuneGraph -Html -PassThru | Show-IntuneGraph -Open Get-IntuneTarget -Identity DESKTOP-01 Get-IntuneBlastRadius -Group "SG-Finance" Find-IntuneOrphan
Four read-only Graph scopes, zero write scopes — the code contains no POST/PATCH/DELETE
paths. Your data never leaves the graph.json you export.