Assignments are a graph — groups nest, filters narrow, includes and excludes fight. Every other tool shows you flat lists. IntuneGraph makes the graph the data model, so the questions admins actually ask become simple queries.
Scan the whole tenant for assignment hygiene problems: dead config, empty and deleted target groups, include/exclude collisions, and mixed device/user targeting.
PS> Find-IntuneOrphan BrokenGroupReference High Old CRM (targets a deleted group) IncludeExcludeCollision High Legacy VPN Profile (included AND excluded) EmptyTarget Warning Kiosk Lockdown (empty group)
Resolve every policy, app and script that targets a device or user, with the exact group path that causes each — through nesting, filters and include/exclude.
PS> Get-IntuneTarget -Identity DEV-FIN-01 Workload Status Via Win11 Security Baseline Applies DEV-FIN-01 -> SG-Finance -> SG-AllStaff Win Compliance AppliesPreFilter DEV-FIN-01 -> All Devices (F-CorpOwned) LOB Finance App Applies DEV-FIN-01 -> SG-Finance
Preview the impact of a membership change before you make it — exactly which workloads a device or user gains or loses, resolved through nesting and exclusions.
PS> Get-IntuneBlastRadius -Group SG-Finance -WhatIfAddMember KIOSK-01 Adding 'KIOSK-01' to 'SG-Finance': Gains 3 workload(s), loses 0.
IntuneGraph ships an MCP server, so Claude Code or GitHub Copilot can query the graph directly. Other Intune MCP servers wrap Graph endpoints — they can list policies. None can answer why one applies, because none of them model group nesting, filters and include/exclude collisions. This one does, because that's the whole data model.
claude mcp add intunegraph -- pwsh -NoLogo -NoProfile -NonInteractive \ -File ./tools/mcp/mcp-server.ps1 -Path ./graph.json
> why does Win11 Security Baseline apply to DEV-FIN-01? [intune_target] Win11 Security Baseline ConfigPolicy Applies via DEV-FIN-01 -> SG-Finance -> SG-AllStaff > what happens if I add KIOSK-01 to SG-Finance? [intune_blast_radius] Gains 3 workload(s), loses 0. + LOB Finance App (required) + Win11 Security Baseline + Adobe Reader (available)
It never touches your tenant. The server reads a local graph.json snapshot,
so the assistant gets the answers without ever getting your credentials — and you decide when
to refresh it. Six read-only tools: intune_target, intune_blast_radius, intune_orphans,
intune_path, intune_node, intune_summary.
Setup guide ↗
The bundled Silver Chariot Corporate demo tenant runs entirely in your browser. Drag nodes, zoom, click for details. The whole tool works offline against demo data — so you can evaluate it (and contribute to it) without ever touching a real tenant.
Not another config-backup tool — the relationship-and-impact layer. The excellent tools below solve adjacent problems; use them together.
| IntuneGraph | Assignment Checker | IntuneCD | Portal | |
|---|---|---|---|---|
| “What applies to X” list | ● | ● | — | |
| Membership path (why) | ● | — | — | |
| Blast-radius / change impact | ● | — | — | |
| Assignment hygiene checks | ● | ◐ | — | |
| Interactive graph | ● | — | — | |
| MCP server (ask an AI, offline) | ● | — | — | |
| Config backup / as-code | — | — | ● |
Install-Module IntuneGraph -Scope CurrentUser Import-Module IntuneGraph Export-IntuneGraph -DemoData -PassThru | Show-IntuneGraph -Open
Connect-IntuneGraph Export-IntuneGraph -Html -PassThru | Show-IntuneGraph -Open Get-IntuneTarget -Identity DESKTOP-01 Get-IntuneBlastRadius -Group "SG-Finance" Find-IntuneOrphan
Four read-only Graph scopes, zero write scopes — the code contains no POST/PATCH/DELETE
paths. Your data never leaves the graph.json you export.