Kevin Malinoski

After roughly a year of writing deep-dive Intune content here on malinoski.me — posts on Assigned Access kiosks, Intune-based McAfee removal, policy conflicts, Autopatch deployments, and the eternal “why isn’t this device getting what I assigned?” question — I kept running into the same fundamental friction.

Intune’s admin center is fantastic for creating policy, but it’s still largely a click-into-every-object experience when you want to answer a simple question: “If I enroll (or provision via Autopilot) a device with these group memberships, this Group Tag, and these assignment filters… what will it actually receive?”

You end up bouncing between Configuration Profiles, Compliance policies, Settings Catalog items (including the unified Security Baselines), Administrative Templates, and then trying to mentally merge includes, excludes, filters, and platform rules. Conflicts and redundant overlaps often only surface after devices check in — sometimes days later.

That loop is slow, risky, and frustrating. So I built something to collapse it.

Introducing Intune Preflight

Intune Preflight is a free, open-source, self-hosted tool that lets you simulate an endpoint and instantly see the full merged CSP-level baseline it would receive — before any device ever enrolls or checks in.

Endpoint simulator view — groups, Autopilot Group Tag, and assignment filters driving policy application.

You pick:

• The OS platform (Windows, macOS, iOS/iPadOS, Android)
• The Entra security groups the device belongs to (including All Devices / All Users)
• An Autopilot Group Tag (it intelligently auto-selects matching dynamic groups based on [OrderID] rules)
• Any Assignment Filters the device matches

… and the tool computes and visualizes:

• A connected diagram showing exactly which policies apply via which groups
• The complete merged baseline table of every setting from every applied policy
• Real conflicts (same setting, different values from different policies)
• Policy overlaps (same setting, same value — redundant assignments)
• Explicit exclusions (group excludes and filter-based exclusions)

No hardware. No enrollment. No Policy Sets. Just clarity.

Drill into the merged CSP baseline with conflicts and overlaps clearly surfaced.

Why This Matters (Especially for Zero-Trust & Complex Environments)

In modern Intune deployments — particularly kiosk/Assigned Access scenarios, Autopilot provisioning with dynamic Group Tags, security baselines, or multi-platform estates — the gap between “what I assigned” and “what the device actually gets” is where risk lives.

Intune Preflight gives you that effective state up front. You can:

• Validate a new policy set or baseline before rolling it out
• Understand why a device isn’t receiving expected configuration (without waiting for check-ins and reports)
• Spot conflicting or overlapping policies during design, not after deployment
• Safely experiment with group/filter strategies and Autopilot tagging logic

It’s read-only, uses application permissions (full-tenant visibility by design — exactly what a preflight needs), runs lightweight (Docker or npm), and keeps everything in memory with a simple refresh button when you make changes in the admin center.

How It Works (High Level)

A small Fastify API talks to Microsoft Graph (client-credentials flow) to pull policies, assignments (include + exclude), assignment filters, Autopilot profiles, and security groups with their dynamic membership rules. The simulation engine then resolves everything for your chosen endpoint characteristics and returns the merged result. The React frontend (with React Flow) makes the relationships visual and the baseline explorable.

Full details, exact Graph permissions required, setup instructions (including the one-command Docker path), security considerations, and known limitations are in the README.

Current Status & Honest Limitations (0.5 Beta)

This is shipping as a 0.5 beta. The core simulation, conflict/overlap detection (Windows), include/exclude handling, assignment filter support, and Autopilot Group Tag awareness all work well for the common cases most of us deal with daily.

Known edges (all documented in the repo):

• Dynamic group rule evaluation is currently best-effort / heuristic for flat [OrderID] clauses (nested or mixed-property rules are not fully parsed yet).
• Overlap detection is Windows-focused for accuracy.
• Some Settings Catalog names appear in their raw definition form (human labels coming in v1).
• Legacy deviceManagement/intents baselines are not yet covered (most modern tenants are fine).

The ROADMAP.md lays out the v1 priorities: proper dynamic membership rule parser/evaluator, legacy intents support, better Settings Catalog labeling, cross-platform overlap accuracy, and a demo/sample-data mode so people can try it without a tenant.

Try It Today

Quick start (Docker — recommended):

Bash

git clone https://github.com/kevinmalinoski/intune-preflight.git
cd intune-preflight
docker compose up --build

Then open http://localhost:8080.

You’ll need a simple Entra app registration with DeviceManagementConfiguration.Read.All + Group.Read.All (plus two optional scopes) and admin consent. Full steps are in the README.

It’s MIT licensed, self-hosted, and designed to live alongside your existing scoped Intune Administrator role — not replace it.

This Is Just the Beginning

Building and shipping this tool after a year of blogging has been incredibly rewarding. The posts I’ve written here were born from real troubleshooting and design work. Intune Preflight turns those lessons into something you can use every day.

I’d love your feedback:

• Does it surface the conflicts and overlaps you care about?
• Are there assignment scenarios it currently mishandles?
• What would make this indispensable in your workflow?

Open an issue, start a discussion, or just star the repo if you find it useful. Contributions (especially around the dynamic rule evaluator or additional platform coverage) are very welcome.

Here’s to fewer “deploy and pray” cycles and more confident, visible Intune environments.

Try Intune Preflight → github.com/kevinmalinoski/intune-preflight

Thanks for reading, and thanks for being part of this community.

— Kevin