Add commands for Microsoft Intune

Aim

This issue proposes a new intune command group and tracks the follow-up issues for its first commands. The first entity is the device configuration profile, with list, get, add, set, and remove. I will write the commands, tests, and docs, one command per follow-up issue, starting with list.

Who this is for

Intune administrators who already use this CLI for the rest of Microsoft 365. Today CLI for Microsoft 365 has no Intune commands at all. The only way to reach Intune from this CLI is m365 request with a hand-built URL and body.

Why

CLI for Microsoft 365 covers Entra ID, Exchange, SharePoint, Teams, Purview, Viva, and Power Platform, and has no Intune commands. Intune is the device half of Microsoft 365 administration, so an admin who runs everything else through this CLI still has to leave it for device work.

Microsoft retired the Microsoft Graph CLI on 28 August 2026 and points users to PowerShell, so there is no Microsoft CLI for Intune either. Source: https://devblogs.microsoft.com/microsoft365dev/microsoft-graph-cli-retirement/

Design

Group name. intune, following the pattern that gave SharePoint Embedded its own spe group in #5731.

API. Microsoft Graph v1.0, /deviceManagement/deviceConfigurations. The endpoint is available in the global cloud, US Government L4, US Government L5 (DoD), and China, so it works with the CLI's national cloud support. The tenant needs an active Intune license. Source: https://learn.microsoft.com/graph/api/intune-deviceconfig-deviceconfiguration-list?view=graph-rest-1.0

Permissions. DeviceManagementConfiguration.Read.All for list and get. DeviceManagementConfiguration.ReadWrite.All for add, set, and remove. Both delegated and application permissions are supported. Personal accounts are not.

How add and set take input. A device configuration profile is one of 24 concrete Graph types in v1.0, such as windows10GeneralConfiguration or macOSGeneralDeviceConfiguration. Property counts run from 18 on macOSGeneralDeviceConfiguration to 207 on windows10GeneralConfiguration, and the types share only six inherited properties, so per-property flags would not fit. So add and set take the profile as JSON through a --body option that also accepts @file.json, the same way m365 request does today. Every create posts to the same /deviceManagement/deviceConfigurations route, and the @odata.type property in the body selects the profile type. Because Graph PATCH is partial, set also offers --displayName and --description flags for the two edits admins make most. Both are inherited from the base type and writable on every profile type. When those flags are used, the command reads the profile first so it can send the correct @odata.type with the PATCH. Sources: https://learn.microsoft.com/graph/api/resources/intune-deviceconfig-windows10generalconfiguration?view=graph-rest-1.0 and https://learn.microsoft.com/graph/sdks/create-requests#updating-an-existing-entity-with-patch

Verbs. list, get, add, set, remove, matching the project's approved verbs. remove prompts for confirmation unless --force is passed.

Commands in this first slice

Each command gets its own "New command" issue with usage, options, examples, and the API details. I will open them after this proposal is accepted.

• m365 intune deviceconfiguration list
• m365 intune deviceconfiguration get
• m365 intune deviceconfiguration add
• m365 intune deviceconfiguration set
• m365 intune deviceconfiguration remove

Commands that complete the end-to-end story

These finish the deploy scenario and are the next slice once the five above are merged.

• m365 intune deviceconfiguration assignment add (POST .../deviceConfigurations/{id}/assign replaces the whole assignment set, so add and remove read the current assignments and post the merged list)
• m365 intune deviceconfiguration assignment list
• m365 intune deviceconfiguration assignment remove
• m365 intune deviceconfiguration devicestatus list

What I need from maintainers

• Agreement on the intune group name and on the JSON body approach for add and set.
• A yes on the first slice so I can open the five command issues.

This is a proposal rather than an implementation issue, and it names no repository files or tests. Start by reviewing the existing m365 request command and the SharePoint Embedded group pattern from #5731, then confirm the Microsoft Graph deviceConfigurations endpoint and proposed JSON approach. Done means maintainers agree on the group and design and the five follow-up command issues are opened.