Microsoft

Microsoft Endpoint Manager Intune Feedback

Suggestion box powered by UserVoice

How can we improve Microsoft Endpoint Manager Intune?

← Ideas

Secure authentication within PowerShell scripts for Intune MDM

We would like to authenticate to services, like Azure Storage or Azure SQL from an Intune MDM PowerShell script.

However, with PowerShell scripts in Intune MDM the source, including passwords are visible in plain text, for instance when you review the log files in C:\ProgramData\Microsoft\IntuneManagementExtension\Logs.

We would like a secure way to safely authenticate with different services from PowerShell scripts in Intune MDM. For instance by being able to preconfigure one or more Credential- or Variable Assets passed (as parameter?) with the PowerShell script configured.

A credential source provider could be Azure Key Vault or Azure Automation Credential- and Variable Assets.

375 votes
Vote
Sign in
(thinking…)
Sign in with: Facebook Google Microsoft Intune
Forgot password?
Create a password
Signed in as (Sign out)
Close
Close
You have left! (?) (thinking…)
jseerden shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →

9 comments

Sign in
(thinking…)
Sign in with: Facebook Google Microsoft Intune
Forgot password?
Create a password
Signed in as (Sign out)
Close
Close
Submitting...
An error occurred while saving the comment
  • Ozzy commented  ·   ·  Flag as inappropriate

    It would be very nice to use Azure Active Directory RBAC for powershell scripts

    regards,
    Ozzy

  • Richard Tracy commented  ·   ·  Flag as inappropriate

    I could definitely use this, but I feel its a difficult feature to implement only because you would then need a shared secret between device and the cloud creds. Unless there was some way to securely store an unretreavable keys on the system (maybe through TPM) manually but mask it as a system variable.

  • Matthew Nelson commented  ·   ·  Flag as inappropriate

    This really needs to be implemented. LAPS is already available on-premise but for intune devices in a cloud only environment, there is really no solution for local admin password control, which is a requirement for SRS devices

Ideas: Scripting-Graph/PowerShell

Categories

Feedback and Knowledge Base

(thinking…)