Word and PDF export
Policies, settings, assignments, scripts, and baselines in the same audit-ready documents as the web version, generated on your machine.
Desktop app for macOS and Windows
Intune documentation that never leaves your machine.
Collect your Intune configuration through an app registration you create in your own Microsoft tenant, then export Word, PDF, and compliance evidence on your own machine. We never get access to your tenant. Built for admins and MSPs whose policies rule out third-party processing of tenant data.
From €99 per month. 30-day money-back guarantee. Cancel anytime. Getting started guide
Need approval from your security team? Download the security overview (PDF)
Same report engine as the free web version, used for 8,650 exported reports.
Real export from a sample tenant
Web or desktop
The same reports, without our server in the path.
The free web version collects through our server, which processes Graph responses in memory and stores nothing. The desktop app removes that hop: your machine talks to Microsoft directly.
- Where Graph responses are processed
- Web (free)On our server, in memory only, never storedDesktop appOnly on your machine
- App registration you sign in with
- Web (free)Ours, consented in your tenantDesktop appYour own, with the permissions you choose
- Word, PDF, and compliance evidence
- Web (free)IncludedDesktop appIncluded
- Many tenants
- Web (free)Sign in to each tenant separatelyDesktop appSwitch tenants in the app (MSP plan)
- Updates
- Web (free)Always the latest versionDesktop appInstalled when you choose
- Price
- Web (free)FreeDesktop appFrom €99 per month
Prefer to run the web version on your own infrastructure? It is open source and free to self-host.
What stays local
Your tenant data stays on your device.
The app signs in with your own app registration and calls Microsoft Graph directly. There is no Intune Documentation server in the middle.
Your own app registration, in your own tenant
You create the app registration in your own Microsoft tenant. It is free, needs no Azure subscription, and gives us no access to your tenant. You control consent, the nine read-only permissions, and Conditional Access.
Straight to Microsoft Graph
Collection runs on your machine and talks to Microsoft directly. Configuration, tokens, and exports are never uploaded to us.
Encrypted on disk
Your license key and token are encrypted with the operating system keychain. Documents are saved only where you choose.
Your machine
Talks to Microsoft Graph directly
- Intune configuration collected from Microsoft Graph
- Microsoft access and refresh tokens
- Exported Word and PDF documents
- Compliance evidence reports
Licensing service
What a license check sends
- License key
- Sign-in token, verified and not stored
- App registration client ID
- Random installation ID
- Entra tenant ID
- Operating system
- App version
For your security review
Getting the desktop app approved internally?
The app connects through an app registration you create in your own Microsoft tenant, so we never get access to it. Share the one-page security and architecture overview with your security team: it covers every read-only Graph permission and each connection the app makes, including what our licensing service receives.
License checks also send a short-lived Microsoft sign-in token, or only the token for an organization license. We verify its signature with Microsoft, use only its tenant ID and app registration ID, and never store it. The licensing service uses this data only to validate your subscription and enforce tenant and installation limits. Details are in the privacy policy.
Features
Everything the web version does, on your own terms.
Compliance evidence for 12 frameworks
Map your configuration to NIS2, ISO/IEC 27001, SOC 2, HIPAA, NIST, BSI IT-Grundschutz, Cyber Essentials, Essential Eight, and more. Each report is built to hand to an auditor, with sample reports to preview.
See the frameworksSearch every setting
Find a setting across all collected policies by name, value, or setting id, and see every policy that sets it, with its value, platform, and assignment. Search runs locally, without an internet connection.
One-page management report
One page for management with safeguards in place and the next five steps, followed by explanations for your IT team. English or German, with month-over-month change from a saved baseline.
Multi-tenant for MSPs
One MSP license covers every customer tenant you activate. Switch tenants in the app without juggling keys.
Works offline for 14 days
After a successful license check, the app keeps working for 14 days without reaching our licensing service. Collection only needs Microsoft Graph.
Pricing
One plan per organization, one for partners.
Both plans include Word and PDF exports, compliance evidence, offline use, and updates. MSP adds more tenants and switching between them. Prices in EUR. VAT is added at checkout where applicable.
- 1
Buy a license
Pick a plan and pay at checkout.
- 2
Get your license key
The key arrives by email after checkout.
- 3
Set up in about 10 minutes
Create the app registration in your own tenant, sign in, and paste the key.
Before you buy
Your own app registration
You create it in your own Microsoft tenant in about 10 minutes. It is free, needs no Azure subscription, and gives us no access to your tenant.
One-time admin consent
Granted once by a Global Administrator, Privileged Role Administrator, or Cloud Application Administrator for the read-only permissions.
Security approval, if your organization needs it
Send your security team the one-page security overview before you buy.
Download the security overview (PDF)
Pro
For one organization documenting its own tenant.
€99per month
One tenant, billed monthly.
30-day money-back guarantee. Cancel anytime.
- 1 Microsoft Entra tenant
- Up to 5 installations
- Other admins in your tenant sign in without a key
- Word and PDF exports
- Compliance evidence for 12 frameworks, including NIS2 and HIPAA
- One-page management report with month-over-month change
- Works offline for 14 days between license checks
- Free updates, installed when you choose
MSP
Best value per tenantFor partners who document many customer tenants.
€199per month
Includes 10 tenants. Each additional tenant €15 per month.
30-day money-back guarantee. Cancel anytime.
- 10 Microsoft Entra tenants included
- Add tenants above 10 at any time
- Up to 5 installations per tenant
- Share the license with the customer tenants you choose
- Switch tenants without extra keys
- Word and PDF exports for every tenant
- Compliance evidence for 12 frameworks, including NIS2 and HIPAA
- One-page management report with month-over-month change
- Works offline for 14 days between license checks
- Free updates, installed when you choose
Need an invoice, purchase order or quote? Email us.
Cancel any time. Cancellation takes effect at the end of the billing period, and the app stays licensed until then. Already a customer? Open the customer portal.
Download
Install once, update when you choose.
The app needs an active license to collect and export. If a colleague already shares one with your tenant, just sign in. Otherwise buy a license first; the key arrives by email.
macOS
Disk image signed and notarized by Apple. Open it and drag the app to Applications.
macOS 13 Ventura or later, on Apple Silicon or Intel
Windows
Installer signed with Microsoft Trusted Signing. Run it and follow the prompts.
Windows 10 or 11, 64-bit (x64)
Updates when you choose
The app tells you when a new release is available and installs it when you choose. You can also turn on automatic installs in Settings. Every version is listed on GitHub Releases.
Questions, answered
Desktop app FAQ
How does licensing work?
You buy a Pro or MSP subscription and receive a license key by email. Paste the key into the app after signing in. The app activates the key for the tenant you signed in to and stores a signed license token on your machine. Colleagues can share an organization license: once a key holder shares it with a tenant, anyone who signs in to that tenant's Intune Documentation app registration is licensed without a key. A Pro license is shared with its tenant by default; an MSP key holder turns sharing on per customer tenant. Every plan comes with a 30-day money-back guarantee: if you are not satisfied, email support within 30 days of your first payment for a full refund. Subscriptions renew until you cancel.
Can I use the app offline?
Yes. Collection and export only need to reach Microsoft Graph. The app checks your license with our service regularly while online, and if the service is unreachable it keeps working for 14 days after the last successful check.
What data is sent to your servers?
License checks send the license key and a short-lived Microsoft sign-in token (for an organization license, the token alone). We verify its signature with Microsoft, use only its tenant ID and app registration ID, and never store it. License checks also send a random installation ID, your Entra tenant ID, the operating system, the app version, and, when you use a key, the client ID of your app registration. Update checks request the latest version from our update service with a random update identifier and standard request data such as your IP address; you can turn automatic update checks off in Settings. Tenant configuration, Microsoft access tokens, and exported documents never leave your machine, and Graph calls go directly from the app to Microsoft.
How many tenants and installations are included?
Pro covers 1 tenant and up to 5 installations for that tenant. MSP covers 10 tenants by default, or the tenant count you purchase, with up to 5 installations per tenant. You can free an installation from the app or the customer portal.
Why do I need my own app registration?
Because the app never connects through us. You create the app registration in your own Microsoft tenant, which is free and needs no Azure subscription, so you own it, you control consent, permissions, and Conditional Access, and you can delete it at any time. We never get an app, an account, or any access in your tenant. In Entra it uses the platform type called Mobile and desktop applications, which is a different registration from the one the web version uses. The getting started guide walks through every step.
What are the system requirements?
macOS: macOS 13 Ventura or later, on Apple Silicon or Intel. Windows: Windows 10 or 11, 64-bit (x64). The machine needs internet access to Microsoft Graph for collection.
Are the installers signed?
Yes. The macOS app is signed with an Apple Developer ID and notarized by Apple. The Windows installer is signed with Microsoft Trusted Signing under Ugurlabs UG (haftungsbeschränkt). The app verifies the same signature before it installs an update.
How do I cancel or change my plan?
Manage your subscription, invoices, and tenant count in the Polar customer portal. Cancellation takes effect at the end of the current billing period, and the app stays licensed until then. Polar is our merchant of record and handles payments, taxes, and invoices.
How do I get support, and who builds the app?
Email support@ugurlabs.com or use the support page. The app is built by Ugurlabs UG (haftungsbeschränkt), the company behind the free Intune Documentation web version, which is open source on GitHub.
Ready in about 10 minutes
Set up your app registration and export your first report.
The guide walks through the Entra app registration, the nine read-only Graph permissions, and license activation.