Getting started with the desktop app

Download the newest installer for your platform.

• macOS: choose Apple Silicon for M-series Macs or Intel for older Macs. Open the DMG and drag Intune Documentation to your Applications folder.
• Windows: run the Setup installer and follow the prompts. It installs for the current user.

The app tells you when an update is available and installs it when you choose. To install updates without asking, turn on Install updates automatically in Settings.

Older versions and release notes are on GitHub Releases.

1. Open the Microsoft Entra admin center and go to Entra ID, then App registrations.
2. Select New registration and give it a name, for example Intune Documentation Desktop.
3. Under Supported account types, choose Accounts in this organizational directory only (single tenant).
4. Leave Redirect URI empty and select Register. You add it in the next step.

1. In the new registration, open Authentication.
2. Select Add a platform (in the newer view, Add Redirect URI) and choose Mobile and desktop applications.
3. Enter this custom redirect URI exactly, with no port and no trailing slash: http://localhost
4. Select Configure.
5. Leave Allow public client flows at No. The app does not need it.

Open API permissions, select Add a permission, choose Microsoft Graph, then Delegated permissions. Add all nine permissions below. Every one is read-only.

Choose Delegated permissions, not Application permissions. The app reads only what the signed-in admin is allowed to see.

Still on API permissions, select Grant admin consent for your tenant and confirm. Every permission should show a green Granted status.

A Global Administrator, Privileged Role Administrator, or Cloud Application Administrator can grant tenant-wide consent for these delegated permissions. Without consent, sign-in fails with AADSTS65001.

1. Open the registration's Overview page.
2. In the app's setup wizard, paste Application (client) ID and Directory (tenant) ID into the fields with the same names.
3. Select Save and continue.

Both values are GUIDs in the form 00000000-0000-0000-0000-000000000000. Neither is a secret, and no client secret is needed.

Select Sign in with Microsoft. Your default browser opens the Microsoft sign-in page. Sign in, then return to the app. The wizard then checks that all nine permissions were granted.

The app sees only what the signed-in account can read. Security Reader or Global Reader each cover everything the app reads. Intune roles such as Intune Administrator or Read Only Operator cannot read Conditional Access policies, so pair them with Security Reader.

Your Microsoft access tokens stay on this machine. The app calls Microsoft Graph directly.

Paste your license key into the last wizard step, or later under License and account. You find the key in the customer portal. The app activates it for the tenant you signed into and stores the license token encrypted with your operating system keychain.

Each license check sends your license key (or, for a shared license, your Microsoft sign-in token), a random installation ID, and your tenant ID. We check the sign-in token, read only its tenant ID, and never store it.

No key yet? Start a 30-day free trial. Manage your subscription in the customer portal.

On the Overview screen, select Collect to read your Intune configuration. When collection finishes, the app reports any sections it could not read.

Then select Export documentation, choose PDF report or Word document (.docx), and select Start export. Files are saved wherever you choose on your machine.

For audit evidence, open Compliance Evidence in the sidebar, pick a framework, and download its evidence report. Collect again whenever your configuration changes, so your documentation stays current.