Runbook Release Notes
Stay up to date with the latest changes to the RealmJoin Runbooks. Runbook updates are typically published here in monthly release cycles.
v2026.08
Adds scheduled Microsoft 365 service health monitoring and focuses on safer bulk operations — refined MFA-group syncing with admin and break-glass exclusions, multi-delegate mailbox access, and more granular out-of-office control.
Changes
➕
org
general
Monitor Service Health (Scheduled)
Keeps an eye on the Microsoft 365 service health of your tenant on a schedule, so incidents and advisories affecting your services are noticed without having to watch the admin center.
Results can be delivered as a summary email report, with the sender taken from the RJReport.EmailSender tenant setting.
The report can be limited to selected services (e.g. Exchange, SharePoint, Teams) and optionally include historical service health data.
✏️
org
devices
Notify Users About Stale Devices (Scheduled)
Adds optional override routing so stale devices without a primary user are gathered into a single summary email to a chosen recipient instead of being skipped, while everyone else is still notified directly.
A new name-pattern option (e.g. DEM-*) lets you redirect notifications for special accounts such as Device Enrollment Manager users to the same override recipient.
✏️
org
security
Sync MFA Secure Users To Group (Scheduled)
Admins are now excluded from the synced group by default: people holding an Entra ID directory role are never added and are removed if already present — useful when the group drives self-service password reset. Adds flexible exclusions via a dedicated exclusion group and individually picked users (e.g. break-glass or service accounts), and the report now shows an exclusion reason per user. Note: the managed identity needs an additional Graph permission, and with admin exclusion on by default existing admins are removed on the next run — review your schedules if that isn't intended.
✏️
user
Delegate Full Access
You can now grant or remove Exchange Online Full Access for several delegates in one run via a multi-user picker, applying the same action and automapping setting to all of them. Delegates without a mailbox are skipped instead of aborting the run, already-granted or already-removed permissions are treated as no-ops, and you get a per-delegate summary of what changed, stayed the same, failed or was skipped.
✏️
user
Set Out Of Office
Adds control over who receives the external automatic reply (nobody, known contacts only, or everyone). Shows the current auto-reply configuration before making changes and gives clearer, step-by-step status and error messages.
General Changes
The required Microsoft.Graph.Authentication PowerShell module was updated to version 2.39.0 across all runbooks that use the Microsoft Graph PowerShell modules (40 runbooks) to address S360 open-source vulnerability findings (SFI-ES5.2).
Previous releases
v2026.07.01
Intermediate patch release: rolls out a new dependency-free Excel report writer across all report runbooks (with flexible CSV/XLSX delivery and download links) and adds new runbooks for Global Secure Access, MAM app-data wipe, membership synchronization and MFA-secure user grouping.
Changes
➕
device
general
Wipe Managed App Data
Removes company data from apps protected by app protection policies (MAM) on a device, without wiping the whole device — mirroring the Intune "App selective wipe" flow. Ideal for lost or stolen devices that are managed only through app protection policies. Wipe requests can be tracked and cancelled in the Intune portal.
➕
org
applications
Add GSA Application Registration
Creates a Global Secure Access application (Enterprise App or Quick Access App), assigns a connector group and adds an application segment (FQDN, IP, CIDR or IP range). Automatically creates a matching security group following a configurable naming scheme and assigns it to the app. Includes pre-flight validation, an update mode to add further segments, and automatic rollback if a run fails.
➕
org
applications
Delete GSA Application Registration
Removes a Global Secure Access application by display name, together with its naming-scheme security group, after confirming the target really is a GSA / App Proxy application. Any other assigned groups are listed but only removed when explicitly confirmed.
➕
org
general
Sync Channel Or Group Members
Keeps membership in sync in one direction — shared channel members into a security group, group members into another group, or group members into a shared channel. Missing members are always added; removing extra members in the target is opt-in. Supports transitive group expansion, guest handling and a dry-run mode, with an optional email report and download link. Change reports are also delivered as an Excel workbook.
➕
org
security
Sync MFA Secure Users To Group (Scheduled)
Keeps an Entra ID group in sync with all users that have at least one "secure" MFA method registered (e.g. passkeys/FIDO2, Windows Hello / Secure Enclave, Authenticator app, OTP or certificate-based). Which methods count as secure is configurable via toggles; an optional strict mode excludes anyone who also has an unsecure method (phone, email, security questions). Offers an optional email report and download link, with results delivered as CSV and a formatted Excel workbook showing added/removed users and the per-user method evaluation.
✏️
device
general
Wipe Device
The Microsoft Defender for Endpoint risk check now runs as an upfront preflight check: when the device's risk score is Medium or High the wipe is aborted with a clear warning, protecting forensic data on devices that may be part of a security incident. Adds an optional switch to place a (Windows) device into the compliance exclusion group after the wipe, giving it a longer compliance grace period once it re-enrolls via Autopilot. The exclusion group is validated up front, so a run aborts safely before any destructive action if it is missing.
✏️
org
devices
Auto Approve Driver Updates (Scheduled)
Now produces a detailed driver approval report (policy, driver name, version, manufacturer, driver class, release date and per-driver outcome) as a CSV/Excel attachment and download. The per-policy driver lists in the email body are capped at 15 entries with a pointer to the full attached report.
✏️
org
devices
Delete Stale Devices (Scheduled)
Simplifies deletion control to a single setting with a clear choice between a report-only simulation (default, safe for scheduled runs) and actually deleting stale devices from Intune.
The report now reflects the real per-device outcome (Deleted/Failed) and adopts the standard email reporting with CSV and a formatted Excel workbook, plus an optional storage download link.
Adds optional user-scope filtering based on primary-user group membership.
Note: parameters changed (the old ConfirmDeletion / sendAlertTo / sendAlertFrom were replaced) — existing schedules and customizations should be reviewed.
✏️
org
devices
Report Devices Without Primary User (Scheduled)
Now available as a scheduled runbook. Adds the device operating system to the output, CSV and email report, and platform filters to limit the report to selected platforms (all included by default). Adds an optional storage download link for the report.
✏️
org
devices
Report Users With More Than 5 Devices (Scheduled)
Now available as a scheduled runbook. The detailed report gains the device display name, clearer device-ID columns, an "InIntune" indicator and a new "Compliant" column (yes/no/unknown), with an option to limit the report to devices present in Intune. Summary and details are delivered as a single Excel workbook (green/red highlighting for InIntune and Compliant), with an optional storage download link.
✏️
org
devices
Report Windows Devices Without Autopilot (Scheduled)
Can now run as a scheduled runbook.
✏️
user
general
List Group Memberships
Adds optional email delivery of the result as a CSV attachment and an optional time-limited download link. The report is now also delivered as a formatted Excel workbook.
✏️
user
general
List Group Ownerships
Adds optional email delivery of the result as a CSV attachment and an optional time-limited download link. The report is now also delivered as a formatted Excel workbook.
General Changes
A new dependency-free Excel (xlsx) report writer (Export-RjRbXlsx, pure .NET — no additional PowerShell modules required) was introduced and rolled out across all modern report runbooks (19 in total). Highlights of the rollout:
Every affected report now delivers its data as CSV and/or a RealmJoin-branded, formatted Excel workbook (typed and sortable cells, conditional highlighting, in-cell data bars, clickable links, an optional "Info" cover worksheet, and one worksheet per result set for multi-result reports).
A new report file-format selection (CSV only / CSV & XLSX / XLSX only, default CSV & XLSX) controls which files are generated, attached to the report email and uploaded to storage.
Every report email gained an attachment size guard (new inline helper
Send-RjRbGuardedReportEmail) that automatically falls back to the Excel workbook alone when the attachments exceed the ~4 MB Graph sendMail limit, with a retry safety net.Several reports that previously only supported email delivery gained a storage download-link option (
CreateDownloadLink): Report EPM Elevation Requests, Monitor Pending EPM Requests, Report License Assignment, Report Application Registration, Report Expiring Application Credentials, Cleanup Autopilot Devices, Report Stale Devices and Report Primary User Mismatch.Export Enterprise Application Users gained an email report option for the first time (previously storage-only), and List Inactive Enterprise Applications now delivers its results via email and/or download link (previously console output only). Affected runbooks: Export Enterprise Application Users (Org/Applications), List Inactive Enterprise Applications (Org/Applications), Report Application Registration (Org/Applications), Report Expiring Application Credentials (Scheduled) (Org/Applications), Auto Approve Driver Updates (Scheduled) (Org/Devices), Cleanup Autopilot Devices (Scheduled) (Org/Devices), Report Devices Without Primary User (Scheduled) (Org/Devices), Report Primary User Mismatch (Scheduled) (Org/Devices), Report Stale Devices (Scheduled) (Org/Devices), Report Users With More Than 5 Devices (Scheduled) (Org/Devices), Report Windows Devices Without Autopilot (Scheduled) (Org/Devices), Report License Assignment (Scheduled) (Org/General), Sync Channel Or Group Members (Scheduled) (Org/General), Sync Shared Channel Owners (Scheduled) (Org/General), Monitor Pending EPM Requests (Scheduled) (Org/Security), Report EPM Elevation Requests (Scheduled) (Org/Security), Sync MFA Secure Users To Group (Scheduled) (Org/Security), List Group Memberships (User/General), List Group Ownerships (User/General).
v2026.07
This release strengthens device security and Defender for Endpoint integration, automates Autopilot cleanup, and adds Exchange Online contact management — backed by module updates and improved notification emails.
Changes
➕
device
security
Check Defender Status
Compares a device between Entra ID and Microsoft Defender for Endpoint using its Entra device ID. Reports whether the device is present in both systems, its onboarding and health state, and its Defender risk score.
➕
org
devices
Cleanup Autopilot Devices (Scheduled)
Identifies and removes orphaned or never-enrolled Autopilot devices based on configurable criteria, with optional email reporting of the results.
Can optionally also delete the matching Entra ID device objects to keep the directory clean.
Supports filtering by Manufacturer and Model to target specific device types.
Designed to run on a schedule for ongoing inventory maintenance.
➕
org
Add Exchange Online Mail Contact
Creates an Exchange Online external mail contact, validating the email address format and checking for duplicate contacts, aliases, and display names before creation. Optionally sets first name, last name, and alias, and can hide the contact from the Global Address List.
✏️
device
general
Wipe Device
Adds an optional skipWipeIfAtRisk setting (off by default): when enabled, the wipe only runs if the device's Microsoft Defender for Endpoint risk score is not Medium or High.
This protects forensic data (e.g. logs) on devices potentially involved in a security incident from being destroyed.
Requires the new Defender for Endpoint permission Machine.Read.All.
✏️
org
devices
Report Primary User Mismatch (Scheduled)
Can now optionally include devices whose Intune primary user has been deleted from Entra ID in the report (off by default).
✏️
user
userinfo
Add User
Now supports setting the new user's sponsor during creation.
General Changes
Updated the
RealmJoin.RunbookHelpermodule to >= 0.8.7 across all runbooks. This version adds new functions for password/key vault handling and further improves the email-sending function, including better Outlook Classic compatibility. Each affected runbook's internal$Versionwas incremented by one patch level.Updated the
Microsoft.Graph.Authenticationmodule to >= 2.38.0 across all affected runbooks.Improved notification emails across all email-sending runbooks: a localized "do not reply" footer was added, plus two optional, hidden-by-default parameters for runbooks that include Service Desk contact information —
ServiceDeskPortalUrl(sourced from the RJReport tenant settingRJReport.ServiceDesk_PortalUrl) andServiceDeskTicketUrl(a direct link to the related ticket). When set, each is rendered as a clickable link. Affected runbooks: Reset MFA, List MFA Methods, Set or Remove Mobile Phone MFA, Create Temporary Access Pass (User/Security) and Notify Users About Stale Devices (Scheduled) (Org/Devices).
v2026.06.01
This patch centers on the reworked
RealmJoin.RunbookHelperemail engine — extensive improvements to report mailing (image embedding and Outlook Classic compatibility) rolled out across all runbooks — plus a fix for out-of-memory failures on large Intune tenants.
Changes
➕
org
devices
Report Windows Devices Without Autopilot
Lists all Windows Entra device objects that have no associated Windows Autopilot object, so you can spot devices missing from Autopilot enrollment.
Matching is done via the Autopilot object's Azure AD device ID (azureActiveDirectoryDeviceId).
➕
org
devices
Report Primary User Mismatch (Scheduled)
Compares the primary user recorded in Intune against the primary user recorded in the RealmJoin customer API for Windows managed devices, flags every device where the two differ, and emails the differences with a CSV attachment on a scheduled basis.
➕
org
general
Sync Shared Channel Owners (Scheduled)
Keeps the members of a mapped security group as owners of selected Teams and of every shared channel those teams host (shared channels do not inherit ownership from their parent team).
Teams are matched by exact display name; the team-name-to-owner-group mapping is maintained centrally via the SharedChannelOwners.Mapping org setting.
Add-only — existing owners and members are never removed — with a WhatIfMode dry run.
Optional email report and/or storage download link, each with per-team and per-change CSV output (both off by default).
✏️
device
general
Outphase Device
Can now optionally exclude a device from Microsoft Defender for Endpoint remediation by applying a configurable exclusion tag (default ExcludeFromRemediation); opt-in and off by default.
Requires the new Defender for Endpoint permissions Machine.Read.All and Machine.ReadWrite.All.
✏️
org
devices
Outphase Devices
Adds the same optional Microsoft Defender for Endpoint exclusion tagging as the single-device runbook, applied to every device in the list (opt-in, off by default).
Requires the new Defender for Endpoint permissions Machine.Read.All and Machine.ReadWrite.All.
✏️
org
general
Check Device Onboarding Exclusion (Scheduled)
Fixes out-of-memory failures on tenants with large Intune inventories — managed devices are now filtered server-side instead of loading the full inventory into memory. Migrated to native Microsoft Graph for better reliability.
General Changes
Updated the
RealmJoin.RunbookHelpermodule to >= 0.8.6 across every runbook that uses it. This version ships an extensive rework of the email-sending function around image embedding and Outlook Classic compatibility. As part of this change, the inlinePublish-RjRbFilesToStorageContainerhelper function was removed from two runbooks (now provided by the module): Export Enterprise Application Users (Org/Applications) and Office 365 License Report (Org/General).Updated the
Microsoft.Graph.Authenticationmodule to >= 2.37.0 across all runbooks that use it.
v2026.06
This release focuses on user security and MFA management, introducing a new runbook for listing authentication methods and adding optional user notification emails across multiple MFA-related runbooks. Additional improvements cover archive mailbox management, guest user invitations, and several reliability fixes.
Changes
➕
user
Manage Archive Mailbox
Enables, disables, or retrieves the current status of the in-place archive mailbox for an Exchange Online user. When enabling, automatically reconnects a soft-deleted archive mailbox (within the 30-day recovery window) instead of creating a new one. The disable action includes a note confirming that the archive can be recovered within 30 days.
➕
user
security
List MFA Methods
Lists all Microsoft Entra ID MFA and authentication methods registered for a target user. Phone numbers can optionally be masked to show only the last 4 digits (default off, setting hidden). Optionally sends a notification email to the user when an administrator retrieves their MFA methods (default off, setting hidden). The notification email language is auto-detected via usage location, with an override parameter to force German or English.
✏️
org
general
Invite External Guest Users
Added a sponsor assignment parameter. Manager and sponsor are now shown by UPN instead of object ID in the summary, improving readability. Added support for a customized email invitation message and a configurable invite redirection URL.
✏️
org
general
Report Apple MDM Cert Expiry (Scheduled)
Fixed an issue where VPP tokens were silently dropped from the report due to a faulty paged-result check. Applied the same fix to DEP onboarding settings, which used the same faulty check. The email report is now only sent when at least one alert is detected, avoiding unnecessary notifications when everything is in order.
✏️
org
Add Shared Mailbox
Added a time zone selection parameter with predefined options and a default value, allowing the shared mailbox time zone to be configured directly during creation.
✏️
user
security
Reset MFA
Added an optional NotifyUser parameter that sends a notification email to the target user when an administrator resets their MFA methods (default off, setting hidden).
Email configuration (sender address, service desk display name, email, and phone number) is sourced from RJ tenant settings and hidden by default.
Email language is auto-detected via usage location, with a LanguageOverride parameter to force German or English.
Added a StatusQuo section that resolves the user's display name, primary email, and usage location before execution.
✏️
user
security
Set Or Remove Mobile Phone MFA
Added an optional NotifyUser parameter that sends a notification email to the target user when an administrator adds or removes their mobile phone MFA method (default off, setting hidden).
Email configuration (sender address, service desk display name, email, and phone number) is sourced from RJ tenant settings and hidden by default.
Email language is auto-detected via usage location, with a LanguageOverride parameter to force German or English.
The notification email text distinguishes between add and remove actions.
✏️
user
userinfo
Update User
Added support for updating the user's manager directly from within the runbook.
General Changes
PSScriptAnalyzer improvements across 6 runbooks — Internal code quality fixes with no functional impact for end users. Includes removal of unused parameters, replacement of empty try/catch blocks, and suppression of false positive warnings. Affected runbooks:
org/applications— Export Enterprise Application Usersorg/devices— Create Endpoint Analytics Baseline (Scheduled)org/general— Assign Groups By Template (Scheduled), Export Policy Report, Office 365 License Reportorg/security— List Admin Users
v2026.05
This release introduces automated duplicate device name resolution for Intune environments, alongside targeted improvements to license reporting, guest user invitations, and policy export reliability.
Changes
➕
org
devices
Dedup Device Names (Scheduled)
Automatically detects and resolves duplicate device names in Intune on a scheduled basis. The most recently enrolled duplicate is renamed using a configurable prefix and a random digit suffix; resolved names are synced back to Autopilot. Supports an OS filter parameter (All / Windows / macOS / Other) and skips personal-owned devices and unsupported platforms with warnings. Checks for pending rename actions before queuing to avoid issuing duplicate MDM commands.
✏️
org
applications
Export Enterprise Application Users
Updated the internal export function to the enhanced version introduced in the Office 365 License Report runbook, aligning export behaviour and capabilities across both runbooks.
✏️
device
general
Enroll Updatable Assets
Added an All option to the UpdateCategory parameter, which sequentially enrolls devices into Driver, Feature, and Quality updates in a single run — removing the need to execute the runbook separately for each update category.
Script restructured with proper regions and parameter logging for improved maintainability.
✏️
org
general
Export Policy Report
Improved pagination handling by replacing static $top=1000 Graph API calls with Get-GraphPagedResult to ensure complete results in large tenants.
Added logging of the retrieved policy count per policy type for better transparency during execution.
✏️
org
general
Invite External Guest Users
Added new parameters: Given Name, Surname, Manager, Usage Location, and Company. Display name is now automatically generated from the given name and surname if no explicit display name is provided, reducing manual input for standard guest invitations.
✏️
org
general
Office 365 License Report
Added an includeUserData parameter that optionally includes real user UPNs in Graph activity reports by temporarily disabling the Microsoft 365 report privacy setting during execution.
Note: the additional ReportSettings.ReadWrite.All permission is only required when includeUserData is enabled — tenants using this feature should update their permission assignments accordingly.
Script fully restructured with proper regions, parameter logging, and enhanced error handling.
v2026.04.01
Patch release with three new runbooks for device and endpoint management, significant improvements to phone MFA handling for guest users, targeted bug fixes in the security domain, and a broad internal code quality pass across 25 runbooks.
Changes
➕
device
security
Show FileVault Recovery Key
Retrieves and displays the FileVault recovery key for a specified Mac device directly from Intune. Provides a quick lookup for administrators without requiring manual navigation through the Intune portal.
➕
device
general
Assign Groups By Template
Adds a device to one or more Entra ID groups using either group object IDs or display names. Enables structured, template-based group assignments for devices without requiring manual portal interaction.
➕
org
devices
Create Endpoint Analytics Baseline (Scheduled)
Creates a new Endpoint Analytics Baseline in Microsoft Intune on a scheduled basis. The naming schema is configurable via runbook parameters, e.g. to include a timestamp for better tracking of baseline versions over time.
✏️
org
security
Find SMS Auth Phone Number
Added dynamic progress reporting based on total user count, making batch processing output more informative in large tenants. Updated the "not found" message to indicate that soft-deleted user accounts may still hold a phone number reservation — helping administrators investigate cases where no active user is identified.
✏️
org
security
Add Defender Indicator
Fixed a logic issue in alert handling that could cause incorrect behavior when processing indicator responses. Fixed the severity parameter not being passed correctly to the Microsoft Defender API. Optimized runbook output to provide clearer information about the created indicator and its current status.
✏️
org
security
Notify Changed CA Policies
Optimized runbook output for improved readability and clarity of reported policy changes.
✏️
user
security
Set Or Remove Mobile Phone MFA
Switched from UPN-based to Object ID-based user identification, fixing 404 errors that occurred for guest users.
The runbook now displays the user's UPN, display name, and guest status after connecting, as well as the current phone number and SMS Sign-In state before any changes are made.
Restructured error handling for Graph API 409 Conflict ("phoneNumberNotUnique") errors: the runbook now suppresses the error, waits, verifies the actual MFA assignment state, and reports success with a conflict note if MFA was successfully assigned despite the SMS Sign-In conflict.
Added an embedded Find-PhoneNumberOwner function that searches for the user holding a phone number when MFA assignment truly fails, enabling administrators to identify and resolve conflicts directly.
✏️
user
general
Resize Windows 365
Fixed an issue where the fromMailAddress parameter was not being passed to the API, which could result in notification emails being sent without a valid sender address.
General Changes
Code quality improvements across 25 runbooks — Internal PSScriptAnalyzer fixes to improve code consistency and static analysis compliance. These changes have no functional impact for end users. Improvements include suppression of false positive warnings, renaming of internal functions to use approved PowerShell verbs, and singular naming corrections. Affected runbooks:
device/security— Show LAPS Passworddevice/general— Enroll Updatable Assets, Unenroll Updatable Assetsgroup/devices— Unenroll Updatable Assets (Scheduled)org/applications— Add Application Registration, Report Expiring Application Credentials (Scheduled), Update Application Registrationorg/devices— Outphase Devicesorg/general— Add Devices Of Users To Group (Scheduled), Add Primary Users Of Devices To Group (Scheduled), Add Security Group, Add Viva Engage Community, Assign Groups By Template (Scheduled), Check Assignments Of Devices, Check Assignments Of Users, Export CloudPC Usage (Scheduled), Export Policy Report, Office365 License Reportorg/phone— Get Teams Phone Number Assignmentorg/security— Backup Conditional Access Policiesuser/general— Assign Groups By Templateuser/phone— Disable Teams Phone, Get Teams User Info, Set Teams Permanent Call Forwardinguser/userinfo— Update User
Minor fixes — Removed an unused parameter from an internal function in Add Security Group (org/general); simplified the internal Save-ToDataTable function in Export CloudPC Usage (Scheduled) (org/general); fixed a typo in Office 365 License Report (org/general).
v2026.04
This release expands automation coverage with new runbooks for device management, compliance checking, and security, alongside reliability improvements across a broad set of existing runbooks.
Changes
➕
device
general
Set Primary User
Sets or changes the primary user of a device in Intune. Ensures accurate device ownership for reporting and device management purposes.
➕
group
general
Add Primary Users Of Devices To Group (Scheduled)
Automatically adds the primary users of devices to a designated group on a scheduled basis. Devices can be filtered by platform and last activity date to target only relevant devices.
➕
org
devices
Auto Approve Driver Updates (Scheduled)
Automatically approves pending driver updates in Intune based on configurable criteria such as device category and driver update class. Reduces manual effort for routine driver update approvals in managed environments.
➕
org
devices
Check Device Compliance
Checks the compliance status of devices in Intune and identifies the specific reason for any non-compliant status. Useful for targeted troubleshooting and compliance reporting without requiring manual inspection in the Intune portal.
➕
org
general
Sync Apple Tokens
Synchronizes Apple MDM push notification tokens between Intune and the Apple Push Notification Service (APNS). Ensures that managed Apple devices continue to receive timely updates and push notifications.
➕
org
security
Find SMS Auth Phone Number
Searches for which user has a specific phone number registered as an SMS Sign-In or phone MFA method in Microsoft Entra ID. Designed to help administrators resolve "phoneNumberNotUnique" errors by identifying the conflicting account.
✏️
org
applications
Export Enterprise Application Users
Added a generalized export function for Azure Storage Account. Simplifies configuration when exporting user data to storage and aligns the export logic with other runbooks in this category.
✏️
org
applications
Update Application Registration
The updated list of redirect URIs is now included in the runbook output after changes are applied. Provides immediate visibility into the current state of the registration without requiring a separate lookup.
✏️
user
security
Create Temporary Access Pass
Added parameter validation to ensure the pass duration falls within acceptable limits before execution. Added optional email notification when a Temporary Access Pass is created, configurable via Runbook Customization parameters. The notification language is automatically selected based on the user's usage location — German for users located in Germany, English otherwise.
✏️
user
security
Set Or Remove Mobile Phone MFA
Added detection and reporting for "phoneNumberNotUnique" errors, which occur when the target phone number is already registered for SMS Sign-In by another user. Migrated all API calls to native Microsoft Graph API. Pagination reliability improved as part of the broader Get-GraphPagedResult update (see General Changes).
General Changes
Pagination fix across 14 runbooks — Replaced the previous custom pagination function with the simplified Get-GraphPagedResult function to improve reliability and consistency when handling large data sets. Without this fix, some runbooks could return incomplete results in large tenants. Affected runbooks:
org/applications— Report Application Registration, Report Expiring Application Credentials (Scheduled)org/devices— Notify Users About Stale Devices (Scheduled), Report Devices Without Primary User, Report Stale Devices (Scheduled), Report Users With More Than 5 Devicesorg/general— Add Primary Users Of Devices To Group (Scheduled), Report Apple MDM Cert Expiry (Scheduled), Report License Assignment (Scheduled)org/security— Find SMS Auth Phone Number, List Admin Users, Monitor Pending EPM Requests (Scheduled), Report EPM Elevation Requests (Scheduled)user/security— Set Or Remove Mobile Phone MFA
v2026.03
This release introduces two new Endpoint Privilege Management runbooks for org/security, expands stale device management with proactive user notifications, and brings significant usability improvements across reporting and assignment runbooks. A complete documentation overhaul across all runbooks improves clarity and onboarding for new administrators.
Changes
➕
device
security
Show Bitlocker Recovery Key
Retrieves and displays the BitLocker recovery key for a specified device directly from Intune. Provides a quick way to look up recovery keys without navigating through the Intune portal manually.
➕
org
devices
Notify Users About Stale Devices (Scheduled)
Sends email notifications to users whose devices have been inactive beyond a configurable threshold, based on last activity date and platform.
Supports English, German, and fully customizable mail templates.
Complements the existing Report Stale Devices (Scheduled) runbook by proactively notifying users rather than just generating reports for administrators.
➕
org
security
Monitor Pending EPM Requests (Scheduled)
Monitors pending Endpoint Privilege Management (EPM) elevation requests that require admin review. Sends email notifications only when pending requests are present, avoiding unnecessary noise. Includes an optional detailed CSV export for audit purposes.
➕
org
security
Report EPM Elevation Requests (Scheduled)
Generates reports on EPM elevation requests with flexible filtering by status (Pending, Approved, Denied, Expired, Revoked, Completed) and configurable time range. Designed to support regular EPM audit workflows and compliance reporting.
✏️
group
general
Unenroll Updatable Assets (Scheduled)
Renamed from Unenroll Updatable Assets to reflect the scheduled execution model.
Added an option to include user-owned devices in the unenrollment process, enabling more comprehensive management of updatable assets beyond corporate-owned devices.
✏️
org
devices
Export All Intune Devices
Fixed an issue where devices with missing or incomplete primary user data caused export errors. Added group-based filtering with a group picker, allowing exports to be scoped to members of a specific group — particularly useful in large tenants where exporting all devices is not practical.
✏️
org
devices
Report Stale Devices (Scheduled)
Added Include/Exclude User Groups filtering, allowing administrators to focus the report on devices belonging to specific user groups or explicitly exclude certain groups from the results.
✏️
org
general
Check Assignments Of Groups
Added a multi-group picker, enabling administrators to process multiple groups in a single run instead of executing the runbook separately for each group.
✏️
org
general
Check Assignments Of Users
Added a multi-user picker, enabling administrators to process multiple users in a single run. Added required permissions for app assignment checks to the runbook documentation.
✏️
org
security
List Admin Users
The runbook output and CSV export now include PIM role assignment status (permanent vs. eligible) and the expiration date for eligible assignments. Provides a more complete picture of privileged access without requiring a separate PIM report.
✏️
user
Assign OWA Mailbox Policy
Added three new policy options to the selection:
OwaMailboxPolicy-NoSignatures — for users who should not have email signatures in OWA
BookingsCreators — for users who create Bookings appointments and need the corresponding add-in enabled
GetCurrent — assigns the currently active policy for the user
➖
org
devices
Report Last Device Contact by Range
Removed — functionality is now fully covered by the updated Report Stale Devices (Scheduled) runbook, which includes enhanced filtering options that supersede this runbook's capabilities.
General Changes
Documentation overhaul across all runbooks — Comprehensive rewrite of comment-based help in every runbook, including more detailed descriptions of functionality and parameters, clearer instructions for required permissions and setup steps, and improved formatting for better readability. This is particularly relevant for administrators onboarding new runbooks or setting up automation for the first time.
Application Registration runbooks — permission tightening — The required app role Application.ReadWrite.All has been replaced with the more restrictive Application.ReadWrite.OwnedBy, and Directory.ReadWrite.All has been removed as it is no longer required. Tenants using these runbooks should update their permission assignments accordingly to follow the principle of least privilege.
Prefer a different view? Browse these notes on the GitHub Releases page of the runbooks repository.
Looking for a more detailed, dated log of every individual runbook change? See the full changelog in the runbooks repository.
Last updated
Was this helpful?