Microsoft Commercial Cloud

​

Cloud Endpoints

​

Implementation Details

CloudEnvironment.Commercial => 
  ("https://graph.microsoft.com/beta", AzureAuthorityHosts.AzurePublicCloud)

• Authority URI: https://login.microsoftonline.com

​

App Registration

​

Prerequisites

• Global Administrator or Application Administrator role in Entra ID
• Access to the Azure Portal: https://portal.azure.com

​

Registration Steps

​

1. Create App Registration

1. Sign in to the Azure Portal
2. Navigate to Entra ID > App registrations > New registration
3. Configure the registration:
   • Name: Intune Commander (or your preferred name)
   • Supported account types: Accounts in this organizational directory only (single tenant)
   • Redirect URI:
     • Platform: Mobile and desktop applications
     • URI: http://localhost:45132
   • Click Register

​

2. Note Registration Details

• Application (client) ID - Found on the Overview page
• Directory (tenant) ID - Found on the Overview page

​

3. Configure API Permissions

DeviceManagementConfiguration.ReadWrite.All
DeviceManagementApps.ReadWrite.All
DeviceManagementServiceConfig.ReadWrite.All
DeviceManagementManagedDevices.Read.All
DeviceManagementRBAC.ReadWrite.All
DeviceManagementScripts.ReadWrite.All

Policy.ReadWrite.ConditionalAccess
Policy.Read.All
Agreement.ReadWrite.All

Organization.Read.All
OrganizationalBranding.ReadWrite.All

Group.Read.All
GroupMember.Read.All

CloudPC.ReadWrite.All

​

4. Grant Admin Consent

1. Still on the API permissions page
2. Click Grant admin consent for [Your Organization]
3. Click Yes to confirm
4. Verify all permissions show a green checkmark in the Status column

​

5. (Optional) Configure Client Secret

1. Navigate to Certificates & secrets
2. Click New client secret
3. Add a description: Intune Commander Service Principal
4. Select expiration: 6 months, 12 months, or 24 months (recommended: 12 months)
5. Click Add
6. Immediately copy the secret value - it will not be shown again

​

Authentication Methods

​

Interactive Browser (Default)

• Auth Method: Interactive
• Client Secret: (leave blank)

• Opens browser window for authentication
• Supports MFA, Conditional Access, and all Entra ID features
• Token cached locally for persistent sessions
• Tokens automatically refresh

• Windows: %LocalAppData%\.IdentityService\msal.cache
• macOS: ~/.IdentityService/msal.cache
• Linux: ~/.IdentityService/msal.cache

var credential = new InteractiveBrowserCredential(
    new InteractiveBrowserCredentialOptions
    {
        TenantId = profile.TenantId,
        ClientId = profile.ClientId,
        AuthorityHost = authorityHost,
        RedirectUri = new Uri("http://localhost:45132")
    }
);

​

Client Secret (Service Principal)

• Auth Method: ClientSecret
• Client Secret: (paste the secret value from app registration)

• No user interaction required
• Authenticates as the application identity
• All operations logged as the app (not a user)
• Secrets are encrypted and stored in the profile file

var credential = new ClientSecretCredential(
    profile.TenantId,
    profile.ClientId,
    profile.ClientSecret,
    new ClientSecretCredentialOptions
    {
        AuthorityHost = authorityHost
    }
);

​

Profile Configuration

​

Creating a Profile

1. Launch Intune Commander
2. Fill in the profile details:
   • Profile Name: Contoso-Production (friendly name for this tenant)
   • Tenant ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
   • Client ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
   • Cloud: Commercial
   • Auth Method: Interactive or ClientSecret
   • Client Secret: (if using ClientSecret auth method)
3. Click Save Profile
4. Profile is encrypted and saved to local storage

• Windows: %LocalAppData%\Intune.Commander\profiles.json
• Linux: ~/.config/Intune.Commander/profiles.json
• macOS: ~/Library/Application Support/Intune.Commander/profiles.json

​

Importing Profiles from JSON

1. Click Import Profiles
2. Select a JSON file containing profile definitions
3. Profiles are merged—duplicates (same Tenant ID + Client ID) are skipped
4. Imported profiles appear in the Saved Profiles dropdown

[
  {
    "name": "Contoso-Production",
    "tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "clientId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "cloud": "Commercial",
    "authMethod": "Interactive"
  },
  {
    "name": "Contoso-Dev",
    "tenantId": "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy",
    "clientId": "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy",
    "cloud": "Commercial",
    "authMethod": "ClientSecret",
    "clientSecret": "your-client-secret-here"
  }
]

​

Profile Encryption

• Windows: Keys protected by DPAPI (user-scoped)
• macOS/Linux: Keys protected by file system permissions
• Encryption marker: File prefixed with INTUNEMANAGER_ENC:
• Key storage: %LocalAppData%\Intune.Commander\keys directory

​

Supported Features

​

Network Requirements

​

Required Outbound Connectivity

​

Proxy Support

• Windows: Internet Options proxy settings
• macOS/Linux: System environment variables (HTTP_PROXY, HTTPS_PROXY)

​

Troubleshooting

​

Authentication Failures

1. Verify redirect URI is configured as http://localhost:45132 (Mobile and desktop applications)
2. Ensure no trailing slash in redirect URI
3. Check that the Client ID matches the app registration

1. Verify all required Graph API permissions are added
2. Ensure admin consent has been granted (green checkmarks)
3. Wait 5-10 minutes after granting consent for changes to propagate
4. Try signing out and back in to refresh the token

​

Permission Errors

1. Use the Permission Check feature in Intune Commander (View menu)
2. Verify missing permissions in the JWT token claims
3. Add missing permissions in Azure Portal
4. Grant admin consent
5. Sign out and sign back in

​

Client Secret Issues

1. Verify the secret hasn’t expired (check Certificates & secrets page)
2. Ensure you copied the secret value, not the secret ID
3. Check for extra spaces when pasting the secret
4. Generate a new secret if the original is lost

​

Migration from PowerShell Version

​

Export Compatibility

• Format: JSON files in subfolder structure
• Migration table: migration-table.json at export root
• Compatibility: PowerShell tool can read .NET exports (forward compatibility not required)

​

Profile Migration

​

Related Resources

• Azure Portal
• Microsoft Graph Explorer
• Entra ID Documentation
• Intune Documentation