We’ve all built PowerShell scripts to query Intune, wrapped them in some automation, and called it a day. It works. But with Azure OpenAI Service and models like GPT-4.1 and GPT-5.2 optimized for tool calling, there’s a more interesting approach—building an actual AI agent that can talk to your Intune environment.

Instead of writing a script for every query, you build one agent that understands natural language and calls the Graph API on your behalf. Ask it “which Windows devices are non-compliant?” and it figures out the right API call, executes it, and summarizes the results. It’s not magic—it’s function calling with a nice interface.

In this post, I’ll walk you through two different approaches to building this agent: the classic direct SDK approach and the newer Microsoft Agent Framework. Both use the same underlying Graph API client, but differ in how they orchestrate the AI. Let’s dive in.

When application management works smoothly, everyone benefits: IT teams operate with fewer tickets, security stays tight, and employees remain productive. Yet for many organizations, keeping every device up to date, simplifying deployments for AVD/Citrix images, managing SSO across the environment, and supporting macOS without costly third-party solutions can feel overwhelming. Add in the need to handle custom, complex applications—where 80% of the workload often goes into just 20% of those installs—and application management becomes even more challenging.