Topic of this page: Intune DevOps: Easy Step-by-Step Dev to Prod Guide. Focus: Intune DevOps Pipeline: Move Objects from Dev to Prod Tenant.
The more clients are managed in your tenant and the more people have contributor rights in your tenant, the more important it becomes to have good release management processes. In this blog post I would like to introduce you to my Intune DevOps pipeline that allows you to transfer configurations from one tenant to another. This Intune DevOps approach offers the possibility that only a small number of administrators have access in the Prod tenant and all others create configurations in a Dev tenant and these are then transferred to the Prod tenant via a DevOps pipeline.
Table of contents
Create a Service Principle
The first building block of the Intune DevOps pipeline is a service principal that authenticates against Microsoft Graph. You can read more about app registrations on Microsoft Learn if you want the background details.
- Open the Azure Portal
- Search for Microsoft Entra ID
- Select App registration -> + New registration
- Enter a Name
- Click Register
- Select API permissions
- Click + Add a permission
- Select Microsoft Graph
- Select Application permissions
- Select the following Graph permissions:
- DeviceManagementConfiguration.ReadWrite.All
- DeviceManagementApps.ReadWrite.All
- Click App permissions
- Click Grant admin consent
- Confirm with Yes
- Keep the browser tab open we need this again soon
Add Subscription to the Azure DevOps Pipeline
- Open Azure DevOps in a new tab
- Create a new Organization and Project
- Open the Project
- Select Pipelines and Library
- Click +Variable group
- Go back to the App Registration and copy the AppId, TenantId and create a secret
- Navigate to Certificates & secrets
- Click + New client secret
- Add a Description and Expires date
- Enter IntuneProd as name for the variable group
- Create three variables (ProdAppSecret, ProdAppId, ProdTenantId) and insert the values from the App Registration
- Select secure variable for the AppSecret
- Click Save
Setup the Dev Environment
Repeat the same steps for your Dev Environment so the Intune DevOps pipeline can read the source configurations, but select the following read-only permissions:
- DeviceManagementApps.Read.All
- DeviceManagementConfiguration.Read.All
Setup the Intune DevOps Pipeline
- Navigate to Repos -> Files
- Select Import repository
- Enter the URL from my GitHub repository:
https://github.com/JayRHa/IntuneDevOps.git- Enter a Name and click Import
- Navigate to Pipelines
- Click New pipeline
- Select Azure Repos Git
- Select the imported Repository
- Select Existing Azure Pipeline YAML file
- Select the azure-pipelines.yaml
- Click Continue
- Click Save
How does the Intune DevOps Pipeline work
Once everything is wired up, running the Intune DevOps pipeline is straightforward. You simply point it at the object you want to promote from Dev to Prod.
- Copy the object id from the object you want to copy on the dev tenant. You can get the Id from the URL.
- Enter the Object type and the Object Id in the Pipeline
- Click Run
Get DevOps Runner
When you start the Intune DevOps pipeline without purchasing a DevOps runner you will get the following error message.
- Fill out the form under https://aka.ms/azpipelines-parallelism-request to get a free trial license (can take 2-3 days)
- You can also install a runner on your PC or on a server in your organization
- You can also add a Billing in the Billing section in the Project settings
Conclusion
I hope that this Intune DevOps pipeline can help you to simplify the transfer of configurations from a Dev to the Prod tenant. If you enjoyed this, you might also like how to create PowerShell script to automate tasks in Intune. I appreciate any testers and feedback on my Intune DevOps pipeline so that I can include it in one of the next versions. Enclosed are the features I plan for the next releases:
- Include Debug option
- Include more Object types
- Add naming convention check
- Include Assignments
- Include approval process
I have some questions on this, I found the layout a little confusing.
Setup Pipeline. Do I do this in both the Test and Prod tenant? I only did it in Test, and got the following error:
An error occurred while loading the YAML build pipeline. Variable group was not found or is not authorized for use. For authorization details, refer to https://aka.ms/yamlauthz.
I’m in two different tenants, I’m assuming I’m missing something for Test to see Prod and vice versa?
Does everything need to be named exactly the same in both instances? Apps, Projects, Variables, etc?
Hey Joe, you only need one pipeline for both. The variables groups need the exact name as I used in my blog or you have to change it in the yaml file. If you need help let me know
Hi Thanks for the post.. i am getting the error in get object from dev. Something went wrong by getting the object from Intune remote server returned an error: (404) Not Found. I am not getting the object ID in url. i can see only policy ID and template ID also from some end point security polices. Can you please share how to get Object ID.
Also you mentioned you could add more object types. please share the link if you have already published.