Delegated public-client authentication
One multi-tenant Entra registration uses authorization code with PKCE and a localhost loopback redirect. There is no application token, app secret, or service certificate.
Back to MCP overview
Local security model
Security boundaries you can explain to an Intune administrator
The MCP runs locally with delegated user permissions. Tokens stay outside model context, Graph access is purpose-built and read-only, and this website hosts no connection or tenant-management backend.
Protected local cache
MSAL uses Windows DPAPI, macOS Keychain, or Linux libsecret. If secure persistence fails, the MCP uses process memory instead of an unencrypted token file.
Tenant-bound execution
Every result includes the resolved tenant ID. IAC_MCP_TENANT_ID can pin guest administrators to the intended tenant GUID, and cursors cannot cross tenants.
No hosted inventory
The local MCP calls Microsoft Graph directly. Intune Assignment Checker does not operate a database of customer policies, groups, devices, or tokens.
Graph controls
Read-only is enforced by design, not just documentation
The first release requests delegated read scopes only and sends GET requests to Microsoft Graph. The API surface cannot be repurposed into a general Graph proxy.
- Every Microsoft Graph URL is constructed inside a known policy adapter.
- The hostname is fixed to graph.microsoft.com and the API version to /beta.
- Opaque nextLink values are validated, retained locally, and replaced by one-time tenant-bound cursors.
- HTTP redirects are rejected, and calls, pages, time, bytes, retries, and concurrency are bounded.
- No tool accepts an arbitrary URL, Graph path, access token, client secret, or certificate.
- Tool inputs are schema-validated, and result sets have explicit upper bounds.
Delegated RBAC is a visibility boundary
Microsoft Graph can return HTTP 200 with a subset of Intune data when the signed-in administrator has scoped RBAC access. The MCP labels successful coverage as potentially RBAC-filtered. An empty result is not presented as proof that the tenant has no matching assignment.
What reaches the model
Tool results can include policy names, group names, assignment filter rules, platforms, identifiers, intents, and role-scope-tag IDs. Your MCP client sends those bounded results to its configured model provider. Access tokens, refresh tokens, passwords, authorization codes, and raw Graph responses are never included. Graph-sourced strings are treated as untrusted input, stripped of control characters, and length-limited.
Retention by data type
| Data | Location | Retention |
|---|---|---|
| Microsoft access and refresh tokens | OS-protected MSAL cache on the user’s machine | Until logout, revocation, or cache removal |
| Graph continuation URLs | MCP process memory only | 10 minutes; one use |
| Policy and assignment results | Returned to the configured MCP client | Not retained by this website or an IAC backend |
| Reports and inventories | Not implemented in the first slice | None |
| Application logs | No raw Graph payloads, names, or tokens by design | Client/operator controlled |
Revoke local access
Run npx -y intune-assignment-checker-mcp logout to remove locally cached accounts. Source contributors can run node dist/index.js logout from the MCP repository. Users can also revoke the application from their Microsoft account.
Revoke tenant consent
An Entra administrator can disable or delete the Intune Assignment Checker MCP enterprise application in the customer tenant. No hosted IAC session remains to clean up.