Run on a schedule with Azure Automation

Keep the apps in Intune up to date automatically with the IntuneBrew runbook in an Azure Automation account.

The IntuneBrew runbook (IntuneBrew_Runbook.ps1) updates apps that are already in Intune whenever a newer catalog version exists. Schedule it, for example daily, and your apps stay current without anyone starting an update.

Updates only

The runbook never adds apps that aren't in Intune yet. Upload them once with the portal or the PowerShell tool first.

1. Create the automation account

Create an Automation account in Azure and import IntuneBrew_Runbook.ps1 as a PowerShell 7 runbook. Make sure the Microsoft.Graph.Authentication module is available to the PowerShell 7 runtime.

2. Choose an identity

Method	`AuthenticationMethod` value
System-assigned managed identity (recommended)	`SystemManagedIdentity`
User-assigned managed identity	`UserAssignedManagedIdentity`
App registration with client secret	`ClientSecret`

Certificates are not supported in the runbook.

System-assigned: open the automation account, go to Account Settings → Identity, and switch System assigned on.

User-assigned: create a managed identity, add it under Identity → User assigned, and note its Client ID.

3. Grant Microsoft Graph permissions

Give the identity the application permission DeviceManagementApps.ReadWrite.All, plus Group.Read.All if you turn on CopyAssignments. Managed identities can't be granted permissions in the portal; use PowerShell, for example:

Connect-MgGraph -Scopes "AppRoleAssignment.ReadWrite.All", "Application.Read.All"
 
$identity = Get-MgServicePrincipal -Filter "displayName eq '<automation account or identity name>'"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
 
foreach ($permission in "DeviceManagementApps.ReadWrite.All", "Group.Read.All") {
  $role = $graph.AppRoles | Where-Object { $_.Value -eq $permission }
  New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $identity.Id `
    -PrincipalId $identity.Id -ResourceId $graph.Id -AppRoleId $role.Id
}

Check the result in Entra under Enterprise applications (filter on Managed Identities) → your identity → Permissions.

4. Add the variables

Create these under Shared Resources → Variables in the automation account:

Variable	Required	Value
`AuthenticationMethod`	Yes	One of the values above
`AppId`	User-assigned identity or client secret	The identity's client ID, or the app registration's application ID
`TenantId`	Client secret	Your tenant ID
`ClientSecret`	Client secret	The secret value. Store it as an encrypted variable.
`CopyAssignments`	No	`true` to move assignments to each new version. Default `false`.
`UseExistingIntuneApp`	No	`true` to upload into the existing app instead of creating a new one. Default `false`.
`MaxAppsPerRun`	No	Apps updated per run. Default `10`; the rest are picked up by the next run.

5. Test and schedule

Start the runbook once and read its output. Then link a schedule to it, for example daily outside working hours.

How it differs from the PowerShell tool

It only updates existing apps.
An installer without a checksum, or with a wrong one, always fails.
If an app isn't found by display name, it also tries the app's bundle ID.
Apple VPP apps are skipped.
Name prefixes and suffixes, scope tags, pre- and post-install scripts, and security update holds are not supported.
MaxAppsPerRun exists because Azure Automation sandboxes are limited to about 1 GB of memory.