PowerShell reference

Every IntuneBrew.ps1 parameter, what a run does, and the exit codes for automation.

Parameters marked 1.1.0 are only in the latest script on GitHub; the PowerShell Gallery has 1.0.1. See Install and connect for setup, and run Get-Help IntuneBrew -Full for the help of your installed version.

Common commands

# Interactive: pick apps from the catalog
IntuneBrew
 
# Find an app's catalog name (runs without signing in)
IntuneBrew -Search "chrome"
 
# Upload or update specific apps
IntuneBrew -Upload google_chrome, visual_studio_code
 
# Update every app that is already in Intune and has a newer version
IntuneBrew -UpdateAll -ConfigFile ./certificate.json
 
# Same, keeping the group assignments of the previous version
IntuneBrew -UpdateAll -PreserveAssignments -ConfigFile ./certificate.json

Apps are identified by their catalog name, such as google_chrome. Find names with -Search or in the app catalog.

What a run does

Signs in and checks the permissions.
Downloads the catalog and, with -LocalJsonDirectory, merges in your own app definitions.
Looks up each selected app in Intune by display name and compares the highest version there with the catalog version. Apps managed through Apple VPP are reported and skipped.
Shows a status overview: Not in Intune, Update Available, Up-to-date, Version ignored or Managed via Apple VPP. -UpdateAll skips this table.
In an interactive run, asks you to confirm, whether to copy assignments, and whether to add pre- or post-install scripts.
For each app: downloads the installer, verifies its SHA256 checksum, creates the Intune app (minimum macOS 11), encrypts and uploads the file, and sets the logo. If an upload fails, an app created in that run is deleted again.
Prints a summary, such as Google Chrome was updated from 129.0 to 130.0.

Updates create a new Intune app by default

Each update adds a new app next to the previous version, so you can test it before moving assignments. Use -PreserveAssignments to move the assignments automatically, or -UseExistingIntuneApp to upload the new version into the existing app instead.

Choosing apps

Parameter	Description
`-Upload <names>`	Upload or update the named apps without the selection prompt.
`-UpdateAll`	Only apps already in Intune that have a newer catalog version.
`-BulkUpload "1,3,5-10"`	Pick apps by their numbers in the alphabetical catalog list.
`-Search <text>`	Search catalog names and exit. Runs before sign-in.
`-LocalJsonDirectory <path>`	Merge every `*.json` app definition in a folder into the catalog. A file overrides the catalog app with the same name. See Local installers.

Assignments and existing apps

Parameter	Description
`-PreserveAssignments`	Copy the previous version's group assignments to the new app, then remove them from the previous app. The previous app is not deleted.
`-CopyAssignments`	Same as `-PreserveAssignments`. Interactive runs ask if neither is set.
`-UseExistingIntuneApp`	Upload the new version into the existing Intune app instead of creating a new one. Assignments stay where they are, so assignment copying is skipped.
`-IgnoreAppVersion`	Never treat apps already in Intune as needing an update.
`-IgnoreVersionDetection` 1.1.0	Set Intune's Ignore app version option. See Version detection.
`-ScopeTagIds "1","2"` 1.1.0	Set Intune scope tags on created and updated apps. Required if your account cannot use the Default scope tag.

Naming and scripts

Parameter	Description
`-AppNamePrefix <text>`	Add text before the Intune display name, for example `"Corporate "`. Also used to find existing apps.
`-AppNameSuffix <text>`	Add text after the display name, for example `" for Mac"`.
`-PreInstallScriptPath <file>`	Run a script before installation. PKG apps only. See Close an app before updating.
`-PostInstallScriptPath <file>`	Run a script after installation. PKG apps only.

Local installers

Parameter	Description
`-LocalFile`	Upload a PKG or DMG you pick in a file dialog (Windows). Asks for name, version, bundle ID, description and an optional logo.
`-LocalFilePath <file>` 1.1.0	Upload a PKG or DMG without dialogs. Needs `-LocalFileConfig` or the three parameters below.
`-LocalFileConfig <json>` 1.1.0	JSON with `name`, `version`, `bundleId`, `description` and an optional `sha`.
`-LocalFileAppName`, `-LocalFileVersion`, `-LocalFileBundleID` 1.1.0	App details for `-LocalFilePath`. They override the JSON file.
`-AllowNetworkPaths` 1.1.0	Allow `file://server/share` paths in local manifests and `-LocalFilePath`.

Authentication and automation

Parameter	Description
`-ConfigFile <json>`	Sign in with an app registration. See configuration files.
`-NonInteractive` 1.1.0	Never prompt. A missing or wrong checksum fails the app instead of asking. Requires `-ConfigFile`.

Security

Parameter	Description
`-SecurityHoldLevel` 1.1.0	`None` (default), `Medium`, `High` or `Critical`. Holds back updates that introduce known vulnerabilities. See Security update holds.
`-IgnoreSecurityHold` 1.1.0	Deploy held updates anyway for this run.
`-ShowAllCves` 1.1.0	Show every known vulnerability for an app, not just the ones that affect the installed or new version.

Exit codes

Code	Meaning
`0`	Success, nothing to do, or cancelled.
`1`	Failure. Only returned with `-NonInteractive`; interactive runs exit without a code.
`2`	At least one update was held by `-SecurityHoldLevel`.

Common commands

What a run does

Choosing apps

Assignments and existing apps

Naming and scripts

Local installers

Authentication and automation

Security

Exit codes

Run on a schedule

Deploy to several tenants

App catalog

On this page