Deploy to several tenants

Invoke-IntuneBrewBatch.ps1 runs IntuneBrew for a list of tenants in parallel, for example when you manage Intune for several customers or subsidiaries. It needs PowerShell 7 and a clone of the repository.

1. Prepare one configuration per tenant

Each tenant needs its own app registration and a configuration file with the tenant GUID and a certificate thumbprint or client secret. Interactive sign-in isn't possible in a batch.

2. Write a tenant manifest

{
  "tenants": [
    { "name": "Customer One", "configFile": "credentials/customer-one.json" },
    { "name": "Customer Two", "configFile": "credentials/customer-two.json" }
  ]
}

• configFile is relative to the manifest.
• Names are 1–80 characters (letters, digits, spaces, _, ., -) and must be unique. The same tenant can't appear twice.

3. Check the plan

./Invoke-IntuneBrewBatch.ps1 -TenantManifest ./tenants.json -Upload google_chrome,slack -WhatIf

-WhatIf validates every configuration without signing in or deploying anything.

4. Run it

./Invoke-IntuneBrewBatch.ps1 -TenantManifest ./tenants.json -UpdateAll -PreserveAssignments

Results

Each tenant runs in its own process and working folder, signed in only to that tenant. The summary file lists every tenant with its status, exit code and duration. The command exits with 1 if any tenant failed; the other tenants still finish.

• Failed tenants are not retried automatically, and nothing is rolled back, because a deployment may have partly completed. Check the tenant before running it again.
• Output from each tenant is hidden to keep credentials out of shared logs. To see what went wrong, run IntuneBrew directly with that tenant's configuration file.