Install and connect the PowerShell tool

The IntuneBrew PowerShell script uploads and updates apps from the same catalog as the web portal, from your own machine or an automation account. Use it when you want to script deployments, run them on a schedule, or deploy installers that are not in the catalog.

Requirements

• PowerShell 7 or later. The script does not run in Windows PowerShell 5.1.

• The Microsoft.Graph.Authentication module:

  Install-Module Microsoft.Graph.Authentication -Scope CurrentUser

• Network access to raw.githubusercontent.com (catalog, app details and logos), the installer download hosts, Microsoft Graph, and Azure Storage (where Intune receives the upload).

• Either an Entra account that can manage Intune apps, or an app registration with the permissions below.

Install the script

From the PowerShell Gallery

Install-Script IntuneBrew -Force
IntuneBrew

Check the installed version with Get-InstalledScript IntuneBrew.

From GitHub

Clone the repository, or download IntuneBrew.ps1 from it, and run the script directly:

git clone https://github.com/ugurkocde/IntuneBrew.git
cd IntuneBrew
./IntuneBrew.ps1

Running from a clone is also what enables the vulnerability report and security update holds, which read the CVE folder of the repository.

On macOS

Install-Script puts the script in ~/.local/share/powershell/Scripts, which is not on your PATH. Either run it by its full path or add the folder to your PowerShell profile:

$env:PATH += ":$HOME/.local/share/powershell/Scripts"

The interactive sign-in menu opens a Windows file picker for the configuration file. On macOS, always pass the file with -ConfigFile instead.

Choose how to sign in

When you run IntuneBrew without -ConfigFile, it asks how to connect:

1. App Registration with Certificate
2. App Registration with Secret
3. Interactive Session with Admin Account

Interactive session

Pick option 3 and sign in. IntuneBrew asks for the delegated permissions DeviceManagementApps.ReadWrite.All and Group.Read.All. If either is missing, it asks whether to continue anyway.

Create an app registration

1. In the Entra admin center, go to Applications → App registrations → New registration.
2. Name it, for example IntuneBrew, choose Single tenant, and select Register.
3. Open API permissions → Add a permission → Microsoft Graph → Application permissions and add:
   • DeviceManagementApps.ReadWrite.All, to create and update apps
   • Group.Read.All, to read group names when IntuneBrew copies assignments
4. Select Grant admin consent.
5. Add a credential under Certificates & secrets, as described below.

IntuneBrew checks both permissions after connecting with an app registration and stops if one is missing.

Certificate

Create a certificate, export it, and upload the public key to the app registration under Certificates & secrets → Certificates:

$cert = New-SelfSignedCertificate -Subject "CN=IntuneBrew" `
  -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable `
  -KeySpec Signature -KeyLength 2048 -KeyAlgorithm RSA -HashAlgorithm SHA256 `
  -NotAfter (Get-Date).AddYears(2)
Export-Certificate -Cert $cert -FilePath IntuneBrew.cer

The certificate must stay in the CurrentUser or LocalMachine store of the machine that runs IntuneBrew. The thumbprint is 40 hexadecimal characters with no spaces or colons.

Client secret

Create a secret under Certificates & secrets → Client secrets and copy its Value right away. IntuneBrew needs the value, not the secret ID. Note the expiry date; the script stops working when the secret expires.

Save a configuration file

Save the connection details as JSON and pass the file with -ConfigFile. The repository has templates for both kinds:

{
  "appId": "00000000-0000-0000-0000-000000000000",
  "tenantId": "00000000-0000-0000-0000-000000000000",
  "certificateThumbprint": "0123456789ABCDEF0123456789ABCDEF01234567"
}

{
  "appId": "00000000-0000-0000-0000-000000000000",
  "tenantId": "00000000-0000-0000-0000-000000000000",
  "clientSecret": "your-secret-value"
}

• tenantId must be the tenant GUID, not a domain name. After signing in, IntuneBrew checks that it connected to that tenant and stops if it did not.
• clientId is accepted instead of appId.
• You can add "authMethod": "Certificate" or "authMethod": "ClientSecret". Without it, IntuneBrew picks the method from the fields you filled in.

Then run, for example:

IntuneBrew -UpdateAll -ConfigFile ./certificate.json

Next steps