TUNO — Intune Operations Tools
Sign in with your Microsoft Entra account to analyze, build and validate your endpoint security configuration — starting with AppLocker policies.
Pop-up not working? Sign in without one →
Runs entirely in your browser — imported policy XML never leaves your session.
What do you want to do?
🖥 Endpoint security
Application control and device security posture.
AppLocker builder & validator NEW BETA
Import an AppLocker policy XML and audit it with the AppLockerInspector check set — enforcement posture, broad principals, user-writable paths, risky wildcards, overly broad publisher rules. Verify the Microsoft apps a locked-down estate still needs (OneDrive first among them) are actually allowed, add the missing rules publisher-first, and export policy XML plus a Markdown report. Runs entirely in the browser.
❓ About this app
What changed, where it is heading, how it works.
What's new
Everything added or changed, per build.
Roadmap
Where TUNO is heading — shipped, next, later.
Help
What each tool does, what it reads, and the security model.
🔐 AppLocker builder & validator BETA
Import a policy XML — a GPO export or Get-AppLockerPolicy -Effective -Xml — and it is audited in the browser with the check set from Spencer Alessi's AppLockerInspector. The Microsoft coverage table answers the question every lockdown discovers too late: can a standard user still run OneDrive, Teams, Edge and Office? Build the missing rules publisher-first and export the XML back into your GPO. Nothing is uploaded — the file is read in this tab and stays there. NTFS and share ACL reality checks need a filesystem and stay in the PowerShell original.
Start by importing a policy.
From a GPO: Group Policy Management Editor → Application Control Policies → AppLocker → right-click → Export Policy…
From a machine's effective policy (elevated PowerShell): Get-AppLockerPolicy -Effective -Xml > policy.xml
Or load the sample policy to see what the audit and the Microsoft coverage check produce.
📋 What's new
Everything added or changed in TUNO, newest first.
🗺 Roadmap
Where TUNO is heading, laid out in time. Order and scope may change — real-tenant feedback decides what lands first.
Each item carries a reference (Rnn) so it can be pointed at without quoting the title — same rules as ENCA: a reference belongs to its item permanently, is never reused once the item ships, and the numbers are not a priority order. An item that ships moves from Next to Now with its reference intact.
Now shipped & shipping
R01 🔐 AppLocker builder & validator live · build 1 BETA
Web-based AppLocker policy analysis after Spencer Alessi's AppLockerInspector: import the XML, get the weak/misconfigured/risky settings with severity, reason and recommendation — plus the check the PowerShell original does not have: a Microsoft app coverage table that verifies OneDrive (per-user!), Teams, Edge, WebView2, Office click-to-run, the Intune agent and friends are actually allowed to run for a standard user, with one-click publisher-first fixes and XML export back into the GPO.
Next
R02 📊 Secure Score visualizer
Read the tenant's Microsoft Secure Score over Graph (security/secureScores and the control profiles) and make it explorable: score over time, per-category breakdown, which improvement actions buy the most points for the least user pain, and what changed since last month — with a Markdown export for the monthly report. Asks for SecurityEvents.Read.All on the click, ENCA-style incremental consent, and reads only.
Later
R03 🖥 Intune device analyzer
The tuno.md original: pick a device and see which groups it is in, which policies land on it and why, and which apps it gets — the Intune counterpart of ENCA's per-user policy views.
❓ Help
What TUNO is
TUNO — Tenant Utilities for iNtune Operations is ENCA's sister tool (enca.limon-it.nl): the same idea — static files running entirely in your browser, minimal delegated Graph permissions asked per tool, nothing stored server-side because there is no server — applied to Intune and endpoint security instead of Conditional Access.
🔐 AppLocker builder & validator
Reads NOTHING from your tenant: the policy XML you import is parsed in this tab, audited with the AppLockerInspector check set, evaluated against a catalog of Microsoft apps (per-user OneDrive is the one everybody breaks), and exported back as XML or a Markdown report. Two honest limits: NTFS/share ACL checks need a filesystem, so run Invoke-AppLockerInspector.ps1 on a host for those; and rule evaluation here is a faithful model (deny beats allow, exceptions, macros, publisher fields), not the AppLocker engine itself — test in AuditOnly before enforcing, always.
Security model
Sign-in is a SPA authorization-code + PKCE flow with no client secret — the same model as ENCA, documented in SECURITY.md. You can run TUNO on your own single-tenant app registration: New-TunoAppRegistration.ps1 -SingleTenant.