Automation
Run ready-made PowerShell scripts against your tenant from the desktop app, with your own sign-in and a confirmation before anything changes.
The Automation page runs ready-made scripts against your tenant, right from your computer. Open Automation in the sidebar.
The scripts come from the IntuneAutomation library, an open source collection of Intune and Microsoft Graph scripts under the MIT license. The library is bundled with the app. The Details of every library script name the library commit it comes from.
Kairavo itself monitors with read permissions only. Scripts that only read run straight away. Scripts that send email or change your tenant run only when you allow them, and every such run asks for your confirmation first.
Requirements
Scripts run with PowerShell 7 on your computer, signed in with your own account. The line under the page title shows whether everything is in place: Ready to run or Setup needed, the PowerShell version, the Graph module version and whether tenant changes are allowed.
Install PowerShell 7. If Kairavo cannot find it, the page shows Install PowerShell 7 with a link to the install guide. Install it, then select Check again.
Install the Microsoft Graph module. If the Microsoft.Graph.Authentication module is missing, select Install modules for this user. A system dialog asks you to confirm. Select Install. The module installs from the PowerShell Gallery into your user profile. You do not need administrator rights, and nothing changes in your tenant.
Choose a tenant. Scripts run against the tenant selected in Kairavo.
Browse tasks and scripts
The Scripts tab opens with the question What do you want to do? and six tasks:
- Find problem devices: stale, outdated or failing devices, ready to export.
- Check compliance and security: noncompliance, encryption, Defender, roles and expiring certificates.
- Report on apps: installed apps, install failures, conflicts and licenses.
- Clean up Intune: unused policies, orphaned apps, duplicates and assignment gaps.
- Act on devices: sync, restart, rename, wipe or rotate keys in bulk.
- Get notified by email: alerts and digests sent to your team when something needs attention.
Click a task to see its scripts. Below the tasks, Popular lists frequently used scripts. Use Search all scripts to find a script by name.
Scripts that change your tenant carry a Makes changes badge. Scripts that send email carry a Sends email badge. Scripts without a badge only read.
Scripts for Intune remediations holds detection and remediation scripts that run on devices. Kairavo never runs them. Open one to view it, then select Copy script and paste it into a remediation in Intune.
Fill in the form and run a script
Each script opens as three steps.
Settings. Fill in the script's parameters. Required fields are marked Required. Less common parameters sit under More options. Lists take one value at a time: type a value and press Enter. A script with no parameters shows "Nothing to set. This script runs as it is."
Run. Check the line under the button. It says what the script does, for example "Reads your tenant. Nothing is changed.", and which tenant it runs against. Select Run script. If a required field is empty, the page tells you which one to fill in.
Results. The results show Done or The script failed, the run time and the number of output lines. Select Show output to read the full console output. Use Cancel to stop a run that is still going.
A run stops on its own after 30 minutes and shows Stopped after the time limit.
View the source
Open Details at the bottom of a script to see:
- What the script does, its category, version, minimum role and platform.
- The Microsoft Graph permissions it needs. Write permissions are marked.
- The full source code, with Copy script and Open on GitHub.
Read the source before you run a script that changes your tenant.
Allow automations that change your tenant
Scripts that send email or change your tenant are off by default. You can read and copy them, but Run script stays disabled until you turn on the setting.
On the Automation page, select Settings in the status line. A script that needs the setting also offers Open the setting.
Turn on Allow automations that change your tenant.
A system dialog asks "Allow automations that send email or change your tenant?". Select Allow.
Turning the setting off takes effect right away and needs no confirmation.
Confirm each run
With the setting on, every run of a script that sends email or changes your tenant opens a system dialog named Confirm automation run before anything happens. The dialog comes from the app itself, not from the page, and shows:
- The script name, the tenant and the account you are signed in with.
- What the script does and the permissions it uses.
- The parameters you entered.
Choose one of the buttons:
- Cancel stops the run. It is the default button.
- Dry run first runs the script with its own dry run option, when it has one, so it reports what it would do instead of doing it.
- Run runs the script.
A run that uses a file or folder you entered, other than the script's default, also asks for confirmation, even when the script only reads.
Consent for write permissions
Scripts that only read use the same sign-in that Kairavo uses for collection.
A script that sends email or changes your tenant gets a sign-in for exactly the permissions it declares. The first time a script needs a permission that your app registration does not have yet, your browser opens and Microsoft asks for consent. Sign in with the same account you use in Kairavo. Consent given with a different account is refused.
If the permission cannot be granted, the run stops with "No token with the script's permissions. Grant them on your app registration (admin consent), then try again."
Once a write permission is consented on your app registration, later sign-ins of that app registration can carry it too. When a read script runs with such a sign-in, the results say "Your sign-in also carries write permissions". Kairavo's collection still only reads.
Where output goes
Each run works in its own folder:
Documents/Kairavo/Automation/<date> <time> <script>For example Documents/Kairavo/Automation/2026-10-13 0942 get-stale-devices. Files a script exports to its default location land in this folder. A folder that stays empty is removed after the run.
When a run saves files, the results list them with their size:
- Select Open folder to open the folder in Finder or File Explorer.
- Select a CSV file to preview its first rows in the app.
The Run history tab keeps the output of past runs on your computer, up to the last 200 runs. Click a run to see its tenant, start time, parameters and output.