How to Deploy PowerShell Script via Intune: A Complete Guide for IT Admins

Introduction

Managing a diverse IT environment requires precision, control, and automation—and nothing empowers IT professionals more than PowerShell. But what happens when your organisation scales? You need a centralised way to deliver scripts to multiple endpoints securely and efficiently. This is where deploying PowerShell scripts via Intune comes into play.

Whether you’re rolling out a configuration change, removing bloatware, or enforcing security policies, this guide will walk you through every step, best practice, and gotcha—backed by real-world insights.

---

Why Use Intune for PowerShell Deployment?

Microsoft Intune, part of Microsoft Endpoint Manager, offers a powerful framework for managing modern and hybrid workplaces. But why should you deploy PowerShell scripts through it?

Benefits:

• Cloud-native script delivery to Azure AD-joined or hybrid-joined Windows 10/11 devices
• No dependency on on-prem GPOs or legacy SCCM distributions
• Built-in targeting and logging through device/user group assignments
• Secure execution with system context, reducing privilege escalation risks

Intune’s scripting capabilities are ideal for organisations transitioning to modern management or working in remote-first environments.

---

Prerequisites: What You Need Before You Start

Before you rush to upload your script to Intune, ensure you’ve checked the following:

Requirement	Details
Intune Admin Access	You must be a Global or Intune Administrator
Windows 10/11 Devices	Enrolled in Intune and supported by the Intune extension
PowerShell Script	Should be tested, encoded in UTF-8, and ideally signed
Azure AD Security Groups	To assign scripts to appropriate users or devices

💡 Tip: Devices must have the Intune Management Extension installed. It’s automatically pushed to Windows devices upon enrolment.

---

Step-by-Step: Deploy PowerShell Script via Intune

Uploading the Script

For this example, we will use the ‘Manage Windows Credential Manager‘ script, deployed to all devices, to ensure that all credentials saved in Windows Credential Manager are cleared

• Log into Microsoft Intune Admin Centre.
• Navigate to Devices > Windows > Scripts and remediations
• You can choose between Platform Script and Remediation.
  I personally prefer Remediation, as it provides insight into how the script is deployed and reports the results

• Enter a name and description that clearly defines the script’s purpose. (Clear saved Credentials in Windows Credentials Manager)

• Click Next, then Upload your PowerShell in Detection script file section.
  You can find a copy of the script in GitHub
• Configure the following options:
  • Run script using the logged-on credentials: No (for system context)
  • Enforce script signature check: No (unless you’ve signed it)
  • Run script in 64-bit PowerShell: Yes (unless you target 32-bit apps)

Note: You can split the script into a detection script and a remediation script, but for this example, we will just use the detection script option

Assigning the Script

1. Assign to Azure AD device groups or user groups.
2. Use filters to narrow targeting (e.g., only laptops or devices with 8+ GB RAM).
3. Click Next > Review + Add.

Monitoring and Troubleshooting

• Navigate to the Script status page for success/failure rates.
• Download logs via Endpoint Analytics or directly from:
  • C:\ProgramData\Microsoft\IntuneManagementExtension\Logs
  • Use CMTrace to read log files more easily.

---

PowerShell Deployment Best Practices

Follow these guidelines to ensure robust and secure deployments:

• Test scripts in a staging group before rolling out organization-wide.
• Use verbose logging (Write-Output) to assist with debugging.
• Ensure idempotency (scripts that can safely run multiple times).
• Prefer Try/Catch blocks for error handling.
• Incorporate exit codes for clearer status reporting.

Example template:

Try {
    # Your logic here
    Write-Output "Script executed successfully"
    Exit 0
} Catch {
    Write-Error "Script failed: $_"
    Exit 1
}

Common Pitfalls and How to Avoid Them

Pitfall	Solution
Script not executing	Ensure device is online and enrolled; check for sync errors
Scripts not running as expected	Verify architecture setting (64-bit vs 32-bit PowerShell)
Incorrect assignment	Always validate AAD group membership and scope filters
Signature issues	Only enforce signing if your environment requires strict validation

---

Conclusion

Using Intune to deploy PowerShell scripts brings enterprise-grade control, remote agility, and auditability to the scripting world. By understanding how to structure scripts, assign correctly, and monitor efficiently, IT admins can automate once-manual tasks while boosting compliance and consistency.

💡 Remember: Always test, document your changes, and keep your environment as code-centric as possible.