How it works
From admin consent to your first compliance score
MDO reads your tenant through Microsoft Graph, with the permissions your administrator approves. It keeps a copy of what it reads, so it can show you history, changes and scores. It writes to Intune only when someone on your team clicks, or when you've turned on automatic revert for a protected policy.
Getting started
Step by step in the docs-
01
Request access
MDO is invite-only during the beta. Send the form and we approve your organisation.
-
02
Sign in
With your Microsoft work account at app.moderndeviceops.com. MDO has no passwords of its own.
-
03
Connect the tenant
A Global Administrator or Privileged Role Administrator grants admin consent on Microsoft's page. You don't create an app registration or copy a secret for this.
-
04
First collection
MDO starts reading the tenant's policies, devices, apps and audit events straight away, and shows progress until it finishes. Your compliance score and app list are ready when it does.
-
05
Connect storage
For backups, the Storage wizard has you register one app and deploy a template that creates a storage account in your subscription and gives that app write access to it. A PowerShell script and manual steps do the same.
-
06
Invite your team
Each person gets one of four roles: Owner, Admin, Deployer or Viewer.
What runs when
Times are in UTC, with local times for New York and Sydney. Nothing on this list writes to Intune.
- 02:00 UTC
- Policy backup to your storage account. The default; you set the schedule. 10 pm in New York (9 pm in winter), noon in Sydney (1 pm in summer).
- 04:00 UTC
- Collection from Intune, then drift detection and the compliance scan. Midnight in New York (11 pm in winter), 2 pm in Sydney (3 pm in summer).
- 05:00 UTC
- Clean-up: policy snapshots older than your retention (90 days by default) are removed from MDO.
- Any time
- Sync with Intune, Backup now and Scan now run the same jobs on demand.
What you need
- A Microsoft 365 tenant with Intune, and Windows devices managed by it.
- Someone who can grant admin consent: a Global Administrator or a Privileged Role Administrator.
- For backups, an Azure subscription where you can create a storage account and an app registration.
You don't need a Windows server, a packaging machine, or an agent on your devices.
Which permissions MDO asks for, and whyFree during the private beta. Tell us about your tenant and Aaron will get back to you.