A Windows agent that Intune deploys on its own once features such as Win32 apps, PowerShell scripts or Remediations are assigned to a device. It keeps its own check-in schedule, separate from MDM.
Also called IME.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Intune Management Extension in context, with comparison tables and the common traps.
Terms in this definition
- Agent
A specialised form of Microsoft Copilot set up for one particular job, pairing instructions with knowledge and skills. You can create one in Copilot Studio, SharePoint or Agent Builder, and administrators control them from the Microsoft 365 admin center.
- Intune
Microsoft's device management service, once branded Microsoft Endpoint Manager. Its compliance policies are what the compliant-device grant in Conditional Access relies on.
- Document Intelligence add-on capabilities
Extra Document Intelligence options switched on with the features query parameter: barcodes, formulas, keyValuePairs, languages, ocrHighResolution, queryFields and styleFont.
- Remediations
Each package pairs a detection script with a fix-up script, which the Intune Management Extension runs on Windows devices either on demand or to a schedule. Licensing requires Windows Enterprise E3/E5, Education A3/A5 or VDA; the feature sits under Devices, Scripts and remediations.
- MDM
Mobile device management: a service such as Microsoft Intune controlling the settings, security and apps of enrolled devices. Intune can push Defender configuration this way using Policy CSP and OMA-URI.
Related terms
- Enterprise App Catalog
A library hosted by Microsoft of Win32 apps, from Microsoft and other vendors, that arrive already packaged with their install commands and detection rules. The Intune Management Extension, rather than winget, installs them.