Top 20 PowerShell Commands Every Intune & Azure Engineer Needs

PowerShell is not optional. If you're working with Microsoft Intune, Azure, or Entra ID every day, the command line is where the real work happens — device enrolment debugging, log triage, service health checks, and automation scripts that save hours of portal clicking. It's also a core expectation in both the MD-102 (Endpoint Administrator) and AZ-104 (Azure Administrator) exams.

This guide covers the 20 commands that appear over and over in real Intune and Azure environments. Not in abstract — with the exact module imports, file paths, service names, and output patterns you'll encounter on real managed devices. Each command is shown in its endpoint-management context, with simulated output so you know what to expect when it works.

Section 1 — Discovery: Know Your Environment (Commands 1–6)

Before you write a single script, you need to know what's available. These six commands are your orientation toolkit.

1. Get-Help

The most important command you'll ever use. Get-Help shows syntax, parameters, and examples for any cmdlet. Run Update-Help first to download the latest documentation locally.

Get-Help Get-IntuneDeviceCompliancePolicy
Get-Help Get-AzVM -Examples
Get-Help Get-MgDevice -Full   # Graph SDK cmdlet — full param reference

2. Get-Command

Find any cmdlet, function, or alias by name or partial name. Especially useful after installing a new module — run this to see what got added.

Get-Command -Module "Microsoft.Graph.Intune"
Get-Command -Name "*Compliance*"   # find anything with Compliance in the name
Get-Command -Name "*Az*" -Module "Az.Compute"

3. Get-Module

Lists modules currently loaded in your session. Run this to confirm the right module version is active before scripting against Intune or Azure.

Get-Module   # show what is loaded right now
Get-Module -Name "Az.*"   # all Az modules currently imported
Get-Module "Microsoft.Graph*"

4. Import-Module

Loads a module into the current session. Every Intune automation script starts here — you cannot use Graph or Az cmdlets without importing the relevant module first.

# Intune + Graph SDK
Import-Module "Microsoft.Graph.Intune"
Import-Module "Microsoft.Graph.DeviceManagement"

# Azure
Import-Module "Az"
Import-Module "Az.Accounts", "Az.Compute", "Az.KeyVault"

5. Get-Module -ListAvailable

Shows every module installed on the machine, not just ones loaded in the current session. Use this to audit which Az or Graph module versions are available before a script run.

Get-Module -ListAvailable | Where-Object {$_.Name -like "*Graph*"} | Select Name, Version
Get-Module -ListAvailable "Az.*" | Sort-Object Version -Descending

6. Get-Alias

Shows short aliases for cmdlets. Essential for reading other people's scripts — when you see gci, where, or ? in a script, this tells you what they actually mean.

Get-Alias gci    # → Get-ChildItem
Get-Alias where  # → Where-Object
Get-Alias select # → Select-Object
Get-Alias ?      # → Where-Object (another alias for the same cmdlet)

Section 2 — Environment & Navigation (Commands 7–11)

Understanding execution policy, the drives PowerShell exposes, and where you are in the shell — these matter every time you run an Intune-deployed script or dig into a device's registry remotely.

7. Get-ExecutionPolicy

Returns the current execution policy. Intune runs scripts under the System context — the execution policy for SYSTEM is independent of the logged-on user. This is the first thing to check when a script silently refuses to run.

Get-ExecutionPolicy
Get-ExecutionPolicy -List   # show all scopes: MachinePolicy, UserPolicy, Process, CurrentUser, LocalMachine

8. Set-ExecutionPolicy

Changes the execution policy. In endpoint management you normally set this via Intune policy — not interactively. But knowing the options matters for troubleshooting and writing remediation scripts.

# Bypass for the current process only (standard in Intune-deployed scripts)
Set-ExecutionPolicy Bypass -Scope Process -Force

# Or set the machine-level policy (requires admin rights)
Set-ExecutionPolicy RemoteSigned -Scope LocalMachine -Force

9. Get-PSDrive

Lists all PowerShell drives — not just file-system paths. HKLM:, HKCU:, Cert:, and Env: are all PSDrives you can navigate with Set-Location and read with Get-ChildItem. Essential for registry and certificate work.

Get-PSDrive
Get-PSDrive -PSProvider Registry   # just the registry drives
Get-PSDrive -PSProvider Certificate # certificate store as a drive

10. Get-Location

Prints the current directory. Simple, but useful in scripts where you are changing directories and need to log or validate where you are at each step.

$currentPath = (Get-Location).Path
Write-Host "Currently at: $currentPath"

# Navigate to the IME log folder and confirm
Set-Location "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs"
Get-Location

11. Set-Location

Changes the current working directory — or drive. Navigate into the registry or certificate store exactly as you would a filesystem. The alias is cd.

# Jump to the IME log folder
Set-Location "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs"

# Navigate the registry like a filesystem
Set-Location "HKLM:\SOFTWARE\Microsoft\Enrollments"
Get-ChildItem   # list all enrolment GUIDs

Section 3 — File & Folder Operations (Commands 12–16)

Managing log files, copying scripts to staging areas, and cleaning up temporary remediation files — these five cmdlets cover all of it.

12. Get-ChildItem

Lists files and folders (or registry keys, or certificate entries). The workhorse of endpoint log triage. Pair with Sort-Object and Select-Object to quickly find the most recent IME log.

# 5 most recent IME log files
Get-ChildItem "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs" | Sort-Object LastWriteTime -Descending | Select-Object -First 5

# All .log files modified in the last 24h
Get-ChildItem "C:\Windows\Logs" -Filter "*.log" -Recurse | Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-24) }

13. New-Item

Creates new files, folders, or registry keys. Used in remediation scripts to create sentinel files (proof-of-run markers) or staging directories for deployments.

# Create a staging folder for a software deployment
New-Item -Path "C:\Staging\Deploy" -ItemType Directory -Force

# Create a sentinel file (Intune detection script checks for this)
New-Item -Path "C:\ProgramData\CompanyName\remediation-ran.txt" -ItemType File -Force

# Create a registry key
New-Item -Path "HKLM:\SOFTWARE\CompanyName\Settings" -Force

14. Remove-Item

Deletes files, folders, or registry keys. Used in remediation scripts to remove broken registry entries, stale log archives, or failed deployment artefacts.

# Delete a specific file
Remove-Item -Path "C:\Staging\broken-script.ps1" -Force

# Remove a folder and everything in it
Remove-Item -Path "C:\OldDeployment" -Recurse -Force

# Delete a registry value (not the whole key)
Remove-ItemProperty -Path "HKLM:\SOFTWARE\CompanyName" -Name "StaleFlag"

15. Copy-Item

Copies files or folders. Common in deployment scripts that copy binaries from a staging share to a local path before running an installer.

# Copy a script to a local staging path
Copy-Item -Path "\\fileserver\share\scripts\fix-compliance.ps1" -Destination "C:\Staging\" -Force

# Copy an entire folder (Recurse for subfolders)
Copy-Item -Path "C:\Source\AppFiles" -Destination "C:\Deploy\AppFiles" -Recurse -Force

16. Move-Item

Moves (not copies) a file or folder. Used to archive old logs or move processed files to a done folder so they are not processed twice.

# Archive a log file after processing
Move-Item -Path "C:\Staging\processed.log" -Destination "C:\Archive\processed.log" -Force

# Rename while moving (same path, new name)
Move-Item -Path "C:\Temp\script.ps1" -Destination "C:\Scripts\deploy-v2.ps1"

Section 4 — Processes, Services & Time (Commands 17–20)

Diagnosing a device that isn't checking into Intune, killing a stuck update process, verifying the IME service is running — these four cmdlets are the ones you reach for when something has gone wrong.

17. Get-Process

Lists running processes. Use it to check whether the Intune Management Extension agent is running, find runaway CPU consumers, or verify an installer has started.

# Is the IME agent process running?
Get-Process -Name "Microsoft.Management.Services.IntuneWindowsAgent" -ErrorAction SilentlyContinue

# Top 10 CPU consumers
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name, CPU, Id

18. Stop-Process

Terminates a running process. Use it carefully in Intune remediation scripts to kill a hung update process or restart the IME agent (stop + service restart is cleaner than stop alone).

# Stop by name (kills all instances)
Stop-Process -Name "usocoreworker" -Force

# Stop by process ID (safer — targets exactly one instance)
$proc = Get-Process -Name "MoUsoCoreWorker"
Stop-Process -Id $proc.Id -Force

19. Get-Service

The single most-used troubleshooting command for Intune engineers. If a device is not checking in, the first three services to check are the IME, the Update Orchestrator, and Windows Update itself.

# Check the IME service state
Get-Service -Name "IntuneManagementExtension"

# Check all update-related services at once
Get-Service | Where-Object {$_.Name -match "Intune|Update|Wmi|MDM|dmwappushsvc"} | Select-Object Name, Status, StartType

20. Get-Date

Returns the current date and time. It appears in nearly every remediation script — for log file names, timestamp markers, age calculations, and conditional logic.

# ISO 8601 timestamp for log entries
$ts = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
Write-Host "[$ts] Remediation started"

# Log file name with datestamp
$logFile = "C:\Logs\remediation-" + (Get-Date -Format "yyyyMMdd-HHmmss") + ".log"

# Check if a file is older than 7 days
$age = (Get-Date) - (Get-Item "C:\Staging\marker.txt").LastWriteTime
if ($age.Days -gt 7) { Write-Host "File is stale" }

Combining Commands: Real Intune & Azure Pipeline Examples

Individual commands are useful. Combined with the pipeline operator (|), they become powerful one-liners. These three examples cover the most common real-world patterns.

# 1. Find all services with Intune in their name
Get-Service | Where-Object {$_.Name -like "*Intune*"} | Select-Object Name, Status

# 2. Show the 5 most recently modified IME log files
Get-ChildItem "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs" |
    Sort-Object LastWriteTime -Descending |
    Select-Object -First 5 Name, LastWriteTime, Length

# 3. Find runaway processes using more than 100s of CPU
Get-Process | Where-Object {$_.CPU -gt 100} | Sort-Object CPU -Descending | Select-Object Name, CPU, Id

Quick Reference — All 20 Commands

Official References

• Get-Help — Microsoft Learn
• Get-Command — Microsoft Learn
• Import-Module — Microsoft Learn
• Get-ExecutionPolicy — Microsoft Learn
• Set-ExecutionPolicy — Microsoft Learn
• Get-ChildItem — Microsoft Learn
• Get-Process — Microsoft Learn
• Get-Service — Microsoft Learn
• Intune Management Extension — Microsoft Learn