PowerShell WPF GUI for managing the DUDE (Dynamic User & Device Enumeration) automation solution.
If you manage Microsoft Intune at scale, you have already hit this wall:
- Intune assigns policies to device groups
- Your organization is structured around user groups
- There is no native way to automatically keep those in sync
This gap forces admins into one of three bad options:
- Manual device group maintenance
- Fragile scripts with broad permissions
- Accepting incorrect or delayed policy targeting
None of these scale reliably, and each one makes safety and auditability harder than it should be.
DUDE exists to close this gap — deliberately, securely, and at enterprise scale.
| Option | Why It Fails |
|---|---|
| Dynamic device groups | Cannot evaluate user group membership |
| Intune filters | Cannot cross the user → device boundary |
| Manual scripts | No guardrails, no audit trail, high blast radius |
| Azure Automation | Still requires custom logic, permissions, and safety controls |
| Enrollment-Based Grouping | Evaluated only at enrollment — does not react to user or org changes over time |
DUDE is purpose-built for this exact problem — not as a workaround, but as a managed system with safety, auditability, and scale in mind.
DUDE (Dynamic User & Device Enumeration) automates device group membership based on user group membership:
- You define mappings: "Sales-Users" → "Sales-Devices"
- DUDE finds all Intune-managed devices for users in "Sales-Users" (including nested group members)
- Devices are added to/removed from "Sales-Devices" automatically
- Runs on schedule as an Azure Function with Managed Identity
Result: Intune policies assigned to "Sales-Devices" now apply to all devices owned by sales team members — automatically.
DUDE uses transitive membership (transitiveMembers) so nested user groups are fully resolved. If "Sales-Users" contains a sub-group "Sales-EMEA-Users," their devices are included too. You can also nest device groups inside the target group — for example, adding an Autopilot device group as a member of "Sales-Devices" so that new devices receive Sales policies immediately during enrollment, without waiting for the next DUDE sync cycle.
- Automatic, continuous device group membership based on user groups
- Full support for nested Entra ID groups (transitive membership)
- No shared credentials — Managed Identity handles runtime group, Administrative Unit, and Defender tag writes
- Built-in safety controls: prefix allowlists, blast radius limiter, debug mode default
- Designed to support security review — not bypass it
- Read-only Posture Snapshot evidence for security review and least-privilege drift discussions
DUDE also enables scoped administration:
- Administrative Units — auto-sync both users and their devices into AUs for Entra ID role scoping (e.g., "HR admins manage only HR users and HR devices")
- Intune Scope Tags — recommended for help desk scoping (user-managed; DUDE does not sync scope tags)
- Defender for Endpoint Tags — auto-tag devices for security team visibility (e.g., "VIP devices" for executive threat hunting)
These features are optional — DUDE works with just user group → device group mappings, or with all delegation features enabled.
DUDE is designed for organizations that:
- Use Microsoft Intune at scale
- Structure access and policy around Entra ID user groups
- Need predictable, auditable device targeting
- Care about least privilege and operational safety
DUDE may be overkill if:
- You have only a handful of static device groups
- You do not rely on user-based targeting at all
- Reads configuration from Azure Table Storage
- Runs as Azure Function App (scheduled timer trigger, default every 2 hours)
- Uses Managed Identity for runtime Graph, Defender, and Azure Table operations
- GUI handles deployment, configuration, monitoring, and posture review; all Entra ID group membership writes are performed by the Function App
- Works for a single group mapping or hundreds; validate plan, concurrency, and API behavior for very large tenants
DUDE's core features (device group sync) require no additional licensing beyond Azure consumption costs. Optional features may require additional licensing — see Azure Cost below.
DUDE deploys standard Azure resources. On the Consumption (serverless) plan, running costs are often low for small or test environments, but actual cost depends on tenant size, run frequency, telemetry volume, and selected plan.
| Resource | Cost |
|---|---|
| Resource Group | Free |
| Storage Account + Azure Table | Usually low for typical config tables; depends on storage account usage and retention |
| Log Analytics Workspace | Azure Monitor/Log Analytics includes a 5 GB/month free data allowance per billing account; cost depends on ingestion and retention |
| Application Insights | Billed through Azure Monitor/Log Analytics; cost depends on telemetry ingestion and retention |
| App Service Plan (Consumption/Y1) | Serverless billing. Azure defaults to a 5-minute function timeout; DUDE configures the Consumption maximum of 10 minutes. Best for test/small environments. |
| App Service Plan (Dedicated/P0v3+) | Fixed monthly cost — recommended for production. DUDE enables and repairs Always On for reliable always-ready behavior; timeout is configurable. |
| App Service Plan (Premium/EP1+) | Higher fixed monthly cost. Consider when you need prewarmed instances, VNet/private networking, longer execution duration, larger compute, or more predictable pricing. |
| Function App | Included in App Service Plan pricing |
Optional features with separate licensing:
- Administrative Units — creating AUs is available with Microsoft Entra ID Free, but AU-scoped administrators require Microsoft Entra ID P1; dynamic AU membership rules also have P1 requirements. See Administrative units license requirements.
- Defender for Endpoint Tags — requires Microsoft Defender for Endpoint P1 or higher
For exact pricing, model your tenant and plan in the Azure Pricing Calculator.
These requirements apply to the DUDE Manager GUI only. The DUDE sync engine runs as an Azure Function and has no local platform requirements.
| Platform | Processor | Authentication Method | Status |
|---|---|---|---|
| Windows 10/11 | x64 (Intel/AMD) | WAM popup or browser | ✅ Tested |
| Windows 11 | ARM64 (Snapdragon) | Browser device code | ✅ Tested |
On ARM64 devices (Snapdragon processors), DUDE Manager uses browser-based device code authentication instead of the standard Windows popup. This is due to compatibility issues between the Windows authentication broker (WAM) and PowerShell running under x64-on-ARM64 emulation.
What to expect on ARM64:
- Browser automatically opens to
microsoft.com/devicelogin - Device code is displayed in the GUI and copied to clipboard
- Enter the code in the browser to complete authentication
- GUI remains responsive during authentication
Security note: Device code authentication may bypass Conditional Access policies that require device compliance or managed device status. If your organization enforces device-based CA policies, consider: (1) adding a CA policy that targets device code flow and requires MFA, or (2) creating a scoped exclusion for ARM64 operators. Consult your Entra ID Conditional Access documentation for your specific policy set.
Time to value: With prerequisites installed, DUDE can usually be deployed quickly, but setup time depends on tenant prerequisites, permissions, Azure provisioning, and Graph/API conditions.
-
PowerShell 7.0+ (7.4+ recommended)
$PSVersionTable.PSVersion # Check version (should be 7.0+)
-
Azure PowerShell & Graph Modules
Install-Module Az.Accounts -MinimumVersion 5.3.2 -Scope CurrentUser Install-Module Az.Resources -MinimumVersion 9.0.0 -Scope CurrentUser Install-Module Az.Storage -MinimumVersion 9.5.0 -Scope CurrentUser Install-Module Az.Websites -MinimumVersion 3.0.0 -Scope CurrentUser Install-Module Az.OperationalInsights -MinimumVersion 3.0.0 -Scope CurrentUser Install-Module Az.ApplicationInsights -MinimumVersion 3.0.0 -Scope CurrentUser Install-Module AzTable -MinimumVersion 2.1.0 -Scope CurrentUser Install-Module Microsoft.Graph.Authentication -MinimumVersion 2.20.0 -Scope CurrentUser Install-Module Microsoft.Graph.Applications -MinimumVersion 2.20.0 -Scope CurrentUser Install-Module Microsoft.Graph.Groups -MinimumVersion 2.20.0 -Scope CurrentUser Install-Module Microsoft.Graph.Identity.DirectoryManagement -MinimumVersion 2.20.0 -Scope CurrentUser
Optional manual verification snippets in the documentation also use:
Install-Module Microsoft.Graph.Users -MinimumVersion 2.20.0 -Scope CurrentUser Install-Module Microsoft.Graph.Identity.Governance -MinimumVersion 2.20.0 -Scope CurrentUser
-
Execution Policy —
RemoteSignedorBypassrequiredSet-ExecutionPolicy RemoteSigned -Scope CurrentUser
-
Windows 10/11 with WPF Support
- GUI requires Windows Presentation Foundation (WPF)
- Not compatible with Linux/macOS or Azure Cloud Shell
-
Clone or download this folder to your local machine
-
Launch DUDE Manager (double-click):
Start-DUDEManager.cmdThe launcher automatically finds PowerShell 7 and loads all required modules.
Alternative (from a PowerShell 7 console):
.\Start-DUDEManager.ps1
DUDE Manager uses independent version tracks:
- Module (GUI): v1.7.3 — desktop application lifecycle
- Function (Runtime): v13.17.5 — Azure Function sync engine lifecycle
The GUI status bar displays both versions.
Screenshots intentionally show disconnected or sanitized states to reflect enterprise security best practices.
No live tenant data is shown.
- Connect to Azure & Graph - Authenticate and select subscription
- Deploy Infrastructure - Create Resource Group, Storage Account, Function App, Log Analytics
- Verify Configuration - Check if all Azure resources exist
- Import/Export Config - Save/load infrastructure settings as JSON (backup, environment cloning)
- Refresh - Load DUDE configurations from Azure Table
- Add/Edit/Delete - Manage configuration rows (User Group → Device Group mappings). Multi-row selection enables bulk editing of Enabled state and OS Filter
- Validate - Check that all groups and admin units exist
- Import/Export - Bulk operations with CSV or JSON. Export includes tenant metadata; import validates tenant context and detects duplicates. See Configuration Import/Export
- Overview Cards - Five at-a-glance status cards:
- Last Execution (timestamp and status)
- Success Rate (percentage and ratio)
- Active Groups (count)
- Function App (app state + debug/production mode)
- Schedule (timer/manual enabled + next scheduled execution)
- Recent Executions - Execution history with status, duration, triggered by (Timer/Manual)
- Function App Logs - Live logs from Application Insights
- Controls - Refresh, Run Now, Restart (orange), Stop (red), Start (green), View Logs, View in Portal
- Time Range - Filter logs (1d, 7d, 30d)
- Run Posture Check - Runs the read-only posture snapshot checks from the GUI.
- Summary Cards - Shows overall posture, last checked time, runtime mode, Managed Identity, Graph permissions, Storage RBAC, and export status.
- Findings Grid - Shows a triage view with status, area, check, risk, action, and filters for Failed, Warnings, Unknown, Passed, and N/A. Full observed/expected evidence is available from View Details or by double-clicking a finding.
- Snapshot Export - Exports redacted snapshots by default from a Save dialog that starts in the user's Downloads folder; internal export is a separate explicit action for tenant-local review.
- Copy Summary - Copies a short non-secret summary, not raw snapshot JSON or Markdown.
- Review Guide - See SECURITY-REVIEW.md for check interpretation, redaction boundaries, and limitations.
- Select Resources — Choose which Azure resources to delete (Resource Group, Storage Account, Table, Log Analytics, Application Insights, App Service Plan, Function App, Functions, local config cache)
- WhatIf Preview — Required dry-run before any deletion (shows what would be deleted)
- Delete Selected Resources — Permanently delete selected resources with confirmation
- Safety Controls — Cascade warnings for Resource Group deletion, subscription/tenant verification banner
Deploying DUDE requires Contributor on the Resource Group, plus a temporary Azure RBAC role-assignment permission (Owner, User Access Administrator, or Role Based Access Control Administrator) for Managed Identity RBAC assignments, and a supported Microsoft Entra role for app-role assignments. Privileged Role Administrator is the recommended operational role for this workflow. After initial deployment, the role-assignment and app-role assignment permissions can be revoked; later deploy/update, Configure, Operations, Posture, and Cleanup workflows each use the least-privilege roles listed in Required Permissions.
-
Launch GUI
.\Start-DUDEManager.ps1 -
Connect to Azure & Graph
- Click "Connect to Azure & Graph"
- Sign in once with your Azure account; DUDE validates the Graph read capabilities already granted to the client
- Select your subscription
-
Deploy Infrastructure (Setup Tab)
- Select your Subscription
- Select Region for new resources (e.g., "West Europe")
- Add at least 1 allowed group prefix (e.g.,
DUDE-,Pilot-) - If you enable any optional feature, make sure to also add allowed prefixes for optional features
- Click "Deploy/Update"
- Wait for the 12-step deployment/verify flow to complete
-
Add DUDE Configuration (Configure tab)
- Click "Add"
- Enter:
- User Group: Name of Entra ID user group (required)
- Device Group: Name of Entra ID device group (required)
- Optional: OS Filter, Admin Unit, Defender Tag
- Click "Save"
- Bulk alternative: If you have many mappings, prepare a CSV and use Import in the Configure tab instead. See Configuration Import/Export.
-
Test Execution (Operations tab)
- Click "Run Now"
- Wait for completion
- Check logs in Operations tab
- Tip: Use Live Logs during testing for faster feedback
- Note: If execution exceeds ~230 seconds (Azure's HTTP gateway timeout), the GUI shows an info dialog — the function continues running in the background. See Troubleshooting.
-
Production (Setup Tab)
- When the logs are as desired, change execution mode from Debug mode to Production mode to make changes
- When changes are as desired, enable the timer function to run on schedule
-
Security Review (Posture tab)
- Run Posture Check to produce a read-only review of runtime identity, Graph permissions, storage RBAC, Function App settings, optional feature permissions, and recent execution evidence
- Export a redacted snapshot for review sharing, or an internal snapshot for tenant-local evidence
- ARCHITECTURE.md - Module structure, execution flow, handler patterns
- SECURITY.md - Scope allowlist, tenant guards, safe defaults
- SECURITY-REVIEW.md - Posture Snapshot purpose, target audience, checks, limitations, and review guidance
- PRIVACY.md — PII handling, data flow, GDPR compliance
- TROUBLESHOOTING.md — Common issues and KQL queries
- RELEASING.md — Versioning, release checklist
- CONTRIBUTING.md — How to contribute
- AzureFunction/README.md — Function App settings reference (all 19 required + optional settings)
| Enabled | User Group | Device Group | OS Filter | Admin Unit | Defender Tag |
|---|---|---|---|---|---|
| true | Sales-Users | Sales-Devices | All | Sales-AU | Sales |
| true | IT-Users | IT-Devices | Windows | IT-AU | IT |
| true | Executives | Executive-Devices | All | Exec-AU | Executive |
| false | Pilot-Users | Pilot-Devices | All |
Columns:
- Enabled — optional (default:
true). Set tofalseto skip a row without deleting it - User Group — required. Entra ID user group to enumerate
- Device Group — required. Entra ID device group to sync devices into
- OS Filter — optional (default:
All). Filter by platform:All,Windows,macOS,iOS,Android - Admin Unit — optional. Entra ID Administrative Unit to sync users and devices into
- Defender Tag — optional. Defender for Endpoint machine tag to apply
What This Does:
- Users in
Sales-Users→ their devices are added toSales-Devices - Both users and devices are added to
Sales-AUAdministrative Unit - Devices are tagged with
Salesin Defender for Endpoint - IT row filters to Windows devices only (macOS/iOS/Android excluded)
- Pilot row is disabled and will be skipped during sync
- Process repeats for all enabled mappings
The Configure tab supports bulk operations via CSV or JSON files. Use this for backup, bulk initial setup, or migrating configuration between environments.
| Scenario | Action |
|---|---|
| Backup before changes | Export → save JSON (includes metadata for exact round-trip) |
| Bulk initial setup (10+ mappings) | Prepare CSV → Import → Validate |
| Migrate test → production | Export from test → Import to prod → Validate → review group existence |
| Share config template | Export → share internally (do not post publicly) |
Your CSV needs only the data columns — PartitionKey, RowKey, and Timestamp are handled automatically.
| Column | Required | Default | Values |
|---|---|---|---|
UserGroupName |
Yes | — | Entra ID user group display name |
DeviceGroupName |
Yes | — | Entra ID device group display name |
Enabled |
No | true |
true / false |
OSFilter |
No | All |
All, Windows, macOS, iOS, Android, Linux, ChromeOS (comma-separated). ChromeOS: limited — no Intune Primary User; AU device sync only. |
AdminUnitName |
No | — | Entra ID Administrative Unit display name |
DefenderTag |
No | — | Defender for Endpoint machine tag |
Example CSV:
UserGroupName,DeviceGroupName,OSFilter,AdminUnitName,DefenderTag
DUDE-Sales-Users,DUDE-Sales-Devices,All,Sales-AU,Sales
DUDE-IT-Users,DUDE-IT-Devices,Windows,IT-AU,IT
DUDE-Exec-Users,DUDE-Exec-Devices,All,Exec-AU,ExecutiveJSON exports include a metadata wrapper with tenant ID, timestamp, and format version. This is the recommended format for backups — it preserves data types and enables exact round-trip restore.
Export (backup) → Import → Validate → Review → Deploy
- Export current config (backup before changes)
- Import CSV or JSON file
- Validate — click Validate in Configure tab to check all groups exist in Entra ID
- Review validation results — fix any errors before proceeding
- Test — run with Debug Mode enabled (Operations tab → Run Now)
- Pre-validation: Before any Azure writes, the import validates CSV structure (required columns), row count (warn >500, block >1000), and content (formula injection detection)
- Formula injection rejection: Values starting with
=,+,-,@are rejected during import (leading'from our own export is stripped automatically) - Privileged group detection: Import checks all group names against privileged patterns (e.g., Global Administrators) and shows a confirmation dialog before proceeding
- Tenant validation: Import warns if the file was exported from a different tenant
- Duplicate detection: Rows with an existing Device Group, Admin Unit, or Defender Tag are skipped
- Input validation: Same rules as manual Add — field length limits, invalid character blocking, OSFilter whitelist (enforced per-row by
Add-DUDETableRow) - Non-blocking import: Large imports run asynchronously — the GUI stays responsive and the status bar shows "Importing X/Y..." progress
Important: Import writes to the Azure Table only. It does not check whether groups exist in Entra ID — that is what the Validate step is for. Always validate after import.
See TROUBLESHOOTING.md for common import/export errors.
See SECURITY.md for file handling best practices.
For troubleshooting common issues (connection problems, Function App errors, ARM64 authentication, table access), see TROUBLESHOOTING.md.
DUDE Manager includes multiple security layers:
- ✅ Configurable Tenant Guards — Protected tenant IDs require explicit confirmation when configured in
SecurityConfig.ps1; default is inactive until you add tenant IDs - ✅ Console Logging — All operations logged via Write-DUDELog
- ✅ Fail-Closed Group Prefix Allowlist —
DUDE_ALLOWED_GROUP_PREFIXESrequired; unset = all rows rejected - ✅ Admin Unit Prefix Stripping —
DUDE_ALLOWED_ADMIN_UNIT_PREFIXESrequired when AU sync is enabled; non-matching AU fields are cleared and the row continues - ✅ Defender Tag Prefix Stripping —
DUDE_ALLOWED_DEFENDER_TAG_PREFIXESrequired when Defender sync is enabled; non-matching tag fields are cleared and the row continues - ✅ Debug Mode Default — New deployments start in read-only WhatIf mode (
DUDE_DEBUG_MODE=true); persists across redeploys once changed - ✅ Privileged Group Detection — Warns when targeting admin or Conditional Access exclusion groups
- ✅ Graph API v1.0 Only — All operations use the stable v1.0 Microsoft Graph API
See SECURITY.md for details, including the full API Versioning table.
DUDE Manager uses a two-tier permission model:
| Layer | Identity | Auth Method | Purpose |
|---|---|---|---|
| GUI (this tool) | Your user account | Delegated (interactive login) | Read Azure/Entra state, deploy infra |
| Function App | Managed Identity | Application (no user) | Runtime group, Admin Unit, and Defender tag writes on schedule |
| What you want to do | Graph Scopes (Delegated) | Azure RBAC | Entra ID Role |
|---|---|---|---|
| Connect (read groups, admin units & apps) | Group.Read.All, AdministrativeUnit.Read.All, Application.Read.All |
— | — |
| Discover / Verify infrastructure | — | Reader @ Subscription or RG | — |
| Deploy infrastructure | — | Contributor @ RG; Owner, User Access Administrator, or Role Based Access Control Administrator required when assigning Managed Identity RBAC | Supported Entra role for app-role assignment, with Privileged Role Administrator recommended for this workflow |
| Assign Owner to Resource Group | — | Owner, User Access Administrator, or Role Based Access Control Administrator @ RG (one-time) | — |
| Load / validate groups in table | Connect scopes above | Reader and Data Access @ Storage (GUI operator) | — |
| Add / edit / delete table rows | — | Reader and Data Access @ Storage (GUI operator) | — |
| View logs in Operations tab | — | Log Analytics Reader @ Workspace | — |
| Run Posture Check | Application.Read.All for service principal/app-role evidence |
Reader @ RG, Reader @ Subscription for subscription-scope and storage RBAC evidence, Reader and Data Access @ Storage unless table summary is skipped, Log Analytics Reader @ Workspace when operations telemetry is collected | Directory Readers, Application Administrator, Cloud Application Administrator, Privileged Role Administrator, or equivalent role for app-role evidence |
| Delete resources (Cleanup) | — | Contributor @ RG (Owner if deleting Resource Group) | — |
AdministrativeUnit.Read.All is the preferred least-privileged default for GUI AU validation. If Azure SSO returns an already-granted read/write or directory superset capability, such as Group.ReadWrite.All, Application.ReadWrite.All, AdministrativeUnit.ReadWrite.All, Directory.ReadWrite.All, or Directory.AccessAsUser.All, DUDE may accept it for read validation but does not request or use that broader scope.
Reader and Data Access note: This is a GUI operator role for table configuration. It includes listkeys and grants full data-plane access to all storage services in the account, not just the DUDE table. The Function App runtime Managed Identity uses Storage Table Data Contributor instead. For least privilege, deploy DUDE into a dedicated storage account. See docs/SECURITY.md and docs/SECURITY-REVIEW.md for details.
Posture Check note: Missing read permissions do not make Posture write or repair anything; affected evidence is reported as UNKNOWN or unavailable. See docs/SECURITY-REVIEW.md for DSEC-006/DSEC-007 interpretation, redaction behavior, and first-release evidence limitations.
Minimum for monitoring only (no deployment): GUI connect read scopes + Reader @ RG + Log Analytics Reader @ Workspace for Operations logs Full deploy + configure: GUI connect read scopes + Contributor @ RG + temporary RBAC role-assignment permission + supported Entra role for app-role assignment + Reader and Data Access @ Storage
How Granted: Tenant-wide admin consent for the Graph scopes DUDE uses. DUDE Manager uses the Azure SSO token for Graph and does not open a second Graph login prompt during normal connect. Deploy/Update can assign Managed Identity app roles only when the signed-in operator already has the documented deploy-time app-role assignment capability; DUDE does not add GUI delegated write scopes to compensate.
| Scope | Purpose |
|---|---|
Group.Read.All |
Read group properties and membership |
User.Read.All |
Resolve user identities |
Device.Read.All |
Resolve device identities |
GroupMember.ReadWrite.All |
Manage target device group memberships; broad app-level membership write risk |
DeviceManagementManagedDevices.Read.All |
Read Intune managed devices |
AdministrativeUnit.ReadWrite.All |
Manage admin unit memberships (optional — only if AU sync enabled) |
Machine.ReadWrite.All |
Read devices and tag in Defender (Defender API; optional — only if Defender sync enabled) |
Azure RBAC (Managed Identity)
In addition to Microsoft Graph application permissions, the Function App's Managed Identity requires Azure RBAC data-plane access to the Storage Account:
- Azure Table (DUDE) — read/write access via Azure RBAC
- DUDE table data-plane operations use Managed Identity tokens
- Azure Functions host/content storage settings on Consumption and Premium plans still use Function App storage connection settings; DUDE treats those values as secrets and redacts them from logs and exports
This completes the permission model:
Microsoft Graph for identity operations + Azure RBAC for platform and storage access.
How Granted: Setup tab -> Deploy/Update -> permissions assigned automatically. The deploying user must have a supported Microsoft Entra role for app-role assignment and an Azure SSO Graph token that can perform app-role assignment with that existing role; Privileged Role Administrator is the recommended operational role for this workflow. This deploy-time capability is separate from the GUI read scopes used for normal Connect, Configure, Operations, and Posture workflows.
GUI Graph access is read-capability only for DUDE operations. The GUI connect flow requires and validates delegated read capability from the Azure SSO Graph token for groups, administrative units, and applications. If the signed-in client already has broader delegated Graph scopes, DUDE may accept them as read capability equivalents, but it does not request those broader scopes and does not use delegated Graph writes. All Entra ID group membership writes are performed by the Function App's Managed Identity. Infrastructure deployment and table configuration use the GUI user's Azure RBAC roles — see Required Permissions for the full model.
See SECURITY.md for the complete security model
DUDE Manager has no built-in role system — access is controlled entirely by Azure RBAC and Graph API scopes. The following roles represent recommended permission sets for different responsibilities:
| Role | Setup | Configure | Operations | Cleanup | Permissions |
|---|---|---|---|---|---|
| Admin | Full | Full | Full | Full | Contributor @ RG, temporary RBAC role-assignment permission, supported Entra role for app-role assignment, GUI Graph read scopes |
| Operator | View | Full | Full | — | Reader @ RG, Reader and Data Access @ SA, Website Contributor @ FA, Log Analytics Reader @ Workspace, GUI Graph read scopes |
| Managed Identity | N/A | N/A | N/A | N/A | 5–7 application permissions (see above) |
Notes:
- Admin can revoke role-assignment and app-role assignment permissions after initial deployment — Owner, User Access Administrator, or Role Based Access Control Administrator is only needed for RBAC assignments (Steps 2/8), and the supported Entra app-role assignment role is only needed for permission assignments (Steps 8/9/10 as enabled). After revocation, Contributor @ RG is sufficient for ongoing deploy/update operations
- Operator has Website Contributor scoped to the Function App (not the entire RG). Graph scopes:
Group.Read.All,AdministrativeUnit.Read.All,Application.Read.All - Both roles share the same GUI. Tab access depends on the Azure permissions granted, not on application-level controls
DUDE Manager/
├── Start-DUDEManager.ps1 # Application launcher (PowerShell 7+)
├── Start-DUDEManager.cmd # Windows double-click launcher
├── LICENSE # MIT License
├── Module/ # PowerShell module (production runtime)
│ ├── DUDE-Manager.psd1 # Module manifest (version, exports)
│ ├── DUDE-Manager.psm1 # Module loader (dot-sources all functions)
│ ├── Functions/ # Public API (exported)
│ │ ├── Azure/ # Azure resource management
│ │ ├── Posture/ # Security posture checks and snapshot export
│ │ ├── Table/ # Table CRUD operations
│ │ └── Utilities/ # GUI entry point
│ ├── Private/ # Internal implementation
│ │ ├── Core/ # Logging, date conversion, hydration, cloud table
│ │ ├── Config/ # Security policies
│ │ ├── Security/ # Guards and validators
│ │ ├── Domain/ # Business logic + validation engine (Steps 1-12)
│ │ └── UI/ # WPF handlers, dialogs, helpers
│ └── Resources/ # Icons, logos, branding
├── AzureFunction/ # Azure Function deployment artifacts
│ ├── README.md # Function deployment guide
│ ├── DUDE_Timer/ # Timer-triggered function (scheduled)
│ ├── DUDE_Manual/ # HTTP-triggered function (on-demand)
│ ├── Modules/ # Shared PowerShell modules (12)
│ ├── Templates/ # App-level files (host.json, etc.)
│ │ ├── Profile.ps1 # Function App startup profile
│ │ └── requirements.psd1 # Empty; runtime uses repo-shipped REST modules
│ ├── VERSION.json # Runtime version (single source of truth)
│ └── ARTIFACTS.json # Integrity manifest (SHA256 hashes)
├── UI/ # WPF XAML and resources
│ ├── MainWindow.xaml # Main window layout
│ ├── Dialogs/ # Dialog XAML (message, group config, bulk edit)
│ └── Resources/ # WPF styles
├── docs/ # Developer documentation
│ ├── images/ # Screenshot assets
│ ├── ARCHITECTURE.md # Module design
│ ├── SECURITY.md # Security model
│ ├── SECURITY-REVIEW.md # Posture Snapshot checks and review guidance
│ ├── PRIVACY.md # PII handling, GDPR compliance
│ ├── TROUBLESHOOTING.md # Common issues, KQL queries
│ ├── RELEASING.md # Versioning, release checklist
│ └── CONTRIBUTING.md # How to contribute
├── .github/ # GitHub configuration
│ └── ISSUE_TEMPLATE/ # Issue templates
│ ├── bug_report.md # Bug report template
│ └── feature_request.md # Feature request template
├── CHANGELOG.md # Release history (GUI + Runtime)
├── CODE_OF_CONDUCT.md # Contributor Covenant 2.0
├── SECURITY.md # Security policy (links to docs/SECURITY.md)
├── .gitignore # Git ignore rules
├── .gitattributes # Git attributes (line endings, diff)
└── README.md # This file
DUDE Manager includes performance optimization settings for large-scale environments.
Safety setting:
DUDE_MAX_REMOVAL_PERCENT(default:25) — Global maximum percentage of members that can be removed from a group in a single sync run. If calculated removals exceed this threshold, removals are skipped and an error is logged. This protects against mass removal caused by empty or misconfigured source groups.
Per-group override: Individual groups can override the global threshold via the MaxRemoval column in the configuration table. Runtime accepts values from 1-100. The GUI provides the standard quick-select values 10, 15, 20, 25, 30, 50, 75, and 100%. When not set, the global DUDE_MAX_REMOVAL_PERCENT applies.
Controls the number of concurrent Graph API operations during device group synchronization.
| Setting | Value Range | Default | Description |
|---|---|---|---|
DUDE_MAX_CONCURRENCY |
1-16 | 4 (Consumption) / 6 (Dedicated/Premium) | Concurrent Graph API operations |
Guidelines:
- Small environments (< 1,000 devices): Use default (4)
- Medium environments (1,000-10,000 devices): Consider 8
- Large environments (> 10,000 devices): Consider 12-16
Trade-offs:
- Higher values = faster processing but more Graph API calls
- Lower values = slower processing but gentler on API rate limits
- If experiencing throttling (429 errors), reduce the value
Configure via GUI: Setup Tab → Runtime section → Max Concurrency dropdown
The authoritative DUDE Runtime version is determined by:
AzureFunction/VERSION.json(local file)AzureFunction/ARTIFACTS.json→runtimeVersionfield, which must matchVERSION.jsonfor release integrity
VERSION.json is the source of truth. ARTIFACTS.json must carry the same runtime version and matching hashes.
DUDE_RUNTIME_VERSION (Function App setting):
- REQUIRED setting (one of 19 required Function App settings)
- Must match the version in
AzureFunction/VERSION.json - Validation behavior:
- Missing → Warning / drift detected (deployment required)
- Mismatch with VERSION.json → Warning / drift detected (re-deployment required)
- Match → Success
- Purpose: Ensures deployed Function App files match the packaged DUDE Runtime version; prevents stale deployments
- Issues: GitHub Issues
- Troubleshooting: docs/TROUBLESHOOTING.md
- Security vulnerabilities: Private reporting
This project is licensed under the MIT License — see LICENSE for details.