Run Intune from one place: apps, hardening, compliance and change history.
MDO packages and tests your Windows apps, scores each tenant against CIS and the Essential Eight, records who changed what in Intune and Entra with the before and after, and puts things back when they break. Built for IT teams and MSPs who run Intune.
Free during the private beta. No agent on your devices and no packaging server to run.
- 157
- apps ready to deploy from the catalog
- 152
- of them installed, detected and uninstalled on a clean Windows 11 machine
- CIS v5 · E8
- plus four Microsoft security baselines, checked against your policies
- 13 months
- of change history for Intune and Entra, and of Activity in MDO
- $0
- of compute in your subscription for policy backups
What MDO takes off your plate
- The packaging machine
- No Windows VM to build installers on. MDO builds each app on its own servers, wraps it in PSAppDeployToolkit and uploads it to Intune for you.
- The audit spreadsheet
- Pick a standard and MDO shows each control, the policy that sets it and how many devices Intune says it reached. Hand the auditor a CSV or a printable view instead of a week of screenshots.
- "Who changed that?"
- Every Intune change, and the Entra changes that affect your devices, land in one history within about 15 minutes, with the person and the time. Open it to see the old and new values, from Intune's log or MDO's next copy of the policy.
- The deleted policy
- Intune has no undelete. MDO backs your policies up every night to your own Azure storage and restores them, with their settings and assignments, in a few clicks.
How it works
The steps in more detail-
01
Connect
An administrator approves MDO on Microsoft's own consent page. Nothing to install and no secret to copy.
-
02
See
When the first collection finishes, your apps, policies, devices, compliance score and recent changes are in one place.
-
03
Act
Deploy an app, create a baseline, revert a change or restore a policy. MDO writes to Intune only when someone asks it to, or when automatic revert is on for a protected policy.
-
04
Prove it
Export the compliance report or the change report for an auditor or a client.
Apps that deploy right the first time
Every catalog app marked Verified has been installed, detected and uninstalled on a clean Windows 11 machine, so fewer installs fail on Monday morning. Before anything downloads, MDO shows you the installer, the commands and the detection rule it will use.
After an app ships you can still change its assignments, detection and install settings, push a new version, or roll back to one of the last three.
152 tested catalog apps, about 11,900 Winget packages, Microsoft Store apps and your own MSI or EXE.
Microsoft 365 Apps has its own wizard: pick the edition, channel, languages and add-ons like Visio and Project, and MDO builds Office so Autopilot and detection behave.
More about appsKnow where each tenant stands
MDO scores the policies already in Intune against CIS v5, the Essential Eight and Microsoft's security baselines, control by control. You don't deploy anything first, and there's no agent.
Each control shows the policy that sets it, who it's assigned to and how many devices Intune says it reached. Where you choose not to meet a control, you record an exception with a reason, an approver and an expiry date.
More about complianceHarden without surprising your users
Baselines arrive in Intune unassigned, so nothing reaches a device until you choose, and you can read every setting in MDO first.
The sets you can deploy today follow CIS v4. MDO's CIS v5 sets keep the settings that break Autopilot out of the first pass and record why. You can read them in MDO now, and deploying them is coming next.
More about baselinesSee every change, and undo the bad ones
One history of what changed in Intune and Entra, who did it and what the setting was before. Get an alert when someone deletes a policy, widens an assignment or weakens a compliance policy, revert from the change itself, and protect the policies that must never change.
A deleted policy comes back from any nightly backup, with or without its assignments.
More about AuditBackups you own
Every night your policies go to a storage account in your own Azure subscription. MDO keeps an index of the backup files so it can find a policy for you. It holds no storage keys.
Five policy categories, 90 days kept by default, and $0 of compute in your subscription.
How backups workHow MDO treats your tenant
Permissions, backups, roles and data- MDO reads your tenant on its own schedule and writes to Intune only when someone on your team asks it to, and the server checks their role first. The one exception is automatic revert of a protected policy, which is off until you turn it on.
- Your backups live in your storage account. MDO keeps the credential to write there, encrypted, and no storage keys.
- Before MDO changes an app's commands, detection or package, it backs the app up. If the backup fails, nothing changes.
- Every action in MDO, by your team or by MDO on a schedule, is in Activity for 13 months.
- When VirtualCaffeine staff open your tenant to help you, they give a reason, and it shows in your Activity.
-
Update policy and rings for each app
New versions reach a pilot group first, then everyone, so a bad update stops at a few devices.
-
Discovered apps
Take over updates for apps already on your devices without installing them anywhere new.
-
CIS v5 sets you can deploy
MDO Hardening, built so Autopilot keeps working, deployed from the Baselines page.
-
Fix
Add only the CIS controls your current policies miss, after showing any conflict.
Pricing
Free during the private beta.
We'll tell beta users about pricing at least 60 days before it starts, and tenants that join during the beta keep a beta rate.
Free during the private beta. Tell us about your tenant and Aaron will get back to you.