Intune Lens: fewer clicks, more device context

Open the device, wait for the blade, check two fields, go back to the list. Then do it again for the next device. If you work in Intune, this is probably familiar. The data is there, but getting a quick answer can take a surprising amount of navigation.

Intune Lens adds hover cards to the Intune admin center through a Manifest V3 browser extension. Devices, users, apps and policies can show selected compliance, assignment, hardware, group or Autopatch details where you are already working. There is no separate service to host. The extension stays in the browser.

Why a browser extension?

The portal makes this a little more involved than adding a tooltip. It is a single-page application, and blade content can sit inside sandboxed cross-origin frames. A script looking for one stable DOM tree will miss some of it. Sending the operator into another detail page to fill the gap would rather defeat the point.

Content scripts find supported list pages and match visible names to objects. An injected page-context script can observe portal responses and relay lookup data; the service worker handles Graph and Autopatch calls. As described in the README, the worker shares results with scripts inside the blade frames, and those scripts render the card when the pointer reaches a matching object.

Lists also replace DOM nodes as you scroll, so a MutationObserver keeps the extension up to date. A small convenience for the operator ends up needing quite a lot of plumbing. This part is very recognisable to anyone who has tried to make an admin portal save one click.

The request and rendering path

Object responses stay in the service worker's memory cache for five minutes, up to 300 entries. For authentication, the extension captures Graph and Autopatch bearer tokens from the signed-in portal's requests. It keeps them in chrome.storage.session and treats them as stale after 45 minutes.

These are the user's session credentials, not credentials from a separate app registration. They let the extension call the services the portal is already using. That is convenient, but it is also the part I would review most carefully.

Code excerpt: keep session data short-lived

Here are the time limits and volatile token lookup from background.js, abbreviated. There is no request authorization header in this excerpt.

const CACHE_TTL = 5 * 60 * 1000;
const TOKEN_MAX_AGE = 45 * 60 * 1000;
const MAX_CACHE_ENTRIES = 300;

const { authToken, tokenTimestamp } = await chrome.storage.session.get([
  'authToken', 'tokenTimestamp'
]);
if (!authToken || Date.now() - (tokenTimestamp || 0) > TOKEN_MAX_AGE) {
  throw new Error('No valid token. Browse the Intune portal so the extension can capture one.');
}

A hover card does not make tenant data less sensitive. The extension operates with the authority of the current browser session. Review its code and permissions as you would another privileged administration tool, even if its visible job is only to save some navigation.

Permission and privacy considerations

The requested permissions include webRequest, storage, and access to Intune, Graph, Autopatch and the portal's blade hosts. The design needs those permissions despite having no backend or separate app registration. Install only a reviewed, trusted build. While valid, the captured tokens are bearer credentials: do not log them, copy them into diagnostics or send them to an unrelated endpoint.

The project says session storage is volatile across browser restarts and that tokens are not sent to external servers. I would still check the source and requested permissions, use an approved browser profile, and apply the tenant's normal data-handling rules. Device, user, group and compliance details remain those details, whether they appear in a full blade or a small card.

Intune Lens is MIT-licensed and has no build step. The repository contains the extension files and its installation guide; this walkthrough refers to the pinned revision c7d02c4. It saves clicks, not the administrator from checking whether the right device was selected.