On October 19 I found a Message Center post: Entra stops honoring layout CSS in company branding on October 26. The news listed ten properties. Learn lists 58, display included, so I built a scanner.

My Widget detection exits 0 with nothing on stdout, so Intune installs the app, can’t find it and reports 0x87D1041C. This index maps each portal symptom to the IntuneScriptLab command behind it.

REM-RETURN-EXIT has run hourly for three weeks, and its probe file holds 168 records, all detections. My validation kit deploys experiments like it to Proxmox VMs and reads them back.

My uptime detection returns 1 at script scope, so it exits 0, and its runtime test passes. The static check fails it on line 5. IntuneScriptLab’s gate and Pester assertions put both in a pull request.

I run Invoke-ScriptAnalyzer -Severity Error with IntuneScriptLab’s rules loaded, and every Intune record disappears, Errors included. The wrapper puts those rules in PSScriptAnalyzer’s own pass.

I set runRemediationScript to false, Graph reads it back that way, and both devices still run the fix every hour. IntuneScriptLab audits what the tenant holds against rules, git and what devices report.

The Enrollment Status Page closes while my user’s blocking app is still InProgress, and only AppWorkload.log records it. IntuneScriptLab reads the agent’s four CMTrace logs as objects and timelines.

Microsoft’s own cpuArchitecture filter example saves without complaint and drops every x64 Windows device, which reports amd64. My command checks a rule locally the way the service parsed and matched it.

A file rule set to “does not exist” saves in the portal and Graph, and the Intune agent never counts the app as installed. My harness checks Win32 detection, requirements and installs the way devices did.

My remediation prints success and exits 0 over a Set-ItemProperty error, and Intune calls it Failed. My harness runs scripts the way the agent does, as me, as SYSTEM or as another account, and now agrees.