Extract your Intune configuration from HAR files!

Many IT professionals struggle with capturing and analyzing Intune configuration data for documentation, backup, or troubleshooting purposes. While Microsoft Graph API provides programmatic access, sometimes you need a quick way to extract configuration data directly from the Intune web portal. This blog post demonstrates a simple powershell solution that leverages HAR files to extract JSON configuration data from browser network traffic.

Understanding HAR Files and Intune Data Flow

What are HAR Files?

HTTP Archive (HAR) files capture detailed information about web page loading performance and network requests. Modern browsers like Edge and Chrome can export HAR files containing all HTTP requests, responses, and metadata from a browsing session. Important ! This captures also some sensitive data !

Intune’s Data Architecture

When you navigate through the most of Microsoft admin centers, the portal makes numerous Graph API calls to retrieve configuration data. These calls return JSON responses containing everything, we will focus on device management policies, compliance settings, and configuration profiles. The data structure typically follows Microsoft Graph’s OData format:

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceManagement/configurationSettings",
  "@odata.type": "#microsoft.graph.deviceConfiguration",
  "value": [...]
}

Implementation: PowerShell HAR Parser

Core Script Structure

Here’s the enhanced version of the PowerShell script for extracting Intune JSON data:

# Load the HAR file
$harFilePath = "C:\Temp\intune.microsoft.com.har"
$harContent = Get-Content -Path $harFilePath -Raw | ConvertFrom-Json

# Create output directory if it doesn't exist
$outputDir = "C:\Temp\json"
if (-not (Test-Path $outputDir)) {
    New-Item -ItemType Directory -Path $outputDir -Force
}

# Initialize counter for file naming
$counter = 1

# Define common Microsoft Graph API patterns for Intune
$graphPatterns = @(
    '"https://graph\.microsoft\.com/beta/\$metadata#deviceManagement/configurationSettings"',
    '"https://graph\.microsoft\.com/beta/\$metadata#deviceManagement/deviceConfigurations"',
    '"https://graph\.microsoft\.com/beta/\$metadata#deviceManagement/deviceCompliancePolicies"',
    '"https://graph\.microsoft\.com/beta/\$metadata#deviceManagement/windowsInformationProtectionPolicies"',
    '"https://graph\.microsoft\.com/beta/\$metadata#deviceManagement/managedAppPolicies"',
    '"https://graph\.microsoft\.com/beta/\$metadata#deviceManagement/conditionalAccessSettings"',
    '"https://graph\.microsoft\.com/beta/\$metadata#deviceManagement/deviceEnrollmentConfigurations"'
)

# Process each HAR entry
foreach ($entry in $harContent.log.entries) {
    $responseText = $entry.response.content.text
    
    # Skip empty responses
    if ([string]::IsNullOrEmpty($responseText)) { continue }
    
    # Check against all defined patterns
    foreach ($pattern in $graphPatterns) {
        if ($responseText -match $pattern) {
            try {
                # Validate JSON structure
                $jsonObject = $responseText | ConvertFrom-Json
                
                # Extract meaningful filename from URL or content type
                $requestUrl = $entry.request.url
                $configType = "unknown"
                
                if ($requestUrl -match "deviceConfigurations") { $configType = "deviceConfig" }
                elseif ($requestUrl -match "deviceCompliancePolicies") { $configType = "compliance" }
                elseif ($requestUrl -match "windowsInformationProtection") { $configType = "wip" }
                elseif ($requestUrl -match "managedAppPolicies") { $configType = "appProtection" }
                elseif ($requestUrl -match "conditionalAccess") { $configType = "conditionalAccess" }
                elseif ($requestUrl -match "deviceEnrollment") { $configType = "enrollment" }
                
                # Create descriptive filename
                $jsonFilePath = "$outputDir\${configType}_$counter.json"
                
                # Save formatted JSON
                $jsonObject | ConvertTo-Json -Depth 10 | Out-File -FilePath $jsonFilePath -Encoding UTF8
                
                Write-Host "Extracted: $jsonFilePath" -ForegroundColor Green
                $counter++
                
                break # Exit pattern loop once matched
            }
            catch {
                Write-Warning "Failed to process JSON for entry $counter`: $_"
            }
        }
    }
}

Write-Host "JSON export complete. Total files: $($counter - 1)"

Advanced Pattern Matching

The script includes patterns for various Microsoft Graph endpoints commonly used in Intune:

Device Configurations: Settings profiles, administrative templates
Compliance Policies: Device compliance requirements
App Protection Policies: Mobile application management settings
Windows Information Protection: Enterprise data protection policies
Conditional Access: Azure AD conditional access integration
Enrollment Configurations: Device enrollment restrictions and settings

Test the same following next 3 steps:

Step 1: Capture HAR File

Open Microsoft Edge or Chrome
Navigate to the Microsoft Intune admin center
Open Developer Tools (F12)
Go to the Network tab
Navigate through Intune sections you want to capture
Right-click in Network tab → Save all as HAR with content

Step 2: Execute PowerShell Script

# Set execution policy if needed
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

# Run the extraction script
.\Extract-IntuneHARData.ps1

Step 3: Analyze Extracted Data

The extracted JSON files contain complete configuration data that can be:

Imported into documentation systems
Used for configuration comparison
Archived for compliance purposes
Analyzed for security auditing

Common Issues and Solutions

Empty Response Content

Some HAR entries have empty response text Solution: Add null/empty checks before processing

if ([string]::IsNullOrEmpty($responseText) -or $responseText.Length -lt 10) { 
    continue 
}

Malformed JSON

Response contains HTML or partial JSON Solution: Implement JSON validation

try {
    $jsonObject = $responseText | ConvertFrom-Json
    if (-not $jsonObject.'@odata.context') {
        Write-Warning "Invalid Graph API response format"
        continue
    }
}
catch {
    Write-Warning "Invalid JSON structure: $_"
    continue
}

Large HAR Files

HAR files can become very large with many network requests Solution: Filter by specific domains or response sizes

This HAR-based extraction method provides a simple and powerful way to capture Intune configuration data without complex API authentication. The PowerShell script can be customized for specific organizational needs and integrated into documentation workflows. While this approach is excellent for ad-hoc analysis and backup scenarios, consider implementing proper Graph API integration for automated, production-scale configuration management.

The extracted JSON data provides valuable insights into your Intune environment and can serve as a foundation for configuration analysis, compliance reporting, and change management processes.