Bulk assignment plans
Select many resources, build one assignment plan, preview it, and apply the same logic across the selected set instead of repeating the same portal steps over and over.
SAB Assign
A Mac-native control desk for bulk Intune assignment work.
SAB Assign helps Microsoft Intune administrators select many resources at once, inspect current assignments, build one assignment plan, and apply or remove matching assignments across apps, settings catalog policies, configuration profiles, and compliance policies in a controlled workflow.
Highlights
Built for safer tenant changes when one-by-one assignment work is too slow.
Bulk unassign matching
Remove only the assignments that match your selected scope, groups, intent, and filters without blindly wiping everything.
Evidence export
Export the assignment plan and activity log as evidence for change control, review, rollback planning, and audit records.
Mock mode included
Learn the workflow safely with built-in sample data before switching to live Microsoft Graph access for production work.
Coverage
One app for the assignment-heavy parts of Intune administration.
SAB Assign focuses on the areas where administrators often need to apply the same targeting logic across many objects:
- Mobile apps across Win32, Store, LOB, and web link types
- Settings Catalog configuration policies
- Device configuration profiles
- Device compliance policies
- Include and exclude group targeting
- Assignment filter include or exclude modes
Workflow
Designed around the real sequence of assignment change work.
The app is structured around a practical admin loop rather than a generic browser shell:
- Start in mock mode or connect live through Microsoft Graph
- Browse apps, settings catalog, configuration profiles, or compliance policies
- Inspect current assignments on a selected item before changing anything
- Build one assignment plan with scope, groups, intent, and filters
- Preview the plan and confirm before applying or unassigning
- Review per-item results and export evidence for the run
Security
Credential handling is kept narrow and explicit.
Secrets stay in Keychain
Tenant ID and Client ID are stored locally as profile data, while the Client Secret is stored in the macOS Keychain.
Tokens stay in memory
OAuth tokens are cached in memory only and refreshed automatically before expiry or reacquired after 401 responses.
Sandboxed network use
The app is designed for outgoing Microsoft identity and Graph traffic only, with no incoming connections or unrelated hardware access.
Operator-first checks
Mock mode, confirmation dialogs, evidence export, and per-item run results are all part of the safety story, not afterthoughts.
Community
Questions and feedback can now live in public discussions.
SAB Assign now has a public GitHub Discussions space so administrators can ask questions, share feedback, and discuss workflows in a more visible place than email alone.
- Discussions for questions, setup help, and general feedback
- Support page for contact details, release status, and guide links
- User guide for the full workflow reference
Documentation
The guide is the main starting point until screenshots are added.
User Guide
The guide covers setup, Microsoft Graph access, browsing resources, inspecting assignments, building plans, applying, unassigning, exporting evidence, troubleshooting, and operational best practices.
Support Page
The support page gives you the current contact route, release status, and what information is useful when asking for help.
Availability
Prepared for public release, with Apple App Store review as the current path.
SAB Assign is currently being prepared for App Store Connect. This page exists now so administrators have a stable home for product information, support, privacy details, and the full guide before the public release is live.
- Mac App Store submission in progress
- Website pages ready for support and privacy
- Screenshots can be added here once they are prepared
- Public GitHub Discussions is now available for feedback and questions