What PSADT-Package Forge is allowed to do in your Intune tenant
Importing into Intune requires an app registration in Microsoft Entra ID. It is created in your own tenant, belongs to your own organisation and can be revoked at any time. This page lists in full which permissions are requested, what for — and what the application actually uses of them.
The requested permissions
| Permission | Type | Purpose |
|---|---|---|
DeviceManagementApps.ReadWrite.All |
Application permission | Create the Win32 app in Intune and upload the package content — exclusively for the import |
DeviceManagementRBAC.Read.All |
Delegated, read-only — not part of the app registration | Read existing scope tags (name and ID). Only if scope tags are used; via a user sign-in to Microsoft's own application "Microsoft Graph Command Line Tools" |
The app registration carries exactly one application permission; it requires admin consent. Scope tags are read separately: a user signs in in the browser, and the query runs with that user's rights, read-only. For this, the user needs an Intune role with read access to role-based access control. The consent dialog of the app registration additionally shows "Sign in and read user profile" (User.Read). Microsoft Entra adds this entry to every new app registration; PSADT-Package Forge does not use it. There are no further permissions — what is not listed here is not requested. The app registration is single-tenant and designed for your own tenant.
According to Microsoft, DeviceManagementApps.ReadWrite.All allows more than PSADT-Package Forge uses — including changing, deleting and assigning Intune applications. Microsoft does not offer a more granular permission. The application itself can only import: no management, no changes to existing packages, no deletion. Assignment to groups is done in the Intune portal.
What the application does not do
- No device management. No devices are read, enrolled, reset or configured.
- No user or group management. User accounts and directory objects are neither read nor changed. Groups are not assigned to an application — that is done in the Intune portal.
- No management of existing applications. Existing Intune applications are neither read nor changed nor deleted. Only what is currently being imported is created.
- No policies outside the app context. Compliance, configuration and update policies remain untouched.
- No API of its own. The app registration does not expose an API and defines no scopes and no app roles.
- No access by DBLAN. The app registration lives in the customer's tenant. DBLAN has no access to it.
Reversible in two minutes
The app registration is an ordinary object in your own Entra tenant. If it is disabled or deleted, all access ends immediately — regardless of whether the application remains installed. Intune applications that have already been imported are not affected; they belong to the tenant and remain in place.
Microsoft Entra admin center → App registrations → PSADT-Package Forge → Delete, or disable under Properties
Which data leaves your premises
| Process | What is transmitted | Recipient | When |
|---|---|---|---|
| Licence activation and update | Product key, user name, system name | DBLAN licence server | only on activation or update |
| Update check | Product GUID, product name, product version | DBLAN | at every program start |
| Support ticket from the application | details entered by the user | Support system | only when deliberately created |
| Intune import | Package data | Customer's Microsoft tenant | during import |
The update check transmits only product GUID, product name and product version — no user name, no system name, no package data. As with any request to a web address, the IP address of the requesting system is technically visible.
Packages, scripts, logs and package repositories do not leave your own network. There is no cloud storage and no telemetry on the use of individual features. For the import into Intune, the package data flows exclusively into the customer's tenant.
Network and firewall
Licence checks and updates require outbound access to https://*.psadt-packageforge.com. This one address belongs in your firewall, proxy and security policies. For the Intune import, the usual Microsoft Graph endpoints apply in addition.
One point that deserves to be stated openly
Client secret instead of certificate. Authentication currently uses a client secret so that several systems can use the same app registration. A switch to certificate-based authentication is planned.
Security contact: security@dblan.eu