intune-container

Run Microsoft Intune in an isolated, rootless Linux container, with seamless Entra ID single sign-on in your host browser — and the container kept headless by default so it has no window into your screen.

Works on any Wayland compositor (niri, Hyprland, Sway, GNOME, KDE) and on X11.

• Quickstart — install, enroll, enable SSO.
• Capabilities — what each command does.
• Architecture — how it fits together (diagrams).
• Roadmap — network isolation and what's next.

Why

Intune's Linux agent and the Microsoft identity broker are desktop apps that make broad changes to a host. Running them in a dedicated, rootless container keeps your host clean — no host root and no sudo — while a small native-messaging bridge lets your everyday browser use the container's enrollment for SSO to Teams, Outlook, and other M365 apps.

Requirements

A Linux host with unprivileged user namespaces enabled, a /etc/subuid + /etc/subgid range for your user, newuidmap/newgidmap (the uidmap/shadow package), and cgroup v2. No sudo, systemd-nspawn, machinectl, nsenter, Docker, or Podman. Building from source also needs Rust, just, and Node.js + npm. See Architecture for the isolation model.