Your PowerShell, turned into guarded self-service.
RealmJoin syncs a curated library of 175 runbooks into your own Azure Automation account, builds a form for each script, and decides who may run what. Every job leaves a log.
- 175 runbooks, open source
- Runs in your Azure subscription
- Permissions down to the target group
- New runbooks every month
175 runbooks you don't have to write
The library is open source on GitHub. RealmJoin syncs it into your Automation account, keeps it current as new releases ship every month, and runs your own runbooks right next to it.
| Runbook |
|---|
| ScheduledCleanup Autopilot devices |
| ScheduledDelete stale devices |
| ScheduledAuto-approve driver updates |
| ScheduledNotify users about low disk space |
| ScheduledReport devices without primary user |
| ScheduledReport expiring application credentials |
| ScheduledMonitor pending EPM requests |
| ScheduledSync MFA-secure users to group |
| Backup Conditional Access policies |
| Notify changed CA policies |
| List inactive users |
| Invite external guest users |
| Add shared mailbox |
| Export all Intune devices |
| Check SharePoint and OneDrive status |
| Offboard user permanently |
| Offboard user temporarily |
| Create temporary access pass |
| Reset MFA |
| Revoke or restore access |
| Confirm or dismiss risky user |
| Convert to shared mailbox |
| Delegate full access |
| Set out of office |
| Set Teams Phone |
| Assign Windows 365 |
| Resize Windows 365 |
| Check Intune enrollment readiness |
| Assign groups by template |
| List sign-in events |
| Wipe device |
| Outphase device |
| Rename device |
| Set primary user |
| Wipe managed app data |
| Check device compliance |
| Isolate or release device |
| Restrict or release code execution |
| Check Defender status |
| Show BitLocker recovery key |
| Show FileVault recovery key |
| Show LAPS password |
| Reset mobile device PIN |
| Toggle drain mode |
| Restart host |
| Add or remove user |
| Add or remove owner |
| Add or remove nested group |
| Rename group |
| Change visibility |
| List all members |
| List user devices |
| Remove group |
| Enable or disable external mail |
| Show or hide in address book |
| Archive team |
| ScheduledUnenroll updatable assets |
A few runbooks from each scope. Organization, 96 runbooks: General 39, Devices 19, Security 15, Mail 10, Applications 9, Collaboration 3, Phone 1.
User, 43 runbooks: Mail 13, General 12, Security 9, Phone 5, User info 3, AVD 1.
Device, 22 runbooks: General 12, Security 8, AVD 2.
Group, 14 runbooks: General 9, Mail 2, Devices 2, Teams 1.
Synced from GitHub
From the
productionbranch by default, prefixedrjgit-, added, updated and removed to match the library.Modules handled
Required modules are read from each script and installed from the PowerShell Gallery, dependencies included.
Managed runtime
A PowerShell 7.4 environment with Az and Azure CLI, in your Automation account.
The form writes itself
RealmJoin reads the parameter block and comment-based help of every script. Use-RJInterface annotations turn parameters into user, group and device pickers backed by Microsoft Graph, into number, date and text fields, or into tenant settings. ValidateSet becomes a dropdown.
- Mandatory fields are checked before a job starts
- Per tenant, hide, rename, reorder or preset any field
- Conditional rules: pick an option, other fields change
- The caller's name is passed in for the audit trail
What RealmJoin renders from the script. Parameters combined from two library runbooks for illustration.
param ( [Parameter(Mandatory = $true)] [ValidateScript( { Use-RJInterface -Type Graph -Entity User -DisplayName "User" } )] [String] $UserName, [ValidateScript( { Use-RJInterface -Type Graph -Entity User -DisplayName "Who should step in as group/resource owner?" } )] [String] $ReplacementOwnerName, [bool] $ReplaceManagerReferences = $false, [ValidateSet("WhatIf (report only)", "Delete")] [string] $DeleteMode = "WhatIf (report only)")
Who may run what, down to the target
Runbook permissions are one JSON document per tenant. Roles map to Entra groups and allow runbooks by name pattern. Target groups can restrict a role further, so first-level support may show local admin passwords for Sweden, but nowhere else. Scheduling gets its own allow and deny patterns.
- Enable or disable whole families with wildcards
- Restrict roles per target group, not just per runbook
- Comments and trailing commas allowed, so it stays readable
{ "EnabledRunbookPatterns": [ "rjgit-*_mail_*", "rjgit-*_security_*" ], "DisabledRunbookPatterns": [ "*password*" ], "Roles": { "LAPSAdmin": { "Groups": [ /* CFG - RealmJoin Admin */ "724c288d-…" ], "AllowedRunbookPatterns": [ "rjgit-*_security_*" ] }, "DeviceAdmin": { "Groups": [ /* Sweden Supporters */ "52fcd199-…" ], "AllowedRunbookPatterns": [ "rjgit-device_*" ] } }, "TargetEntityGroups": { /* Sweden Users: LAPS only for Sweden Supporters */ "ca03f227-…": { "RestrictRoles": { "LAPSAdmin": [ "52fcd199-…" ] } } }, "SchedulingDisabledRunbookPatterns": [ "rjgit-device_*" ]}
Schedules in your time zone
Hourly, daily, weekly and monthly schedules come ready, all in your tenant's time zone, and you can add your own.
- Scheduled jobs listed next to manual ones
- Allow or block scheduling per runbook pattern
Built to run unattended
34 library runbooks are built for it: cleanup, reporting and monitoring that nobody should have to start by hand.
- Reports by email or as a time-limited download link
- Every scheduled run in the job history and your Log Analytics workspace
On-premises too Preview
Some jobs still live on-premises: a file share, an Active Directory attribute, a legacy app. Runbooks whose names end in _hybrid can run on a Hybrid Runbook Worker group in your network. When you start one, you pick the worker group; everything else stays the same.
Available on the RealmJoin staging portal while in preview.
A remediation library, staged and measured
RealmJoin syncs curated Intune remediation scripts from its public GitHub repository every night. Subscribe to one, stage it, deploy it to managed groups on a schedule, then watch detection and remediation results per device. Need it now on one machine? Run it from the device page.
- Unmanaged, managed, staged, deployed and deprecated at a glance
- Detection and remediation source side by side
- Scripts removed upstream are kept while you still use them
Forms for everyone else
Not every request is a runbook. Self-service forms are built from a JSON schema with a translation file, show up for employees as corporate forms, and send each submission by email or to a webhook, for example your ITSM tool or a Teams flow. Every response is kept in a history.
- Multilingual through a translation file
- Email recipient and optional webhook per form
- Form history for admins, responses on the user page
Start runbooks from anywhere
The Customer API runs runbooks synchronously or in the background and returns job status, output text, output streams and exceptions. Your ITSM can offboard a leaver from the ticket that asked for it.
Run and wait
Synchronous call that returns when the job ends, for jobs up to an hour.
Start in the background
Returns a job ID at once; poll status when you need it.
Job status
Queued, running, completed or failed.
Output
Plain output text or all output streams.
Exceptions
The exception text when a job fails.
Nightly log export
Finished jobs land in your Log Analytics workspace at 23:00. Customer API reference
Privileged access
Roles, custom permissions and local admin access.
Developers
Customer API, MCP server and PowerShell module.
Helpdesk & operations
Runbooks right on the user, group and device pages.
Retire the scripts folder.
Connect Azure Automation, sync the library, and hand the first runbook to helpdesk with the right guardrails.