### FILE: index.php
<?php
/**
 * M365 SaaS Engine Dashboard for Intune APP Compliance
 */
$policyId = 'Your-Policy-ID';
$endpoint = "/deviceAppManagement/managedAppPolicyDeploymentSummaries/$policyId";

$response = $ms->graphCall($endpoint, $_SESSION['ms_access_token'], 'GET');
$deployedCount = $response['deployedUserCount'] ?? 0;

echo render_premium_card('APP Deployment Health', (string)$deployedCount, 'Active Users', 'up', '🛡️', ($deployedCount > 0 ? 100 : 0));
?>

### FILE: scripts/Audit-IntuneAppCompliance.ps1
<#
.SYNOPSIS
    Audits the deployment health of Microsoft Intune App Protection Policies.

.DESCRIPTION
    Queries the Graph API to verify if the specified APP policy is reaching target users.

.EXAMPLE
    .\Audit-IntuneAppCompliance.ps1 -ManagedAppPolicyId "abc-123-def"

.NOTES
    Author:      Souhaiel Morhag
    Company:     MSEndpoint.com
    Blog:        https://msendpoint.com
    Academy:     https://app.msendpoint.com/academy
    LinkedIn:    https://linkedin.com/in/souhaiel-morhag
    GitHub:      https://github.com/Msendpoint
    License:     MIT
#>
param(
    [Parameter(Mandatory=$true)]
    [string]$ManagedAppPolicyId
)

try {
    Write-Host "Querying deployment summary for policy: $ManagedAppPolicyId" -ForegroundColor Cyan
    $status = Get-MgDeviceAppManagementManagedAppPolicyDeploymentSummary -ManagedAppPolicyId $ManagedAppPolicyId
    
    if ($status.DeployedUserCount -eq 0) {
        Write-Warning "Policy is not reaching any target users."
        return $false
    }
    
    Write-Host "Deployment healthy. Active users: $($status.DeployedUserCount)" -ForegroundColor Green
    return $true
} catch {
    Write-Error "Failed to connect to Microsoft Graph: $($_.Exception.Message)"
    exit 1
}

### FILE: scripts/Assign-AppProtection.ps1
<#
.SYNOPSIS
    Assigns an Intune App Protection Policy to a target Entra ID Group.

.DESCRIPTION
    Uses Microsoft Graph to apply an APP policy to a specific security group.

.NOTES
    Author:      Souhaiel Morhag
    Company:     MSEndpoint.com
    Blog:        https://msendpoint.com
    Academy:     https://app.msendpoint.com/academy
    LinkedIn:    https://linkedin.com/in/souhaiel-morhag
    GitHub:      https://github.com/Msendpoint
    License:     MIT
#>
param(
    [Parameter(Mandatory=$true)] [string]$PolicyId,
    [Parameter(Mandatory=$true)] [string]$GroupId
)

$uri = "https://graph.microsoft.com/beta/deviceAppManagement/iosManagedAppProtections/$PolicyId/assign"
$body = @{
    assignments = @(@{
        target = @{
            "@odata.type" = "#microsoft.graph.groupAssignmentTarget"
            groupId = $GroupId
        }
    })
} | ConvertTo-Json -Depth 10

try {
    Invoke-MgGraphRequest -Method POST -Uri $uri -Body $body
    Write-Host "Successfully assigned policy $PolicyId to group $GroupId" -ForegroundColor Green
} catch {
    Write-Error "Assignment failed: $($_.Exception.Message)"
}