v0.1.30 — Policy-Bulk-Import gehaertet, macOS-Apps, Gruppen-Suche & Direkt-Zuweisung

- Bulk-Import von Policies (Batches + Fortschritt, Fehler-Isolierung)
- Export/Import-Treue via Raw-JSON (-OutputType Json), null-Collections-Strip,
  Settings-Catalog-Reparatur + Korruptions-Erkennung, Git-Resolver
- macOS-Apps in Liste/Suche + Plattform-Filter
- "Gruppe"-Tab durchsucht alle Gruppen (Live-Suche) statt nur Praefix-Gruppen
- Bestehende Gruppe(n) direkt an Apps zuweisen inkl. Mehrfachauswahl
- Fix: Add-GraphAppAssignment merged bestehende Zuweisungen (/assign ersetzt sonst
  die komplette Liste) -> kein Ueberschreiben mehr, ein Request fuer alle Ziele

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,59 @@ Versionierung folgt [Semantic Versioning](https://semver.org/lang/de/) — solan
 
 ---
 
+## [0.1.30] - 2026-09-03
+
+Policy-Bulk-Import gehärtet, macOS-Apps, Gruppen-Suche & Direkt-Zuweisung an Apps.
+
+### Neu
+
+- **Bulk-Import von Policies**: Mehrere Policy-Dateien (oder eine Bundle-Datei) auf einmal importieren. Läuft server-seitig in Batches à 5 mit Fortschrittsanzeige und Fehler-Isolierung pro Batch — umgeht das 180-s-Timeout einzelner Requests.
+- **macOS-Apps** erscheinen jetzt in App-Liste und -Suche (DMG, PKG, LOB, Defender, Edge, M365, VPP) mit eigenen Typ-Labels. Neuer **Plattform-Filter** (Alle / Windows / macOS).
+- **Gruppen-Suche** im Ziel-Panel: Der frühere „Abteilung"-Tab heißt jetzt **„Gruppe"** und durchsucht per Live-Suche **alle** Tenant-Gruppen (statt nur Präfix-Gruppen). Auswahl bleibt über mehrere Suchen erhalten.
+- **Bestehende Gruppe(n) direkt einer App zuweisen**: Im Dialog „Zuweisung hinzufügen" neue Option „Bestehende Gruppe" (Required/Available) mit Gruppensuche und **Mehrfachauswahl** (Chips).
+
+### Behoben
+
+- **App-Zuweisung überschrieb bestehende Zuweisungen**: `Add-GraphAppAssignment` nutzte die `/assign`-Action mit nur einer Zuweisung — diese ersetzt aber die komplette Liste. Jetzt werden bestehende Zuweisungen geladen, neue gemergt (Duplikate übersprungen) und in **einem** Request geschickt. Behebt sowohl die Mehrfach-Zuweisung als auch stillen Verlust vorhandener Zuweisungen beim Einzel-Hinzufügen.
+- **Policy-Export/-Import-Treue** (Windows PowerShell 5.1): Policy-Details werden als **rohes JSON** von Graph geholt (`-OutputType Json`), sonst skalarisierte der Hashtable-Modus Ein-Element-Collections (z. B. `printerNames`) → 400 beim Re-Import.
+- **Configuration-Profile-Import**: `null`-Werte für nicht-nullbare Collections werden entfernt (400 `ModelValidationFailure`).
+- **Settings-Catalog-Import**: Reparatur leerer/verstümmelter Collections (`[""]`, `{}`), Rettung stringifizierter `*TemplateReference`-Felder und **klarer Abbruch** bei irreparabel beschädigten Quelldateien (alte Exporte mit zu geringer JSON-Tiefe).
+- **Git-Snapshot**: `git` wird jetzt auch über bekannte Installationsorte gefunden, falls es nicht im (veralteten) PATH des Server-Prozesses liegt.
+
+---
+
+## [0.1.29] - 2026-08-24
+
+Geräte-Offboarding (v1).
+
+### Neu
+
+- **Geräte-Offboarding** als neue Ansicht: Geräte über **Intune, Autopilot und Entra ID** hinweg entfernen (Decommissioning). Portiert aus dem [Device Offboarding Manager](https://github.com/ugurkocde/DeviceOffboardingManager) von Ugur Koc (MIT-Lizenz).
+  - Suche per Gerätename/Seriennummer, Auflösung der IDs über alle drei Dienste (`$batch`)
+  - **Recovery-Keys vor dem Löschen**: BitLocker/FileVault und LAPS-Passwörter werden angezeigt
+  - Bestätigungs-Dialog mit Dienst-Auswahl (Entra löschen/deaktivieren, Intune, Autopilot), Pflicht-Bestätigung und Ergebnis-Liste; **403/Multi-Admin-Approval** wird abgefangen
+  - Im **Read-Only-Modus gesperrt**
+  - Neue Endpoints: `GET /api/offboard/search`, `POST /api/offboard/keys`, `POST /api/offboard/execute` (neues Modul `src/Offboard.ps1`)
+  - Zusätzliche Berechtigungen dokumentiert; Setup-Skript-Schalter `-IncludeOffboarding`. (MDE-Offboarding bewusst nicht in v1.)
+
+---
+
+## [0.1.28] - 2026-08-24
+
+Umbenennen beim Import, UI-Fixes, Geräte-Export repariert.
+
+### Neu
+
+- **Umbenennen beim Import**: Vor dem Anlegen kann jeder importierten Policy im neuen Dialog „Policies importieren" ein anderer Name gegeben werden (das richtige Namensfeld je Typ — `name`/`displayName` — wird gesetzt).
+
+### Behoben
+
+- **Geräte-Export im App Report**: Der von Graph entfernte synchrone Endpoint `getDeviceInstallStatusReport` (400 „Resource not found for the segment") ist durch den asynchronen Export-Job **`DeviceInstallStatusByApp`** ersetzt (ZIP/CSV-Auswertung, tolerantes Spalten-Mapping). ZIP/CSV-Logik in `Get-IntuneReportRows` ausgelagert.
+- **Darkmode-Kontrast** im Zuweisungs-Dialog: Gruppen-Chips nutzen jetzt die Theme-Variablen (`--surface-strong`/`--ink` statt fester heller Farben) — heller Text auf hellem Chip behoben.
+- **Dialog-Breite**: Lange Policy-Namen im Zuweisungs-/Import-Dialog brechen jetzt um (`overflow-wrap`/`flex-wrap`) statt horizontal zu scrollen; das Fenster passt sich der Breite an.
+
+---
+
 ## [0.1.27] - 2026-08-23
 
 Policy-Import härter, Administrative Vorlagen, Zuweisung nach Import, Git-Snapshot, App-Registrierungs-Doku.

Start.ps1

@@ -137,6 +137,7 @@ if (-not $SkipModuleCheck) {
 . (Join-Path $root "src/Graph.ps1")
 . (Join-Path $root "src/Api.ps1")
 . (Join-Path $root "src/PolicyIO.ps1")
+. (Join-Path $root "src/Offboard.ps1")
 . (Join-Path $root "src/Router.ps1")
 . (Join-Path $root "src/Server.ps1")
 
@@ -188,7 +189,7 @@ $script:State = [pscustomobject]@{
     Session        = @()      # geplante Zuweisungen
 }
 
-$script:ToolVersion = "0.1.27"
+$script:ToolVersion = "0.1.30"
 $script:BuildStamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
 
 Write-Host ""

docs/App-Registration.md

@@ -42,6 +42,26 @@ Nur nötig, wenn der **Geräte-Tab** (Sync/Reboot/Lock/Diagnose/Wipe/Retire) gen
 | `DeviceManagementManagedDevices.ReadWrite.All` | Sync, Neustart, Remote-Lock, Diagnose, BitLocker-Key-Rotation |
 | `DeviceManagementManagedDevices.PrivilegedOperations.All` | Wipe, Retire, Autopilot-Reset |
 
+### Geräte-Offboarding (optional)
+
+Nur nötig, wenn die **Offboarding**-Ansicht (Geräte aus Intune + Autopilot + Entra
+entfernen, Recovery-Keys lesen) genutzt wird:
+
+| Berechtigung | Wofür |
+|---|---|
+| `Device.ReadWrite.All` | Gerät aus Entra ID löschen/deaktivieren |
+| `DeviceManagementManagedDevices.ReadWrite.All` | Gerät aus Intune löschen |
+| `DeviceManagementServiceConfig.ReadWrite.All` | Gerät aus Autopilot löschen |
+| `BitlockerKey.Read.All` | BitLocker-Recovery-Keys lesen |
+| `DeviceLocalCredential.Read.All` | LAPS-Passwörter lesen |
+
+> **Wichtig:** Löschen aus Entra/Intune/Autopilot benötigt bei delegierter
+> Anmeldung zusätzlich **Verzeichnis-/Intune-Rollen** (Cloud Device Administrator
+> bzw. Intune Administrator) — die Scopes allein reichen nicht, sonst `403`.
+> Diese Scopes müssen außerdem in den **Read/Write-Scopes** des Tools eingetragen
+> sein (Einstellungen → Verbindung), damit sie im Token landen.
+> Skript: `.\docs\Setup-AppRegistration.ps1 -IncludeOffboarding -GrantAdminConsent`
+
 ### Read-Only-Variante
 
 Für eine reine Anzeige-App (im Tool als `clientIdRo` hinterlegbar) genügen die

docs/Setup-AppRegistration.ps1

@@ -61,6 +61,7 @@ param(
     [switch]$MultiTenant,
     [switch]$ReadOnly,
     [switch]$IncludeDeviceActions,
+    [switch]$IncludeOffboarding,
     [switch]$GrantAdminConsent,
     [switch]$EmitManifest
 )
@@ -85,6 +86,18 @@ if ($IncludeDeviceActions) {
           'DeviceManagementManagedDevices.PrivilegedOperations.All')
     }
 }
+if ($IncludeOffboarding) {
+    # Geraete ueber Intune/Autopilot/Entra entfernen + Recovery-Keys lesen.
+    # ACHTUNG: Loeschen braucht zusaetzlich Verzeichnis-/Intune-ROLLEN (Cloud
+    # Device Administrator / Intune Administrator) — nicht nur diese Scopes.
+    $perms += @(
+        'Device.ReadWrite.All',
+        'DeviceManagementManagedDevices.ReadWrite.All',
+        'DeviceManagementServiceConfig.ReadWrite.All',
+        'BitlockerKey.Read.All',
+        'DeviceLocalCredential.Read.All'
+    )
+}
 $perms = $perms | Select-Object -Unique
 
 # --- Verbinden ----------------------------------------------------------------

installer/build-local.ps1

@@ -12,7 +12,7 @@ if (Test-Path "$x64Dotnet\dotnet.exe") {
     $env:DOTNET_ROOT = "C:\Program Files\dotnet"
 }
 
-$version      = "0.1.27"
+$version      = "0.1.30"
 $src          = "\\Mac\Home\ClaudePRJ\Intune Manager"
 $stage        = "$env:TEMP\IntuneManagerStage"
 $installerDir = "$src\installer"

src/Api.ps1

@@ -60,6 +60,10 @@ function Invoke-ApiHandler {
         "POST /api/policies/assign"       { return Invoke-PolicyAssignEndpoint -Body $Body }
         "POST /api/policies/git-snapshot" { return Invoke-PolicyGitSnapshotEndpoint }
         "POST /api/pickfolder"            { return Invoke-FolderPickerEndpoint -Body $Body }
+
+        "GET /api/offboard/search"        { return Search-OffboardDevicesEndpoint -Query $Query }
+        "POST /api/offboard/keys"         { return Get-OffboardKeysEndpoint -Body $Body }
+        "POST /api/offboard/execute"      { return Invoke-OffboardExecuteEndpoint -Body $Body }
     }
 
     # 2-segment fallbacks (z.B. /api/groups/<id>/members)
@@ -1995,8 +1999,49 @@ function Get-AppInstallReportEndpoint {
     return @{ items = $items; count = $items.Count }
 }
 
+# Intune-Report via asynchronem Export-Job (exportJobs) -> CSV-Zeilen.
+# Kein 'select' (unbekannte Spalten wuerden 400 ausloesen) — der Aufrufer
+# greift tolerant auf die tatsaechlich gelieferten Spalten zu.
+function Get-IntuneReportRows {
+    param(
+        [Parameter(Mandatory=$true)][string]$ReportName,
+        [string]$Filter = '',
+        [int]$TimeoutSec = 120
+    )
+    $jobBody = @{ reportName = $ReportName; filter = $Filter } | ConvertTo-Json -Compress
+    $job = Invoke-MgGraphRequestRetry `
+        -Uri 'https://graph.microsoft.com/beta/deviceManagement/reports/exportJobs' `
+        -Method POST -Body $jobBody -ContentType 'application/json'
+    $jobId  = $job.id
+    $status = $job.status
+    $waited = 0
+    while ($status -ne 'completed' -and $status -ne 'failed' -and $waited -lt $TimeoutSec) {
+        Start-Sleep -Seconds 3
+        $waited += 3
+        $job    = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/deviceManagement/reports/exportJobs/$jobId"
+        $status = $job.status
+    }
+    if ($status -ne 'completed') { throw "Export-Job '$ReportName' nicht abgeschlossen (Status: $status nach $waited s)" }
+
+    $tmpZip = [System.IO.Path]::GetTempFileName() + '.zip'
+    $tmpDir = [System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), "IntuneReport_$jobId")
+    try {
+        Invoke-WebRequest -Uri $job.url -OutFile $tmpZip -UseBasicParsing
+        Add-Type -AssemblyName System.IO.Compression.FileSystem
+        [System.IO.Compression.ZipFile]::ExtractToDirectory($tmpZip, $tmpDir)
+        $csv = Get-ChildItem -Path $tmpDir -Filter '*.csv' | Select-Object -First 1
+        if (-not $csv) { throw "Keine CSV im Export-ZIP gefunden" }
+        return @(Import-Csv -Path $csv.FullName -Encoding UTF8)
+    } finally {
+        Remove-Item -Path $tmpZip -Force -ErrorAction SilentlyContinue
+        Remove-Item -Path $tmpDir -Recurse -Force -ErrorAction SilentlyContinue
+    }
+}
+
 function Get-AppDeviceStatusEndpoint {
-    # Verwendet getDeviceInstallStatusReport (synchron, paginiert) statt deviceStatuses.
+    # Per-Device-Installationsstatus einer App via Export-Job 'DeviceInstallStatusByApp'.
+    # (Der frueher genutzte synchrone Endpoint getDeviceInstallStatusReport existiert
+    #  nicht mehr -> 400 "Resource not found for the segment".)
     param([hashtable]$Query)
     $err = Test-Connected
     if ($err) { return $err }
@@ -2006,58 +2051,38 @@ function Get-AppDeviceStatusEndpoint {
         return @{ __status = 400; error = "appId fehlt" }
     }
 
-    Write-Host "[DEVSTATUS] Lade Install-Status fuer App $appId via Reports-API..." -ForegroundColor DarkCyan
+    Write-Host "[DEVSTATUS] Export-Job (DeviceInstallStatusByApp) fuer App $appId..." -ForegroundColor DarkCyan
-    $pageSize = 50
+    try {
-    $skip     = 0
+        $rows = @(Get-IntuneReportRows -ReportName 'DeviceInstallStatusByApp' -Filter "(ApplicationId eq '$appId')")
-    $allRows  = @()
+    } catch {
-    $cols     = $null
+        $msg = $_.Exception.Message
-
+        try { if ($_.ErrorDetails.Message) { $msg = $_.ErrorDetails.Message } } catch {}
-    do {
+        return @{ __status = 500; error = "Graph-Fehler: $msg" }
-        $bodyJson = "{""filter"":""(ApplicationId eq '$appId')"",""select"":[],""skip"":$skip,""top"":$pageSize,""orderBy"":[]}"
-        try {
-            $resp = Invoke-MgGraphRequestRetry `
-                -Uri    'https://graph.microsoft.com/beta/deviceManagement/reports/getDeviceInstallStatusReport' `
-                -Method POST -Body $bodyJson -ContentType 'application/json'
-        } catch {
-            return @{ __status = 500; error = "Graph-Fehler: $($_.Exception.Message)" }
-        }
-
-        if (-not $cols) {
-            $cols = @($resp.Schema | ForEach-Object { $_.Column })
-            Write-Host "  [DEVSTATUS] Spalten: $($cols -join ',')" -ForegroundColor DarkGray
-        }
-        $rows = @($resp.Values)
-        $allRows += $rows
-        $skip += $pageSize
-    } while ($rows.Count -eq $pageSize)
-
-    Write-Host "  -> $($allRows.Count) Eintraege" -ForegroundColor DarkGray
-
-    if (-not $cols -or $allRows.Count -eq 0) {
-        return @{ items = @(); count = 0 }
     }
+    Write-Host "  -> $($rows.Count) Eintraege" -ForegroundColor DarkGray
+    if ($rows.Count -eq 0) { return @{ items = @(); count = 0 } }
 
-    function ColIdx($name) { [Array]::IndexOf($cols, $name) }
+    Write-Host "  [DEVSTATUS] Spalten: $(($rows[0].PSObject.Properties.Name) -join ',')" -ForegroundColor DarkGray
-    $iDevice    = ColIdx 'DeviceName'
-    $iUser      = ColIdx 'UserName'
-    $iState     = ColIdx 'InstallState'
-    $iDetail    = ColIdx 'InstallStateDetail'
-    $iErr       = ColIdx 'ErrorCode'
-    $iOs        = ColIdx 'OSVersion'
-    $iSync      = ColIdx 'LastModifiedDateTime'
-    if ($iOs    -lt 0) { $iOs   = ColIdx 'OsVersion' }
-    if ($iSync  -lt 0) { $iSync = ColIdx 'LastSyncDateTime' }
 
-    $result = @($allRows | ForEach-Object {
+    # Spaltennamen des Reports koennen variieren -> tolerant mit Fallbacks lesen.
+    $col = {
+        param($row, [string[]]$names)
+        foreach ($n in $names) {
+            $p = $row.PSObject.Properties[$n]
+            if ($p -and $null -ne $p.Value -and [string]$p.Value -ne '') { return [string]$p.Value }
+        }
+        return ''
+    }
+    $result = @($rows | ForEach-Object {
         $r = $_
         [pscustomobject]@{
-            DeviceName         = if ($iDevice -ge 0) { [string]$r[$iDevice] } else { '' }
+            DeviceName         = & $col $r @('DeviceName')
-            UserName           = if ($iUser   -ge 0) { [string]$r[$iUser]   } else { '' }
+            UserName           = & $col $r @('UserName','UserPrincipalName')
-            InstallState       = if ($iState  -ge 0) { [string]$r[$iState]  } else { '' }
+            InstallState       = & $col $r @('InstallState_loc','InstallState','AppInstallState_loc','AppInstallState')
-            InstallStateDetail = if ($iDetail -ge 0) { [string]$r[$iDetail] } else { '' }
+            InstallStateDetail = & $col $r @('InstallStateDetail_loc','InstallStateDetail','AppInstallStateDetail_loc','AppInstallStateDetail')
-            ErrorCode          = if ($iErr    -ge 0) { [string]$r[$iErr]    } else { '' }
+            ErrorCode          = & $col $r @('ErrorCode','HexErrorCode')
-            OsVersion          = if ($iOs     -ge 0) { [string]$r[$iOs]     } else { '' }
+            OsVersion          = & $col $r @('OSVersion','OsVersion','Platform')
-            LastSyncDateTime   = if ($iSync   -ge 0) { [string]$r[$iSync]   } else { '' }
+            LastSyncDateTime   = & $col $r @('LastModifiedDateTime','LastSyncDateTime')
         }
     })
 
@@ -2780,23 +2805,29 @@ function Add-AppAssignmentEndpoint {
     if ($intent -notin @("required","available")) {
         return @{ __status = 400; error = "intent muss 'required' oder 'available' sein" }
     }
-    $target = [string]$Body.target
+    # Ein ODER mehrere Ziele akzeptieren: 'targets' (Array) hat Vorrang, sonst 'target'.
-    if ([string]::IsNullOrWhiteSpace($target)) {
+    $targets = @()
-        return @{ __status = 400; error = "target fehlt (ALL_USERS / ALL_DEVICES / <group-guid>)" }
+    if ($Body.targets) { $targets = @($Body.targets | ForEach-Object { [string]$_ }) }
+    elseif ($Body.target) { $targets = @([string]$Body.target) }
+    $targets = @($targets | Where-Object { $_ -and $_.Trim() })
+    if ($targets.Count -eq 0) {
+        return @{ __status = 400; error = "target/targets fehlt (ALL_USERS / ALL_DEVICES / <group-guid>)" }
     }
-    # Bei Group-Target: zumindest grobe Hex/GUID-Form pruefen damit wir keine
+    # Jedes Group-Target grob auf Hex/GUID-Form pruefen (keine Garbage an Graph).
-    # Garbage an Graph schicken.
+    foreach ($t in $targets) {
-    if ($target -notin @("ALL_USERS","ALL_DEVICES") -and $target -notmatch '^[0-9a-fA-F-]{8,}$') {
+        if ($t -notin @("ALL_USERS","ALL_DEVICES") -and $t -notmatch '^[0-9a-fA-F-]{8,}$') {
-        return @{ __status = 400; error = "Ungueltige target-GUID: $target" }
+            return @{ __status = 400; error = "Ungueltige target-GUID: $t" }
+        }
     }
 
     # App-Cache fuer logging
     $cachedApp = $script:State.Apps | Where-Object { $_.AppId -eq $AppId } | Select-Object -First 1
     $appName = if ($cachedApp) { $cachedApp.AppName } else { $AppId }
 
-    Write-Host "[ADD ASSIGN] $appName -> intent=$intent target=$target" -ForegroundColor Yellow
+    Write-Host "[ADD ASSIGN] $appName -> intent=$intent targets=$($targets -join ', ')" -ForegroundColor Yellow
     try {
-        Add-GraphAppAssignment -AppId $AppId -Intent $intent -GroupId $target
+        # EIN Request fuer alle Ziele: bestehende Zuweisungen werden gemergt.
+        Add-GraphAppAssignment -AppId $AppId -Intent $intent -GroupId $targets
     } catch {
         $graphBody = $null
         try { $graphBody = $_.ErrorDetails.Message } catch {}
@@ -2811,38 +2842,46 @@ function Add-AppAssignmentEndpoint {
         return @{ __status = $status; error = $friendly; code = $details.Code; graph = $graphBody }
     }
 
-    # Cache aktualisieren — neue Zuweisung im App-Eintrag ergaenzen
+    # Cache aktualisieren — neue Zuweisung(en) im App-Eintrag ergaenzen.
+    # (Das Frontend laedt danach ohnehin neu; das haelt die UI aber sofort konsistent.)
     if ($cachedApp) {
-        $entry = if ($target -eq "ALL_USERS") {
+        $lookup = @{}
-            @{ GroupId = "ALL_USERS"; GroupName = "All Users"; IsNative = $true }
+        foreach ($g in $script:State.Groups)    { $lookup[$g.Id] = $g.DisplayName }
-        } elseif ($target -eq "ALL_DEVICES") {
+        foreach ($g in $script:State.RpaGroups) { $lookup[$g.Id] = $g.DisplayName }
-            @{ GroupId = "ALL_DEVICES"; GroupName = "All Devices"; IsNative = $true }
+        foreach ($target in $targets) {
-        } else {
+            $entry = if ($target -eq "ALL_USERS") {
-            # Group-Namen aus den geladenen Gruppen oder Graph nachschlagen
+                @{ GroupId = "ALL_USERS"; GroupName = "All Users"; IsNative = $true }
-            $groupName = $target
+            } elseif ($target -eq "ALL_DEVICES") {
-            $lookup = @{}
+                @{ GroupId = "ALL_DEVICES"; GroupName = "All Devices"; IsNative = $true }
-            foreach ($g in $script:State.Groups)    { $lookup[$g.Id] = $g.DisplayName }
+            } else {
-            foreach ($g in $script:State.RpaGroups) { $lookup[$g.Id] = $g.DisplayName }
+                $groupName = $target
-            if ($lookup.ContainsKey($target)) { $groupName = $lookup[$target] }
+                if ($lookup.ContainsKey($target)) { $groupName = $lookup[$target] }
-            else {
+                else {
-                try {
+                    try {
-                    $g = Get-GraphGroupById -Id $target -Property @("id","displayName")
+                        $g = Get-GraphGroupById -Id $target -Property @("id","displayName")
-                    if ($g.displayName) { $groupName = [string]$g.displayName }
+                        if ($g.displayName) { $groupName = [string]$g.displayName }
-                } catch {}
+                    } catch {}
+                }
+                @{ GroupId = $target; GroupName = $groupName; IsNative = $false }
+            }
+            $exists = if ($intent -eq "available") {
+                @($cachedApp.AvailableGroups | Where-Object { $_.GroupId -eq $entry.GroupId }).Count -gt 0
+            } else {
+                @($cachedApp.RequiredGroups  | Where-Object { $_.GroupId -eq $entry.GroupId }).Count -gt 0
+            }
+            if ($exists) { continue }
+            if ($intent -eq "available") {
+                $cachedApp.AvailableGroups = @($cachedApp.AvailableGroups + $entry)
+                $cachedApp.AvailableCount  = $cachedApp.AvailableGroups.Count
+            } else {
+                $cachedApp.RequiredGroups  = @($cachedApp.RequiredGroups + $entry)
+                $cachedApp.RequiredCount   = $cachedApp.RequiredGroups.Count
             }
-            @{ GroupId = $target; GroupName = $groupName; IsNative = $false }
-        }
-        if ($intent -eq "available") {
-            $cachedApp.AvailableGroups = @($cachedApp.AvailableGroups + $entry)
-            $cachedApp.AvailableCount  = $cachedApp.AvailableGroups.Count
-        } else {
-            $cachedApp.RequiredGroups  = @($cachedApp.RequiredGroups + $entry)
-            $cachedApp.RequiredCount   = $cachedApp.RequiredGroups.Count
         }
     }
 
-    Write-Host "[ADD ASSIGN] OK" -ForegroundColor Green
+    Write-Host "[ADD ASSIGN] OK ($($targets.Count) Ziel(e))" -ForegroundColor Green
-    return @{ ok = $true; appId = $AppId; intent = $intent; target = $target }
+    return @{ ok = $true; appId = $AppId; intent = $intent; targets = @($targets); count = $targets.Count }
 }
 
 function Remove-AppAssignmentEndpoint {

src/Graph.ps1

@@ -33,7 +33,13 @@ function Invoke-MgGraphRequestRetry {
         $Body,
         [string]$ContentType,
         [hashtable]$Headers,
-        [int]$MaxRetries = 3
+        [int]$MaxRetries = 3,
+        # Rohes JSON von Graph holen und selbst parsen. Noetig fuer Policy-Exporte:
+        # Invoke-MgGraphRequest liefert unter Windows PowerShell 5.1 im Hashtable-
+        # Modus Ein-Element-Collections als Skalar (z.B. printerNames), was beim
+        # Re-Import 400 "A 'StartArray' node was expected" ausloest. -OutputType Json
+        # umgeht das: ConvertFrom-Json bewahrt Arrays.
+        [switch]$AsRawJson
     )
     $attempt = 0
     while ($true) {
@@ -42,6 +48,13 @@ function Invoke-MgGraphRequestRetry {
             if ($PSBoundParameters.ContainsKey('Body') -and $null -ne $Body) { $params.Body = $Body }
             if ($ContentType) { $params.ContentType = $ContentType }
             if ($Headers)     { $params.Headers = $Headers }
+            if ($AsRawJson) {
+                $params.OutputType = 'Json'
+                $raw = Invoke-MgGraphRequest @params
+                if ([string]::IsNullOrWhiteSpace([string]$raw)) { return $null }
+                if ($PSVersionTable.PSVersion.Major -ge 6) { return ($raw | ConvertFrom-Json -AsHashtable) }
+                return ($raw | ConvertFrom-Json)
+            }
             return Invoke-MgGraphRequest @params
         } catch {
             $msg = $_.Exception.Message
@@ -64,11 +77,15 @@ function Invoke-MgGraphRequestRetry {
 }
 
 function Get-GraphPaged {
-    param([Parameter(Mandatory=$true)][string]$Uri)
+    param(
+        [Parameter(Mandatory=$true)][string]$Uri,
+        # An Invoke-MgGraphRequestRetry durchreichen: bewahrt Arrays fuer Exporte.
+        [switch]$AsRawJson
+    )
     $results = @()
     $next = $Uri
     do {
-        $response = Invoke-MgGraphRequestRetry -Uri $next -Method GET
+        $response = Invoke-MgGraphRequestRetry -Uri $next -Method GET -AsRawJson:$AsRawJson
         if ($response.value) { $results += $response.value }
         $next = $response.'@odata.nextLink'
     } while ($next)
@@ -376,21 +393,51 @@ function Add-GraphAppAssignment {
     param(
         [string]$AppId,
         [string]$Intent,         # "available" | "required"
-        [string]$GroupId         # GUID oder "ALL_USERS" / "ALL_DEVICES"
+        [string[]]$GroupId       # eine ODER mehrere: GUID(s) und/oder "ALL_USERS"/"ALL_DEVICES"
     )
-    $target = switch ($GroupId) {
+    # WICHTIG: Die /assign-Action ERSETZT die komplette Zuweisungsliste der App.
-        "ALL_USERS"   { @{ "@odata.type" = "#microsoft.graph.allLicensedUsersAssignmentTarget" } }
+    # Ein einzelnes POST wuerde also alle bestehenden Zuweisungen loeschen. Daher:
-        "ALL_DEVICES" { @{ "@odata.type" = "#microsoft.graph.allDevicesAssignmentTarget" } }
+    # bestehende Zuweisungen laden, die neuen mergen (Duplikate ueberspringen) und
-        default       { @{ "@odata.type" = "#microsoft.graph.groupAssignmentTarget"; "groupId" = $GroupId } }
+    # den VOLLEN Satz in EINEM Request schicken. Das haelt mehrere neue Gruppen
+    # zusammen (kein Read-after-Write-Rennen) und bewahrt vorhandene Zuweisungen.
+    $newTargets = @()
+    foreach ($gid in @($GroupId)) {
+        if ([string]::IsNullOrWhiteSpace([string]$gid)) { continue }
+        $newTargets += switch ([string]$gid) {
+            "ALL_USERS"   { @{ "@odata.type" = "#microsoft.graph.allLicensedUsersAssignmentTarget" } }
+            "ALL_DEVICES" { @{ "@odata.type" = "#microsoft.graph.allDevicesAssignmentTarget" } }
+            default       { @{ "@odata.type" = "#microsoft.graph.groupAssignmentTarget"; "groupId" = [string]$gid } }
+        }
     }
-    $body = @{
+
-        mobileAppAssignments = @(@{
+    $existing    = Get-GraphMobileAppAssignments -AppId $AppId
-            "@odata.type" = "#microsoft.graph.mobileAppAssignment"
+    $assignments = @()
+    $seen        = @{}   # Schluessel intent|type|groupId -> Duplikate vermeiden
+    foreach ($a in $existing) {
+        $tgt = $a.target
+        if (-not $tgt) { continue }
+        $key = ([string]$a.intent) + '|' + ([string]$tgt.'@odata.type') + '|' + ([string]$tgt.groupId)
+        $seen[$key] = $true
+        $assignments += @{
+            '@odata.type' = '#microsoft.graph.mobileAppAssignment'
+            intent        = [string]$a.intent
+            target        = $tgt          # inkl. evtl. Filter -> unveraendert beibehalten
+            settings      = $a.settings   # bestehende Assignment-Settings bewahren
+        }
+    }
+    foreach ($t in $newTargets) {
+        $key = $Intent + '|' + [string]$t['@odata.type'] + '|' + [string]$t['groupId']
+        if ($seen.ContainsKey($key)) { continue }   # bereits (mit diesem Intent) zugewiesen
+        $seen[$key] = $true
+        $assignments += @{
+            '@odata.type' = '#microsoft.graph.mobileAppAssignment'
             intent        = $Intent
-            target        = $target
+            target        = $t
             settings      = $null
-        })
+        }
     }
+
+    $body = @{ mobileAppAssignments = @($assignments) }
     Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/beta/deviceAppManagement/mobileApps/$AppId/assign" -Method POST -Body $body
 }
 
@@ -827,16 +874,15 @@ function Remove-GraphMobileApp {
     }
 }
 
-# Excluded App-Typen aus dem Original-Script
+# Ausgeschlossene App-Typen: iOS/Android bleiben ausgeblendet (dieses Tool ist auf
+# Windows + macOS ausgelegt). macOS-Typen sind bewusst NICHT mehr ausgeschlossen,
+# damit Mac-Apps in Liste/Suche erscheinen.
 $script:ExcludedAppTypes = @(
     '#microsoft.graph.iosLobApp', '#microsoft.graph.iosStoreApp', '#microsoft.graph.iosVppApp',
     '#microsoft.graph.managedIOSLobApp', '#microsoft.graph.managedIOSStoreApp',
     '#microsoft.graph.androidLobApp', '#microsoft.graph.androidStoreApp', '#microsoft.graph.androidForWorkApp',
     '#microsoft.graph.androidManagedStoreApp', '#microsoft.graph.androidManagedStoreWebApp',
-    '#microsoft.graph.managedAndroidLobApp', '#microsoft.graph.managedAndroidStoreApp',
+    '#microsoft.graph.managedAndroidLobApp', '#microsoft.graph.managedAndroidStoreApp'
-    '#microsoft.graph.macOSDmgApp', '#microsoft.graph.macOSLobApp', '#microsoft.graph.macOSMicrosoftDefenderApp',
-    '#microsoft.graph.macOSMicrosoftEdgeApp', '#microsoft.graph.macOSOfficeSuiteApp', '#microsoft.graph.macOSPkgApp',
-    '#microsoft.graph.macOsVppApp'
 )
 
 function Test-AppTypeAllowed {
@@ -858,6 +904,13 @@ function ConvertTo-AppFriendlyType {
         '#microsoft.graph.windowsAppX'                  { 'APPX' }
         '#microsoft.graph.windowsUniversalAppX'         { 'APPX' }
         '#microsoft.graph.windowsMobileMSI'             { 'MSI' }
+        '#microsoft.graph.macOSDmgApp'                  { 'macOS DMG' }
+        '#microsoft.graph.macOSPkgApp'                  { 'macOS PKG' }
+        '#microsoft.graph.macOSLobApp'                  { 'macOS LOB' }
+        '#microsoft.graph.macOSMicrosoftDefenderApp'    { 'macOS Defender' }
+        '#microsoft.graph.macOSMicrosoftEdgeApp'        { 'macOS Edge' }
+        '#microsoft.graph.macOSOfficeSuiteApp'          { 'macOS M365' }
+        '#microsoft.graph.macOsVppApp'                  { 'macOS VPP' }
         default {
             ($Type -replace '#microsoft\.graph\.','')
         }

src/Offboard.ps1

@@ -0,0 +1,238 @@
+# Geraete-Offboarding: ein Geraet ueber Intune, Autopilot und Entra ID hinweg
+# entfernen (Decommissioning). Vor dem Loeschen koennen BitLocker-/FileVault-Keys
+# und LAPS-Passwoerter ausgelesen werden, damit sie nicht verloren gehen.
+#
+# Portiert aus dem "Device Offboarding Manager" (Ugur Koc, MIT-Lizenz) — dort
+# WPF, hier als Web-Endpoints in den Intune Manager integriert.
+#
+# Loeschen ist destruktiv -> im Read-Only-Modus gesperrt, harte Bestaetigung im UI.
+
+# Generischer Microsoft-Graph-$batch-Helper. Nimmt Sub-Requests
+# ( @{ id; method; url; body?; headers? } ) und liefert eine Map id -> Response.
+function Invoke-GraphBatch {
+    param([Parameter(Mandatory=$true)][object[]]$Requests)
+    $map = @{}
+    for ($i = 0; $i -lt $Requests.Count; $i += 20) {
+        $chunk = $Requests[$i .. [Math]::Min($i + 19, $Requests.Count - 1)]
+        $body  = @{ requests = @($chunk) } | ConvertTo-Json -Depth 10 -Compress
+        $resp  = Invoke-MgGraphRequestRetry -Uri 'https://graph.microsoft.com/beta/$batch' -Method POST -Body $body -ContentType 'application/json'
+        foreach ($r in @($resp.responses)) { $map[[string]$r.id] = $r }
+    }
+    return $map
+}
+
+# Graph-Fehlermeldung aus einer Exception ziehen (Body statt generischer Text).
+function Get-OffboardGraphErr {
+    param($ErrorRecord)
+    $m = $ErrorRecord.Exception.Message
+    try { if ($ErrorRecord.ErrorDetails.Message) { $m = $ErrorRecord.ErrorDetails.Message } } catch {}
+    return $m
+}
+
+# Geraete suchen und ueber die drei Dienste hinweg aufloesen.
+# Query: query=<text>, type=name|serial
+function Search-OffboardDevicesEndpoint {
+    param([hashtable]$Query)
+    $err = Test-Connected
+    if ($err) { return $err }
+
+    $q    = [string]$Query['query']
+    $type = [string]$Query['type']
+    if ([string]::IsNullOrWhiteSpace($q)) { return @{ __status = 400; error = 'Suchbegriff fehlt' } }
+    $qEsc = $q -replace "'", "''"
+
+    # managedDevices unterstuetzt startswith(deviceName) bzw. serialNumber eq.
+    $filter = if ($type -eq 'serial') { "serialNumber eq '$qEsc'" } else { "startswith(deviceName,'$qEsc')" }
+    $sel    = 'id,deviceName,serialNumber,operatingSystem,osVersion,userPrincipalName,lastSyncDateTime,azureADDeviceId,managedDeviceOwnerType,managementAgent'
+    $uri    = "https://graph.microsoft.com/beta/deviceManagement/managedDevices?`$filter=$([Uri]::EscapeDataString($filter))&`$select=$sel&`$top=50&`$orderby=deviceName"
+    try {
+        $intune = @(Get-GraphPaged -Uri $uri)
+    } catch {
+        $m = Get-OffboardGraphErr $_
+        if ($m -match '403|Forbidden') {
+            return @{ __status = 403; error = 'Keine Berechtigung fuer die Geraete-Suche. Scope "DeviceManagementManagedDevices.Read.All" muss in den Read/Write-Scopes stehen UND per Admin-Consent zugestimmt sein (siehe docs/App-Registration.md). Nach dem Ergaenzen: ab- und neu anmelden.' }
+        }
+        return @{ __status = 500; error = "Graph-Fehler bei der Suche: $m" }
+    }
+    if ($intune.Count -eq 0) { return @{ items = @(); count = 0 } }
+
+    # Entra-Objekt (fuer Delete) + Autopilot-Identity (fuer Delete) per Batch nachladen.
+    $reqs = @()
+    $idx  = 0
+    foreach ($d in $intune) {
+        $aad = [string]$d.azureADDeviceId
+        $ser = [string]$d.serialNumber
+        if ($aad -and $aad -ne '00000000-0000-0000-0000-000000000000') {
+            $f = [Uri]::EscapeDataString("deviceId eq '$aad'")
+            $reqs += @{ id = "e$idx"; method = 'GET'; url = "/devices?`$filter=$f&`$select=id,deviceId,displayName,accountEnabled&`$top=1" }
+        }
+        if ($ser) {
+            $sf = [Uri]::EscapeDataString("contains(serialNumber,'$($ser -replace "'","''")')")
+            $reqs += @{ id = "a$idx"; method = 'GET'; url = "/deviceManagement/windowsAutopilotDeviceIdentities?`$filter=$sf&`$top=1" }
+        }
+        $idx++
+    }
+    $batch = if ($reqs.Count -gt 0) { Invoke-GraphBatch -Requests $reqs } else { @{} }
+
+    $items = @()
+    $idx   = 0
+    foreach ($d in $intune) {
+        $entra = $null; $autop = $null
+        $er = $batch["e$idx"]; if ($er -and [int]$er.status -eq 200) { $entra = @($er.body.value)[0] }
+        $ar = $batch["a$idx"]; if ($ar -and [int]$ar.status -eq 200) { $autop = @($ar.body.value)[0] }
+        $items += [pscustomobject]@{
+            deviceName      = [string]$d.deviceName
+            serialNumber    = [string]$d.serialNumber
+            operatingSystem = [string]$d.operatingSystem
+            osVersion       = [string]$d.osVersion
+            primaryUser     = [string]$d.userPrincipalName
+            lastSync        = $d.lastSyncDateTime
+            ownership       = [string]$d.managedDeviceOwnerType
+            coManaged       = ([string]$d.managementAgent -match 'configurationManager')
+            intuneDeviceId  = [string]$d.id
+            azureADDeviceId = [string]$d.azureADDeviceId
+            entraObjectId   = if ($entra) { [string]$entra.id } else { '' }
+            entraEnabled    = if ($entra) { [bool]$entra.accountEnabled } else { $null }
+            autopilotId     = if ($autop) { [string]$autop.id } else { '' }
+            inIntune        = $true
+            inEntra         = [bool]$entra
+            inAutopilot     = [bool]$autop
+        }
+        $idx++
+    }
+    return @{ items = @($items); count = $items.Count }
+}
+
+# Recovery-Keys eines Geraets holen (vor dem Loeschen). Body:
+#   { intuneDeviceId, azureADDeviceId, operatingSystem }
+function Get-OffboardKeysEndpoint {
+    param($Body)
+    $err = Test-Connected
+    if ($err) { return $err }
+
+    $intuneId = [string](Get-PolicyProp $Body 'intuneDeviceId')
+    $aad      = [string](Get-PolicyProp $Body 'azureADDeviceId')
+    $os       = [string](Get-PolicyProp $Body 'operatingSystem')
+
+    $bitlocker = @()
+    $fileVault = $null
+    $laps      = $null
+    $notes     = @()
+
+    if ($os -eq 'Windows' -and $aad) {
+        try {
+            $keyIds = @(Get-GraphPaged -Uri "https://graph.microsoft.com/beta/informationProtection/bitlocker/recoveryKeys?`$filter=deviceId eq '$aad'")
+            foreach ($k in $keyIds) {
+                try {
+                    $kd = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/informationProtection/bitlocker/recoveryKeys/$($k.id)?`$select=key,volumeType" -Method GET
+                    if ($kd.key) { $bitlocker += @{ volumeType = [string]$kd.volumeType; key = [string]$kd.key } }
+                } catch {}
+            }
+            if ($bitlocker.Count -eq 0) { $notes += 'Kein BitLocker-Key gefunden.' }
+        } catch {
+            $m = Get-OffboardGraphErr $_
+            $notes += if ($m -match '403') { 'BitLocker: Zugriff verweigert (BitlockerKey.Read.All noetig).' } else { "BitLocker: $m" }
+        }
+    }
+    elseif ($os -eq 'macOS' -and $intuneId) {
+        try {
+            $fv = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/deviceManagement/managedDevices('$intuneId')/getFileVaultKey" -Method GET
+            if ($fv.value) { $fileVault = [string]$fv.value } else { $notes += 'Kein FileVault-Key gefunden.' }
+        } catch { $notes += "FileVault: $(Get-OffboardGraphErr $_)" }
+    }
+
+    # LAPS (jede Plattform, ueber die Entra-Device-Id).
+    if ($aad) {
+        try {
+            $resp  = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/directory/deviceLocalCredentials/$aad`?`$select=credentials" -Method GET
+            $creds = @($resp.credentials)
+            if ($creds.Count -gt 0) {
+                $latest = $creds | Sort-Object -Property backupDateTime -Descending | Select-Object -First 1
+                $pw     = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String([string]$latest.passwordBase64))
+                $laps   = @{ account = [string]$latest.accountName; password = $pw }
+            }
+        } catch {
+            $m = Get-OffboardGraphErr $_
+            if ($m -notmatch '404') { $notes += "LAPS: $m" }
+        }
+    }
+
+    return @{ ok = $true; keys = @{ bitlocker = @($bitlocker); fileVault = $fileVault; laps = $laps; notes = @($notes) } }
+}
+
+# Offboarding ausfuehren. Body:
+#   devices  = [ { deviceName, intuneDeviceId, entraObjectId, autopilotId } ]
+#   services = { entra: 'delete'|'disable'|'none', intune: bool, autopilot: bool }
+function Invoke-OffboardExecuteEndpoint {
+    param($Body)
+    $err = Test-Connected
+    if ($err) { return $err }
+    if ($script:State.ReadOnly) { return @{ __status = 403; error = 'Read-Only-Modus: Offboarding ist deaktiviert.' } }
+
+    $devices = @(Get-PolicyProp $Body 'devices') | Where-Object { $_ }
+    $svc     = Get-PolicyProp $Body 'services'
+    if (@($devices).Count -eq 0) { return @{ __status = 400; error = 'Keine Geraete uebergeben' } }
+
+    $entraAction = [string](Get-PolicyProp $svc 'entra')
+    $doIntune    = [bool](Get-PolicyProp $svc 'intune')
+    $doAutopilot = [bool](Get-PolicyProp $svc 'autopilot')
+
+    $reqs = @()
+    $meta = @{}
+    $n    = 0
+    foreach ($d in $devices) {
+        $name = [string](Get-PolicyProp $d 'deviceName')
+        $iid  = [string](Get-PolicyProp $d 'intuneDeviceId')
+        $eid  = [string](Get-PolicyProp $d 'entraObjectId')
+        $aid  = [string](Get-PolicyProp $d 'autopilotId')
+
+        if ($entraAction -eq 'delete' -and $eid) {
+            $rid = "r$n"; $reqs += @{ id = $rid; method = 'DELETE'; url = "/devices/$eid" }
+            $meta[$rid] = @{ name = $name; svc = 'Entra ID'; action = 'geloescht' }; $n++
+        } elseif ($entraAction -eq 'disable' -and $eid) {
+            $rid = "r$n"; $reqs += @{ id = $rid; method = 'PATCH'; url = "/devices/$eid"; body = @{ accountEnabled = $false }; headers = @{ 'Content-Type' = 'application/json' } }
+            $meta[$rid] = @{ name = $name; svc = 'Entra ID'; action = 'deaktiviert' }; $n++
+        }
+        if ($doIntune -and $iid) {
+            $rid = "r$n"; $reqs += @{ id = $rid; method = 'DELETE'; url = "/deviceManagement/managedDevices/$iid" }
+            $meta[$rid] = @{ name = $name; svc = 'Intune'; action = 'geloescht' }; $n++
+        }
+        if ($doAutopilot -and $aid) {
+            $rid = "r$n"; $reqs += @{ id = $rid; method = 'DELETE'; url = "/deviceManagement/windowsAutopilotDeviceIdentities/$aid" }
+            $meta[$rid] = @{ name = $name; svc = 'Autopilot'; action = 'geloescht' }; $n++
+        }
+    }
+    if ($reqs.Count -eq 0) { return @{ __status = 400; error = 'Keine ausfuehrbaren Aktionen (fehlende IDs oder nichts ausgewaehlt).' } }
+
+    Write-Host "[OFFBOARD] Fuehre $($reqs.Count) Aktion(en) fuer $(@($devices).Count) Geraet(e) aus..." -ForegroundColor Yellow
+    $batch = Invoke-GraphBatch -Requests $reqs
+
+    $results = @()
+    foreach ($rid in ($meta.Keys | Sort-Object { [int]($_ -replace '\D','') })) {
+        $m      = $meta[$rid]
+        $r      = $batch[$rid]
+        $status = if ($r) { [int]$r.status } else { 0 }
+        $ok     = $status -in @(200, 204)
+        $errMsg = ''
+        if (-not $ok) {
+            $code = ''
+            try { $code = [string]$r.body.error.code } catch {}
+            if ($status -eq 403 -and $code -match 'multipleAdminApproval|protectedOperation') {
+                $errMsg = 'Erfordert Multi-Admin-Approval'
+            } elseif ($status -eq 403) {
+                $errMsg = "403 - fehlende Rolle/Berechtigung fuer $($m.svc)"
+            } elseif ($status -eq 0) {
+                $errMsg = 'Keine Antwort'
+            } else {
+                $errMsg = "HTTP $status" + $(if ($code) { " ($code)" } else { '' })
+            }
+        }
+        $results += [pscustomobject]@{
+            deviceName = $m.name; service = $m.svc; action = $m.action
+            success = $ok; error = $errMsg
+        }
+    }
+    $okCount = @($results | Where-Object { $_.success }).Count
+    Write-Host "  -> $okCount/$($results.Count) erfolgreich" -ForegroundColor DarkGray
+    return @{ ok = $true; successCount = $okCount; total = $results.Count; results = @($results) }
+}

src/PolicyIO.ps1

@@ -119,6 +119,15 @@ function Get-PolicyProp {
     return $null
 }
 
+# Property setzen — Hashtable ODER PSCustomObject (fuer Import-Umbenennung).
+function Set-PolicyProp {
+    param($Obj, [string]$Name, $Value)
+    if ($null -eq $Obj) { return }
+    if ($Obj -is [System.Collections.IDictionary]) { $Obj[$Name] = $Value; return }
+    if ($Obj.PSObject.Properties[$Name]) { $Obj.$Name = $Value }
+    else { $Obj | Add-Member -NotePropertyName $Name -NotePropertyValue $Value -Force }
+}
+
 # Grobe Plattform-Bezeichnung fuer die Listenanzeige.
 function Get-PolicyPlatformLabel {
     param($Raw, [string]$Type)
@@ -177,10 +186,12 @@ function Get-GraphPolicyDetail {
 
     # Administrative Vorlagen: Basis-Objekt holen und die konfigurierten Werte
     # (definitionValues inkl. Definition + Presentation-Werten) separat expandieren.
+    # -AsRawJson durchgaengig: bewahrt Ein-Element-Collections als Array (PS-5.1-
+    # Hashtable-Modus wuerde sie skalarisieren -> 400 beim Re-Import).
     if ($cfg.Key -eq 'administrativetemplate') {
-        $base = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/$Id" -Method GET
+        $base = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/$Id" -Method GET -AsRawJson
         $dvUri = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/$Id/definitionValues?`$expand=definition(`$select=id,classType,displayName,policyType,version),presentationValues(`$expand=presentation)"
-        $dvs = @(Get-GraphPaged -Uri $dvUri)
+        $dvs = @(Get-GraphPaged -Uri $dvUri -AsRawJson)
         if ($base -is [System.Collections.IDictionary]) { $base['definitionValues'] = $dvs }
         else { $base | Add-Member -NotePropertyName definitionValues -NotePropertyValue $dvs -Force }
         return $base
@@ -188,7 +199,7 @@ function Get-GraphPolicyDetail {
 
     $uri = "https://graph.microsoft.com/beta/deviceManagement/$($cfg.Collection)/$Id"
     if ($cfg.ExportExpand) { $uri += "?`$expand=$($cfg.ExportExpand)" }
-    return Invoke-MgGraphRequestRetry -Uri $uri -Method GET
+    return Invoke-MgGraphRequestRetry -Uri $uri -Method GET -AsRawJson
 }
 
 # PSCustomObject/Hashtable -> bereinigte Hashtable ohne Read-Only-Felder.
@@ -220,10 +231,23 @@ function ConvertTo-ImportBody {
 function Repair-SettingsCatalogArrays {
     param($Node)
     $arrayKeys = @('settings','children','groupSettingCollectionValue','simpleSettingCollectionValue','values')
+    # *TemplateReference-Keys tragen ein Objekt ODER null. Ein alter Export mit zu
+    # geringer ConvertTo-Json-Tiefe hat solche (tief liegenden) Objekte zu ".ToString()"
+    # stringifiziert -> "System.Collections.Hashtable". Graph lehnt das ab
+    # ('Property settingValueTemplateReference ... does not match schema'). Der bloße
+    # String ist eindeutig korrupt und nicht rekonstruierbar -> auf null setzen; die
+    # (optionale) Template-Bindung entfaellt, die eigentlichen Werte bleiben erhalten.
+    $refKeys = @('settingInstanceTemplateReference','settingValueTemplateReference')
 
-    # Array-Property normalisieren: $null -> @() (Graph-Schema: Collections sind
+    # Array-Property normalisieren — WICHTIG inline (Zuweisung, KEIN Funktions-
-    # Nullable=False, ein 'children': null wird abgelehnt), Einzelobjekt -> @(obj).
+    # Return): ein leeres Array aus einer Funktion zurueckzugeben entpackt PS zu
-    # Inline (nicht als Funktion), sonst entpackt der Return ein Ein-Element-Array.
+    # $null, was zu 'children: {}' statt '[]' fuehrt. Als Zuweisung bleibt @() ein @().
+    #   $null        -> @()      (Graph-Schema: Collections sind Nullable=False)
+    #   Einzelobjekt -> @(obj)   (Ein-Element-Array wurde vom Roundtrip skalarisiert)
+    #   leere/Whitespace-STRING-Elemente entfernen: ein PS-JSON-Roundtrip macht aus
+    #   einer leeren Collection [] teils ""/[""] -> Graph lehnt das als
+    #   'Property children ... does not match schema' ab. Diese Keys tragen nie bare
+    #   Strings -> gefahrlos filtern; wird die Collection dadurch leer, bleibt [].
     if ($Node -is [System.Collections.IDictionary]) {
         $out = [ordered]@{}
         foreach ($k in @($Node.Keys)) {
@@ -231,7 +255,9 @@ function Repair-SettingsCatalogArrays {
             if ($k -in $arrayKeys) {
                 if ($null -eq $fixed) { $fixed = @() }
                 elseif (-not ($fixed -is [System.Collections.IList])) { $fixed = @($fixed) }
+                $fixed = @($fixed | Where-Object { -not (($_ -is [string]) -and [string]::IsNullOrWhiteSpace($_)) })
             }
+            elseif ($k -in $refKeys -and ($fixed -is [string])) { $fixed = $null }
             $out[$k] = $fixed
         }
         return $out
@@ -243,7 +269,9 @@ function Repair-SettingsCatalogArrays {
             if ($p.Name -in $arrayKeys) {
                 if ($null -eq $fixed) { $fixed = @() }
                 elseif (-not ($fixed -is [System.Collections.IList])) { $fixed = @($fixed) }
+                $fixed = @($fixed | Where-Object { -not (($_ -is [string]) -and [string]::IsNullOrWhiteSpace($_)) })
             }
+            elseif ($p.Name -in $refKeys -and ($fixed -is [string])) { $fixed = $null }
             $out[$p.Name] = $fixed
         }
         return $out
@@ -258,6 +286,43 @@ function Repair-SettingsCatalogArrays {
     return $Node
 }
 
+# Entfernt rekursiv alle Properties mit $null-Wert. Configuration Profiles
+# exportieren nicht genutzte Collection-Properties als null; beim POST lehnt Graph
+# null fuer 'Collection(...)[Nullable=False]' ab (400 ModelValidationFailure, z.B.
+# 'defenderAdditionalGuardedFolders'). Weggelassene Properties belegt Graph mit
+# Defaults -> sicheres Strippen. Array-Typen werden am Parent wieder in @()
+# gewrappt, damit ein Ein-Element-Array beim Return nicht zum Skalar entpackt wird.
+function Remove-PolicyNullProps {
+    param($Node)
+    if ($Node -is [System.Collections.IDictionary]) {
+        $out = @{}
+        foreach ($k in @($Node.Keys)) {
+            $v = $Node[$k]
+            if ($null -eq $v) { continue }
+            $fixed = Remove-PolicyNullProps $v
+            if (($v -is [System.Collections.IEnumerable]) -and -not ($v -is [string]) -and -not ($v -is [System.Collections.IDictionary])) {
+                $out[$k] = @($fixed)
+            } else { $out[$k] = $fixed }
+        }
+        return $out
+    }
+    if ($Node -is [System.Management.Automation.PSCustomObject]) {
+        $out = @{}
+        foreach ($p in $Node.PSObject.Properties) {
+            if ($null -eq $p.Value) { continue }
+            $fixed = Remove-PolicyNullProps $p.Value
+            if (($p.Value -is [System.Collections.IEnumerable]) -and -not ($p.Value -is [string]) -and -not ($p.Value -is [System.Collections.IDictionary])) {
+                $out[$p.Name] = @($fixed)
+            } else { $out[$p.Name] = $fixed }
+        }
+        return $out
+    }
+    if (($Node -is [System.Collections.IEnumerable]) -and -not ($Node -is [string])) {
+        return @($Node | ForEach-Object { Remove-PolicyNullProps $_ })
+    }
+    return $Node
+}
+
 function New-DefaultComplianceScheduledActions {
     # Compliance Policies verlangen beim Anlegen mindestens einen
     # scheduledActionsForRule-Block, sonst antwortet Graph mit 400.
@@ -311,6 +376,8 @@ function Import-GraphConfigurationProfile {
     if (-not $body['@odata.type']) {
         throw 'Configuration Profile benoetigt @odata.type fuer den Import.'
     }
+    # null-Properties strippen: Graph lehnt null fuer nicht-nullbare Collections ab.
+    $body = Remove-PolicyNullProps $body
     $json = $body | ConvertTo-Json -Depth 50
     return Invoke-MgGraphRequestRetry -Uri 'https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations' -Method POST -Body $json -ContentType 'application/json'
 }
@@ -341,6 +408,17 @@ function Import-GraphSettingsCatalogPolicy {
         $body['settings'] = @()
     }
     $json = $body | ConvertTo-Json -Depth 50
+
+    # Korruptions-Check: enthaelt der Payload noch stringifizierte .NET-Objekte
+    # ("System.Collections.Hashtable" / "System.Object[]"), stammt die Quelldatei aus
+    # einem alten Export mit zu geringer ConvertTo-Json-Tiefe. *TemplateReference
+    # (optionale Metadaten) wurde oben bereits gerettet; verbleibende Marker sitzen in
+    # WERT-tragenden Feldern (z.B. groupSettingCollectionValue) -> echte Konfiguration
+    # ist verloren und nicht rekonstruierbar. Klar abbrechen statt kaputt zu importieren.
+    if ($json -match 'System\.Collections\.Hashtable|System\.Object\[\]') {
+        throw 'Quelldatei beschaedigt: Teile der Konfiguration wurden von einem alten Export (zu geringe JSON-Tiefe) zu ".ToString()" verstuemmelt und sind nicht wiederherstellbar. Bitte die Policy neu aus Graph exportieren und die frische Datei importieren.'
+    }
+
     return Invoke-MgGraphRequestRetry -Uri 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies' -Method POST -Body $json -ContentType 'application/json'
 }
 
@@ -563,6 +641,14 @@ function Import-PoliciesEndpoint {
             $results += @{ policyName = [string]$policyName; success = $false; error = 'Envelope ohne "policy"-Feld' }
             continue
         }
+        # Optionale Umbenennung: das richtige Namensfeld je Typ setzen.
+        $newName = [string](Get-PolicyProp $env 'newName')
+        if ($newName -and $newName.Trim()) {
+            $cfg = Get-PolicyTypeConfigByExportType $exportType
+            $nameField = if ($cfg) { $cfg.NameField } else { 'displayName' }
+            Set-PolicyProp $policy $nameField $newName.Trim()
+            $policyName = $newName.Trim()
+        }
         try {
             $imported = Import-GraphPolicyByExportType -ExportType $exportType -Policy $policy
             $results += @{ policyName = [string]$policyName; exportType = $exportType; success = $true; newId = [string](Get-PolicyProp $imported 'id') }
@@ -675,9 +761,27 @@ function ConvertTo-StableObject {
     return $InputObject
 }
 
+# git muss nicht im PATH des Server-Prozesses liegen (haeufig, wenn der Server vor
+# der Git-Installation gestartet wurde oder mit eingefrorener Umgebung laeuft).
+# Erst PATH probieren, dann bekannte Installationsorte. Ergebnis wird gecacht.
+function Get-GitExe {
+    if ($script:GitExe -and (Test-Path $script:GitExe)) { return $script:GitExe }
+    $cmd = Get-Command git -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+    if ($cmd) { $script:GitExe = $cmd.Source; return $script:GitExe }
+    $cands = @()
+    if ($env:ProgramFiles)        { $cands += (Join-Path $env:ProgramFiles 'Git\cmd\git.exe') }
+    if (${env:ProgramFiles(x86)}) { $cands += (Join-Path ${env:ProgramFiles(x86)} 'Git\cmd\git.exe') }
+    if ($env:LOCALAPPDATA)        { $cands += (Join-Path $env:LOCALAPPDATA 'Programs\Git\cmd\git.exe') }
+    if ($env:LOCALAPPDATA)        { $cands += (Join-Path $env:LOCALAPPDATA 'Microsoft\WinGet\Links\git.exe') }
+    foreach ($c in $cands) { if ($c -and (Test-Path $c)) { $script:GitExe = $c; return $c } }
+    return $null
+}
+
 function Invoke-Git {
     param([Parameter(Mandatory=$true)][string]$RepoPath, [Parameter(Mandatory=$true)][string[]]$GitArgs)
-    $out = & git -C $RepoPath @GitArgs 2>&1
+    $exe = Get-GitExe
+    if (-not $exe) { return @{ exit = 9009; out = 'git nicht gefunden (weder im PATH noch an bekannten Installationsorten).' } }
+    $out = & $exe -C $RepoPath @GitArgs 2>&1
     return @{ exit = $LASTEXITCODE; out = (@($out) -join "`n").Trim() }
 }
 
@@ -700,9 +804,10 @@ function Invoke-PolicyGitSnapshotEndpoint {
         return @{ __status = 400; error = 'Kein Git-Repo-Pfad konfiguriert (Einstellungen -> Policy-Backup).' }
     }
 
-    # git verfuegbar?
+    # git verfuegbar? (PATH + bekannte Installationsorte)
-    try { $null = & git --version 2>&1; if ($LASTEXITCODE -ne 0) { throw 'x' } }
+    if (-not (Get-GitExe)) {
-    catch { return @{ __status = 500; error = 'git ist nicht installiert oder nicht im PATH.' } }
+        return @{ __status = 500; error = 'git ist nicht auffindbar (weder im PATH des Server-Prozesses noch an den Standard-Installationsorten). Ggf. Server nach der Git-Installation neu starten.' }
+    }
 
     # Repo-Ordner + .git sicherstellen
     if (-not (Test-Path $repo)) { New-Item -ItemType Directory -Path $repo -Force | Out-Null }

www/app.js

@@ -11,7 +11,7 @@ const State = {
   targets: [],
   selectedTargetIds: new Set(),
   apps: [],
-  appFilter: { search: '', preset: 'all', category: '', onlyMember: false, hideNative: false, modFrom: '', modTo: '' },
+  appFilter: { search: '', preset: 'all', platform: 'all', category: '', onlyMember: false, hideNative: false, modFrom: '', modTo: '' },
   session: [],
   membershipCache: new Map(),
   loadedModes: new Set(),
@@ -432,6 +432,13 @@ document.querySelectorAll('.seg').forEach(seg => {
       search.value = '';
       search.focus();
       try { search.setSelectionRange(0, 0); } catch {}
+    } else if (newMode === 'dept') {
+      // Gruppen-Modus: Live-Suche ueber ALLE Gruppen (min. 2 Zeichen), kein Praefix-Filter
+      search.placeholder = 'Gruppe suchen...';
+      hint.classList.remove('hidden');
+      search.value = '';
+      search.focus();
+      try { search.setSelectionRange(0, 0); } catch {}
     } else {
       search.placeholder = 'Filtern...';
       hint.classList.add('hidden');
@@ -441,8 +448,9 @@ document.querySelectorAll('.seg').forEach(seg => {
     renderTargets();
     onTargetSelectionChange();
 
-    // Auto-Load nur wenn fuer diesen Mode noch nichts geladen wurde UND es kein User-Mode ist
+    // Auto-Load nur fuer Listen-Modi (RPA). 'dept' (Gruppensuche) und 'user'
-    if (State.connected && newMode !== 'user' && !State.loadedModes.has(newMode) && State.targets.length === 0) {
+    // laden erst bei Sucheingabe.
+    if (State.connected && newMode === 'rpa' && !State.loadedModes.has(newMode) && State.targets.length === 0) {
       loadTargets({ silent: false });
     }
   });
@@ -461,6 +469,14 @@ document.getElementById('btnReloadTargets').addEventListener('click', () => {
       return;
     }
     runUserSearch(term);
+  } else if (State.mode === 'dept') {
+    const term = document.getElementById('targetSearch').value;
+    if (!term || term.length < 2) {
+      document.getElementById('targetSearch').focus();
+      toast('Tippe mind. 2 Zeichen für die Gruppensuche', 'warn');
+      return;
+    }
+    runGroupSearch(term);
   } else {
     State.loadedModes.delete(State.mode);
     loadTargets({ silent: false });
@@ -470,16 +486,20 @@ document.getElementById('btnReloadTargets').addEventListener('click', () => {
 document.getElementById('targetSearch').addEventListener('input', e => {
   if (State.mode === 'user') {
     debouncedUserSearch(e.target.value);
+  } else if (State.mode === 'dept') {
+    debouncedGroupSearch(e.target.value);
   } else {
     renderTargets();
   }
 });
 
-// Enter key triggers explicit user search
+// Enter loest die Server-Suche sofort aus (Benutzer- und Gruppen-Modus)
 document.getElementById('targetSearch').addEventListener('keydown', e => {
-  if (e.key === 'Enter' && State.mode === 'user') {
+  if (e.key !== 'Enter') return;
-    const term = e.target.value;
+  const term = e.target.value;
-    if (term && term.length >= 2) runUserSearch(term);
+  if (term && term.length >= 2) {
+    if (State.mode === 'user') runUserSearch(term);
+    else if (State.mode === 'dept') runGroupSearch(term);
   }
 });
 
@@ -576,6 +596,77 @@ async function runUserSearch(term) {
   }
 }
 
+// ── Gruppen-Live-Suche: durchsucht ALLE Gruppen (nicht nur Praefix-Gruppen) ──
+let groupSearchTimer = null;
+let groupSearchAbort = null;
+let groupSearchCache = { query: '', results: [] };
+
+// Bereits ausgewaehlte Gruppen in ein neues Ergebnis mergen, damit die Auswahl
+// (und die Namen in der Pinned-Leiste) ueber mehrere Suchen hinweg bestehen bleibt.
+function mergeSelectedGroups(results) {
+  const ids = new Set(results.map(r => r.Id));
+  const keep = State.targets.filter(t => State.selectedTargetIds.has(t.Id) && !ids.has(t.Id));
+  return keep.length ? results.concat(keep) : results;
+}
+
+function debouncedGroupSearch(term) {
+  clearTimeout(groupSearchTimer);
+  const t = (term || '').trim();
+  if (t.length < 2) {
+    // Unter 2 Zeichen: nur die ausgewaehlten Gruppen stehen lassen (Auswahl behalten)
+    State.targets = State.targets.filter(x => State.selectedTargetIds.has(x.Id));
+    groupSearchCache = { query: '', results: [] };
+    renderTargets();
+    return;
+  }
+  // Optimistisch lokal verfeinern, wenn die neue Anfrage die vorige praezisiert
+  const lower = t.toLowerCase();
+  const cachedLower = groupSearchCache.query.toLowerCase();
+  if (cachedLower && lower.startsWith(cachedLower) && groupSearchCache.results.length > 0) {
+    const filtered = groupSearchCache.results.filter(g => (g.DisplayName || '').toLowerCase().includes(lower));
+    State.targets = mergeSelectedGroups(filtered);
+    renderTargets();
+    return;
+  }
+  groupSearchTimer = setTimeout(() => runGroupSearch(t), 220);
+}
+
+async function runGroupSearch(term) {
+  if (!State.connected) { toast('Bitte zuerst verbinden', 'warn'); return; }
+
+  if (groupSearchAbort) { try { groupSearchAbort.abort(); } catch {} }
+  groupSearchAbort = new AbortController();
+  const signal = groupSearchAbort.signal;
+
+  document.getElementById('targetList').innerHTML = `
+    <div class="skeleton">
+      <div class="sk-line med"></div>
+      <div class="sk-line short"></div>
+      <div class="sk-line med"></div>
+    </div>`;
+  try {
+    const resp = await fetch('/api/groups/search?q=' + encodeURIComponent(term), {
+      headers: { 'Content-Type': 'application/json' },
+      signal,
+    });
+    let data = {};
+    try { data = await resp.json(); } catch {}
+    if (signal.aborted) return;
+    if (!resp.ok) throw new Error(data.error || `HTTP ${resp.status}`);
+
+    const results = data.items || [];
+    groupSearchCache = { query: term, results: results.slice() };
+    State.targets = mergeSelectedGroups(results);
+    renderTargets();
+    onTargetSelectionChange();
+    if (results.length === 0) toast(`Keine Gruppen für "${term}" gefunden`, 'warn');
+  } catch (e) {
+    if (e.name === 'AbortError') return;  // neue Suche laeuft schon
+    toast(e.message, 'err', 'Gruppensuche fehlgeschlagen');
+    renderTargets();
+  }
+}
+
 let loadTargetsInFlight = null;   // welcher Mode laeuft gerade
 
 async function loadTargets(opts = {}) {
@@ -589,12 +680,19 @@ async function loadTargets(opts = {}) {
     }
     return runUserSearch(term);
   }
+  // 'dept' (Gruppen) ist suchbasiert — kein Listen-Load. Bei vorhandener Eingabe
+  // die Suche ausloesen, sonst nichts tun (auch beim Auto-Load nach Connect).
+  if (State.mode === 'dept') {
+    const term = document.getElementById('targetSearch').value;
+    if (term && term.length >= 2) return runGroupSearch(term);
+    return;
+  }
 
   const requestedMode = State.mode;
   if (loadTargetsInFlight === requestedMode) return; // gleiche Anfrage laeuft bereits
   loadTargetsInFlight = requestedMode;
 
-  if (!opts.silent) setLoading('Lade ' + (requestedMode === 'rpa' ? 'RPA-Gruppen' : 'Abteilungen') + '...');
+  if (!opts.silent) setLoading('Lade ' + (requestedMode === 'rpa' ? 'RPA-Gruppen' : 'Gruppen') + '...');
   document.getElementById('targetList').innerHTML = `
     <div class="skeleton">
       <div class="sk-line med"></div>
@@ -619,7 +717,7 @@ async function loadTargets(opts = {}) {
     });
     renderTargets();
     onTargetSelectionChange();
-    if (!opts.silent) toast(`${res.count} ${requestedMode === 'rpa' ? 'RPA-Gruppen' : 'Abteilungen'} geladen`, 'ok');
+    if (!opts.silent) toast(`${res.count} ${requestedMode === 'rpa' ? 'RPA-Gruppen' : 'Gruppen'} geladen`, 'ok');
   } catch (e) {
     if (State.mode === requestedMode) {
       toast(e.message, 'err', 'Laden fehlgeschlagen');
@@ -633,7 +731,8 @@ async function loadTargets(opts = {}) {
 
 function getFilteredTargets() {
   const q = document.getElementById('targetSearch').value.toLowerCase().trim();
-  if (!q || State.mode === 'user') return State.targets;
+  // 'user' und 'dept' werden serverseitig gesucht -> State.targets ist bereits das Ergebnis.
+  if (!q || State.mode === 'user' || State.mode === 'dept') return State.targets;
   return State.targets.filter(t =>
     (t.DisplayName || '').toLowerCase().includes(q) ||
     (t.UserPrincipalName || '').toLowerCase().includes(q)
@@ -656,13 +755,17 @@ function renderTargets() {
   }
 
   if (filtered.length === 0) {
-    if (State.mode === 'user') {
+    if (State.mode === 'user' || State.mode === 'dept') {
       const term = document.getElementById('targetSearch').value;
+      const isUser = State.mode === 'user';
+      const has2 = term && term.length >= 2;
       list.innerHTML = emptyState({
-        title: term && term.length >= 2 ? 'Keine Treffer' : 'Benutzer suchen',
+        title: has2 ? 'Keine Treffer' : (isUser ? 'Benutzer suchen' : 'Gruppe suchen'),
-        text: term && term.length >= 2
+        text: has2
-          ? `Keine Benutzer für "${escapeHtml(term)}" gefunden.`
+          ? `Keine ${isUser ? 'Benutzer' : 'Gruppen'} für "${escapeHtml(term)}" gefunden.`
-          : 'Tippe mind. 2 Zeichen — Name, UPN oder E-Mail.',
+          : (isUser
+              ? 'Tippe mind. 2 Zeichen — Name, UPN oder E-Mail.'
+              : 'Tippe mind. 2 Zeichen — durchsucht alle Gruppen im Tenant.'),
       });
     } else {
       list.innerHTML = emptyState({
@@ -776,7 +879,7 @@ function renderPinnedTargets() {
   }
   wrap.classList.remove('hidden');
 
-  const modeLabels = { dept: 'Abt', rpa: 'RPA', user: 'User' };
+  const modeLabels = { dept: 'Grp', rpa: 'RPA', user: 'User' };
   const chips = items.map(it => {
     const isEmpty = it.hasMembers === false ? 'pin-empty' : '';
     const title = `${it.name}${it.meta ? ' · ' + it.meta : ''} (${modeLabels[it.mode] || it.mode}) — Klick: zur Zeile springen, X: entfernen`;
@@ -865,6 +968,10 @@ document.getElementById('appFilter').addEventListener('change', e => {
   State.appFilter.preset = e.target.value;
   renderApps();
 });
+document.getElementById('appPlatformFilter')?.addEventListener('change', e => {
+  State.appFilter.platform = e.target.value;
+  renderApps();
+});
 document.getElementById('appCategoryFilter').addEventListener('change', e => {
   State.appFilter.category = e.target.value;
   renderApps();
@@ -1008,6 +1115,13 @@ function getFilteredApps() {
   let list = State.apps.slice();
   const f = State.appFilter;
   if (f.search) list = list.filter(a => (a.AppName || '').toLowerCase().includes(f.search));
+  // Plattform-Filter ueber den rohen @odata.type: macOS-Typen enthalten "macos"
+  // (z.B. macOSDmgApp, macOsVppApp), alles uebrige ist Windows (iOS/Android sind
+  // bereits serverseitig ausgeschlossen).
+  if (f.platform && f.platform !== 'all') {
+    const isMac = a => (a.AppTypeRaw || '').toLowerCase().includes('macos');
+    list = f.platform === 'macos' ? list.filter(isMac) : list.filter(a => !isMac(a));
+  }
   switch (f.preset) {
     case 'none':         list = list.filter(a => a.AvailableCount === 0 && a.RequiredCount === 0); break;
     case 'available':    list = list.filter(a => a.AvailableCount > 0 && a.RequiredCount === 0); break;
@@ -1694,6 +1808,12 @@ async function jumpToAppById(appId) {
   // Suchfeld leeren damit die App garantiert sichtbar ist
   const search = document.getElementById('appSearch');
   if (search && search.value) { search.value = ''; State.appFilter.search = ''; }
+  // Plattform-Filter zuruecksetzen, sonst koennte die Ziel-App ausgeblendet sein
+  if (State.appFilter.platform !== 'all') {
+    State.appFilter.platform = 'all';
+    const pf = document.getElementById('appPlatformFilter');
+    if (pf) pf.value = 'all';
+  }
 
   // WICHTIG: Wenn die App noch nicht expanded ist, muessen wir den DETAILS-
   // FETCH triggern. Frueher haben wir nur expandedApps.add() gemacht — ohne
@@ -2156,7 +2276,7 @@ function toggleSession({ appId, groupId, groupName, type }) {
     return;
   }
   if (allSel.length === 0) {
-    toast('Wähle erst Abteilungen oder Benutzer aus', 'warn');
+    toast('Wähle erst Gruppen oder Benutzer aus', 'warn');
     return;
   }
 
@@ -2441,7 +2561,7 @@ async function applyAssignments() {
   document.getElementById('confirmText').innerHTML = `
     <strong>${total}</strong> Vorgang${total === 1 ? '' : 'e'} wird ausgeführt:
     <ul style="margin: 8px 0 0 18px; line-height: 1.6;">
-      ${deptOps > 0 ? `<li><strong>${deptOps}</strong> auf Abteilungsgruppen</li>` : ''}
+      ${deptOps > 0 ? `<li><strong>${deptOps}</strong> auf Gruppen</li>` : ''}
       ${userOps > 0 ? `<li><strong>${userOps}</strong> auf Einzelbenutzer</li>` : ''}
     </ul>`;
   openModal('modalConfirm');
@@ -2662,17 +2782,19 @@ function getCurrentCgMode() {
   return el ? el.value : 'req-group';
 }
 
-// Modus -> { intent, isGroup, target } — single source of truth
+// Modus -> { intent, isGroup, isExisting, target } — single source of truth
 function cgModeMeta(mode) {
   switch (mode) {
-    case 'req-group':       return { intent: 'required',  isGroup: true,  target: null };
+    case 'req-group':       return { intent: 'required',  isGroup: true,  isExisting: false, target: null };
-    case 'req-allusers':    return { intent: 'required',  isGroup: false, target: 'ALL_USERS' };
+    case 'req-existing':    return { intent: 'required',  isGroup: false, isExisting: true,  target: null };
-    case 'req-alldevices':  return { intent: 'required',  isGroup: false, target: 'ALL_DEVICES' };
+    case 'req-allusers':    return { intent: 'required',  isGroup: false, isExisting: false, target: 'ALL_USERS' };
-    case 'avail-group':     return { intent: 'available', isGroup: true,  target: null };
+    case 'req-alldevices':  return { intent: 'required',  isGroup: false, isExisting: false, target: 'ALL_DEVICES' };
-    case 'avail-allusers':  return { intent: 'available', isGroup: false, target: 'ALL_USERS' };
+    case 'avail-group':     return { intent: 'available', isGroup: true,  isExisting: false, target: null };
-    case 'avail-alldevices':return { intent: 'available', isGroup: false, target: 'ALL_DEVICES' };
+    case 'avail-existing':  return { intent: 'available', isGroup: false, isExisting: true,  target: null };
+    case 'avail-allusers':  return { intent: 'available', isGroup: false, isExisting: false, target: 'ALL_USERS' };
+    case 'avail-alldevices':return { intent: 'available', isGroup: false, isExisting: false, target: 'ALL_DEVICES' };
   }
-  return { intent: 'required', isGroup: true, target: null };
+  return { intent: 'required', isGroup: true, isExisting: false, target: null };
 }
 
 function openCreateGroupModal(appId, appName) {
@@ -2720,6 +2842,7 @@ function openCreateGroupModal(appId, appName) {
     }
   }
   document.getElementById('cgAssignToApp').checked = true;
+  resetCgExisting();
   applyCgModeUi();
   openModal('modalCreateGroup');
 }
@@ -2731,12 +2854,20 @@ function applyCgModeUi() {
   const meta = cgModeMeta(mode);
   const nameGroup = document.getElementById('cgGroupNameGroup');
   const assignWrap = document.getElementById('cgAssignToAppWrap');
+  const existingGroup = document.getElementById('cgExistingGroup');
   const createBtn = document.getElementById('cgCreate');
 
   const intentLabel = meta.intent === 'available' ? 'Available' : 'Required';
-  if (meta.isGroup) {
+  if (meta.isExisting) {
+    // Bestehende Gruppe(n) suchen + zuweisen (Mehrfachauswahl)
+    nameGroup.hidden = true;
+    assignWrap.hidden = true;
+    if (existingGroup) existingGroup.hidden = false;
+    renderCgSelected();   // setzt Button-Label + disabled anhand der Auswahl
+  } else if (meta.isGroup) {
     nameGroup.hidden = false;
     assignWrap.hidden = false;
+    if (existingGroup) existingGroup.hidden = true;
     document.getElementById('cgGroupName').value = suggestedGroupName(createGroupContext.appName, meta.intent);
     document.querySelector('#cgAssignToAppWrap span').textContent =
       `Gruppe direkt der App als ${intentLabel} zuweisen`;
@@ -2745,6 +2876,7 @@ function applyCgModeUi() {
   } else {
     nameGroup.hidden = true;
     assignWrap.hidden = true;
+    if (existingGroup) existingGroup.hidden = true;
     createBtn.disabled = false;
     const tgtLbl = meta.target === 'ALL_USERS' ? 'All Users' : 'All Devices';
     createBtn.textContent = `Als ${intentLabel} für ${tgtLbl} zuweisen`;
@@ -2755,6 +2887,110 @@ document.querySelectorAll('input[name="cgMode"]').forEach(r => {
   r.addEventListener('change', applyCgModeUi);
 });
 
+// ── "Bestehende Gruppe" — Mehrfach-Suche + -Auswahl im Zuweisungs-Dialog ──
+let cgExistingTimer = null;
+let cgExistingAbort = null;
+
+function cgSelectedGroups() {
+  if (!createGroupContext) return [];
+  if (!Array.isArray(createGroupContext.selectedGroups)) createGroupContext.selectedGroups = [];
+  return createGroupContext.selectedGroups;
+}
+
+function resetCgExisting() {
+  if (createGroupContext) createGroupContext.selectedGroups = [];
+  const s = document.getElementById('cgExistingSearch');
+  const r = document.getElementById('cgExistingResults');
+  if (s) s.value = '';
+  if (r) r.innerHTML = '';
+  renderCgSelected();
+}
+
+// Ausgewaehlte Gruppen als entfernbare Chips zeigen + Button-Status/Label setzen.
+function renderCgSelected() {
+  const sel = document.getElementById('cgExistingSelected');
+  const groups = cgSelectedGroups();
+  if (sel) {
+    sel.className = 'cg-existing-chips';
+    sel.innerHTML = groups.length === 0
+      ? '<span class="form-hint">Noch keine Gruppe ausgewählt.</span>'
+      : groups.map(g =>
+          `<span class="cg-chip" title="${escapeHtml(g.name)}">
+            <span class="cg-chip-name">${escapeHtml(g.name)}</span>
+            <button type="button" class="cg-chip-x" data-remove-id="${escapeHtml(g.id)}" aria-label="Entfernen">×</button>
+          </span>`).join('');
+  }
+  // Nur im "Bestehende Gruppe"-Modus den Erstellen/Zuweisen-Button steuern.
+  const meta = cgModeMeta(getCurrentCgMode());
+  if (meta.isExisting) {
+    const btn = document.getElementById('cgCreate');
+    const intentLabel = meta.intent === 'available' ? 'Available' : 'Required';
+    btn.disabled = groups.length === 0;
+    btn.textContent = groups.length > 1
+      ? `${groups.length} Gruppen als ${intentLabel} zuweisen`
+      : `Als ${intentLabel} zuweisen`;
+  }
+}
+
+document.getElementById('cgExistingSearch')?.addEventListener('input', e => {
+  clearTimeout(cgExistingTimer);
+  const term = e.target.value.trim();
+  const results = document.getElementById('cgExistingResults');
+  if (term.length < 2) { if (results) results.innerHTML = ''; return; }
+  cgExistingTimer = setTimeout(() => runCgExistingSearch(term), 250);
+});
+
+async function runCgExistingSearch(term) {
+  const results = document.getElementById('cgExistingResults');
+  if (!results) return;
+  if (cgExistingAbort) { try { cgExistingAbort.abort(); } catch {} }
+  cgExistingAbort = new AbortController();
+  results.innerHTML = '<div class="cg-existing-empty">Suche…</div>';
+  try {
+    const resp = await fetch('/api/groups/search?q=' + encodeURIComponent(term), { signal: cgExistingAbort.signal });
+    let data = {}; try { data = await resp.json(); } catch {}
+    if (cgExistingAbort.signal.aborted) return;
+    if (!resp.ok) throw new Error(data.error || `HTTP ${resp.status}`);
+    const items = data.items || [];
+    if (items.length === 0) { results.innerHTML = '<div class="cg-existing-empty">Keine Treffer</div>'; return; }
+    const selIds = new Set(cgSelectedGroups().map(g => g.id));
+    results.innerHTML = items.map(g =>
+      `<button type="button" class="cg-existing-item${selIds.has(String(g.Id)) ? ' is-selected' : ''}" data-id="${escapeHtml(g.Id)}" data-name="${escapeHtml(g.DisplayName)}">
+        <span class="cg-existing-name">${escapeHtml(g.DisplayName)}</span>
+        ${g.Description ? `<span class="cg-existing-desc">${escapeHtml(g.Description)}</span>` : ''}
+      </button>`).join('');
+  } catch (e) {
+    if (e.name === 'AbortError') return;
+    results.innerHTML = `<div class="cg-existing-empty">Fehler: ${escapeHtml(e.message)}</div>`;
+  }
+}
+
+// Ergebnis anklicken -> Auswahl togglen (Mehrfachauswahl)
+document.getElementById('cgExistingResults')?.addEventListener('click', e => {
+  const btn = e.target.closest('.cg-existing-item');
+  if (!btn) return;
+  const id = btn.dataset.id, name = btn.dataset.name;
+  const groups = cgSelectedGroups();
+  const idx = groups.findIndex(g => g.id === id);
+  if (idx >= 0) { groups.splice(idx, 1); btn.classList.remove('is-selected'); }
+  else { groups.push({ id, name }); btn.classList.add('is-selected'); }
+  renderCgSelected();
+});
+
+// Chip entfernen -> Auswahl abwaehlen (und ggf. Ergebnis-Item entmarkieren)
+document.getElementById('cgExistingSelected')?.addEventListener('click', e => {
+  const x = e.target.closest('[data-remove-id]');
+  if (!x) return;
+  const id = x.dataset.removeId;
+  const groups = cgSelectedGroups();
+  const idx = groups.findIndex(g => g.id === id);
+  if (idx >= 0) groups.splice(idx, 1);
+  document.querySelectorAll('.cg-existing-item').forEach(it => {
+    if (it.dataset.id === id) it.classList.remove('is-selected');
+  });
+  renderCgSelected();
+});
+
 document.getElementById('cgGroupName').addEventListener('input', () => {
   clearTimeout(cgCheckTimer);
   cgCheckTimer = setTimeout(checkGroupName, 400);
@@ -2793,6 +3029,30 @@ document.getElementById('cgCreate').addEventListener('click', async () => {
   if (!createGroupContext) return;
   const meta = cgModeMeta(getCurrentCgMode());
 
+  if (meta.isExisting) {
+    // Bestehende Gruppe(n) zuweisen — EIN Request mit allen Zielen. Das Backend
+    // mergt die neuen Gruppen mit den bestehenden Zuweisungen (die /assign-Action
+    // ersetzt sonst die komplette Liste -> nur die letzte Gruppe bliebe uebrig).
+    const groups = cgSelectedGroups();
+    if (groups.length === 0) { toast('Bitte zuerst mind. eine Gruppe auswählen', 'warn'); return; }
+    const intentLabel = meta.intent === 'available' ? 'Available' : 'Required';
+    setLoading(`Weise ${groups.length} Gruppe(n) als ${intentLabel} zu...`);
+    try {
+      await api(`/api/apps/${encodeURIComponent(createGroupContext.appId)}/assignments`, {
+        method: 'POST',
+        body: { intent: meta.intent, targets: groups.map(g => g.id) },
+      });
+      toast(`${groups.length} ${intentLabel}-Zuweisung(en) hinzugefügt`, 'ok');
+      closeModal('modalCreateGroup');
+      await loadApps(true);
+    } catch (e) {
+      toast(e.message, 'err', 'Zuweisung fehlgeschlagen');
+    } finally {
+      clearLoading();
+    }
+    return;
+  }
+
   if (meta.isGroup) {
     // Gruppe erstellen + zuweisen
     const { prefix, suffix } = getNamingFor(meta.intent);
@@ -3303,7 +3563,7 @@ function applyExpandedSelection(groupId) {
 
   renderTargets();
   onTargetSelectionChange();
-  toast(`${picked.length} Benutzer aus "${entry.name}" übernommen — Abteilungs-Auswahl bleibt erhalten`, 'ok');
+  toast(`${picked.length} Benutzer aus "${entry.name}" übernommen — Gruppen-Auswahl bleibt erhalten`, 'ok');
 }
 
 // (Alte Modal-Logik — unbenutzt, aber harmlos:)
@@ -4621,6 +4881,7 @@ function switchMainView(view) {
   const reportView = document.getElementById('appReportView');
   const devView    = document.getElementById('devView');
   const polView    = document.getElementById('policiesView');
+  const offView    = document.getElementById('offView');
   document.querySelectorAll('#topbarNav .nav-tab').forEach(t => {
     t.classList.toggle('active', t.dataset.view === view);
     t.setAttribute('aria-selected', t.dataset.view === view ? 'true' : 'false');
@@ -4630,12 +4891,13 @@ function switchMainView(view) {
   reportView.classList.toggle('hidden', view !== 'report');
   devView   .classList.toggle('hidden', view !== 'devices');
   polView   .classList.toggle('hidden', view !== 'policies');
+  if (offView) offView.classList.toggle('hidden', view !== 'offboard');
 }
 
 document.querySelectorAll('#topbarNav .nav-tab').forEach(btn => {
   btn.addEventListener('click', () => {
     const view = btn.dataset.view;
-    if ((view === 'groups' || view === 'report' || view === 'devices' || view === 'policies') && !State.connected) {
+    if ((view === 'groups' || view === 'report' || view === 'devices' || view === 'policies' || view === 'offboard') && !State.connected) {
       toast('Bitte zuerst verbinden.', 'warn');
       return;
     }
@@ -4644,6 +4906,7 @@ document.querySelectorAll('#topbarNav .nav-tab').forEach(btn => {
     if (view === 'report' && ReportState.items.length === 0) loadAppReport();
     if (view === 'devices') { devLoadAll(); setTimeout(() => document.getElementById('devSearch').focus(), 80); }
     if (view === 'policies' && PolState.items.length === 0) loadPolicies();
+    if (view === 'offboard') setTimeout(() => document.getElementById('offSearch').focus(), 80);
   });
 });
 
@@ -5920,6 +6183,13 @@ function polExtractEnvelopes(parsed, fileName) {
   return [];
 }
 
+let _polImportEnvelopes = [];
+
+function polEnvName(env) {
+  return env.policyName || (env.policy && (env.policy.name || env.policy.displayName)) || '(ohne Name)';
+}
+
+// Dateien einlesen -> Rename-Dialog oeffnen (der eigentliche Import folgt dort).
 async function polHandleImportFiles(fileList) {
   const files = [...fileList];
   if (!files.length) return;
@@ -5931,11 +6201,57 @@ async function polHandleImportFiles(fileList) {
     envelopes = envelopes.concat(polExtractEnvelopes(parsed, f.name));
   }
   if (!envelopes.length) return;
-  if (!window.confirm(`${envelopes.length} Policy(s) als NEUE Policies im verbundenen Tenant anlegen?\n\nBestehende Policies werden dabei nicht verändert.`)) return;
+  _polImportEnvelopes = envelopes;
+  renderPolImportList();
+  openModal('modalPolImport');
+}
+
+function renderPolImportList() {
+  const list = document.getElementById('polImportList');
+  if (!list) return;
+  list.innerHTML = _polImportEnvelopes.map((env, i) => {
+    const type = env.exportType || env.policyType || '';
+    return `<div class="pol-import-row">
+      <input class="input pol-import-name" data-idx="${i}" value="${escapeHtml(polEnvName(env))}" placeholder="Policy-Name">
+      <span class="pol-type-badge">${escapeHtml(POL_TYPE_LABELS[type] || type || 'Policy')}</span>
+    </div>`;
+  }).join('');
+  const info = document.getElementById('polImportInfo');
+  if (info) info.textContent = `${_polImportEnvelopes.length} Policy(s)`;
+}
+
+async function polDoImport() {
+  // Geänderte Namen übernehmen (nur wenn nicht leer und wirklich anders).
+  _polImportEnvelopes.forEach((env, i) => {
+    const input = document.querySelector(`.pol-import-name[data-idx="${i}"]`);
+    const nn = input ? input.value.trim() : '';
+    if (nn && nn !== polEnvName(env)) env.newName = nn; else delete env.newName;
+  });
+  closeModal('modalPolImport');
+  const envelopes = _polImportEnvelopes.slice();
+  const total = envelopes.length;
   setLoading('Importiere Policies…');
   try {
-    const res = await api('/api/policies/import', { method: 'POST', body: { policies: envelopes }, timeoutMs: 180000 });
+    // Sequenzieller Server-Import in kleinen Batches: umgeht die 180-s-Timeout-Wand
-    const results = res.results || [];
+    // eines einzelnen Requests bei vielen Policies und erlaubt Fortschrittsanzeige.
+    const BATCH = 5;
+    const loadingText = document.getElementById('loadingText');
+    const results = [];
+    for (let start = 0; start < total; start += BATCH) {
+      const chunk = envelopes.slice(start, start + BATCH);
+      if (loadingText && total > BATCH) {
+        loadingText.textContent = `Importiere Policies… (${start + 1}–${Math.min(start + chunk.length, total)} von ${total})`;
+      }
+      // Timeout pro Batch nach Batch-Größe skaliert (Anlegen + Retry je Policy).
+      try {
+        const res = await api('/api/policies/import', { method: 'POST', body: { policies: chunk }, timeoutMs: 30000 + chunk.length * 30000 });
+        if (res && res.results) results.push(...res.results);
+      } catch (be) {
+        // Batch-Fehler nicht den Gesamtimport abbrechen lassen — als fehlgeschlagen
+        // vermerken und mit dem nächsten Batch weitermachen.
+        chunk.forEach(env => results.push({ policyName: polEnvName(env), success: false, error: be.message }));
+      }
+    }
     const ok = results.filter(r => r.success);
     const fail = results.filter(r => !r.success);
     if (fail.length) {
@@ -5954,6 +6270,7 @@ async function polHandleImportFiles(fileList) {
     clearLoading();
   }
 }
+document.getElementById('polImportConfirm')?.addEventListener('click', polDoImport);
 
 // =============================================================
 // Post-Import: Policies pro Stück Include-/Exclude-Gruppen zuweisen
@@ -6181,3 +6498,172 @@ document.querySelectorAll('#polTable th.sortable').forEach(th => {
     renderPolicies();
   });
 });
+
+// =============================================================
+// OFFBOARDING: Geräte aus Intune / Autopilot / Entra entfernen
+// =============================================================
+const OffState = { items: [], selected: new Set() };
+function offKey(d) { return d.intuneDeviceId; }
+function offSelectedDevices() { return OffState.items.filter(d => OffState.selected.has(offKey(d))); }
+
+async function offSearch() {
+  const q = document.getElementById('offSearch').value.trim();
+  const type = document.getElementById('offSearchType').value;
+  if (q.length < 2) { toast('Mindestens 2 Zeichen.', 'warn'); return; }
+  const body = document.getElementById('offBody');
+  body.innerHTML = `<tr><td colspan="7" class="pol-hint"><span class="spinner" style="width:14px;height:14px;border-width:2px;"></span> Suche…</td></tr>`;
+  try {
+    const res = await api(`/api/offboard/search?query=${encodeURIComponent(q)}&type=${type}`, { timeoutMs: 60000 });
+    OffState.items = res.items || [];
+    OffState.selected = new Set();
+    renderOff();
+  } catch (e) {
+    toast('Suche fehlgeschlagen: ' + e.message, 'err');
+    body.innerHTML = `<tr><td colspan="7" class="pol-empty">Fehler bei der Suche.</td></tr>`;
+  }
+}
+
+function offSvcBadges(d) {
+  const b = [];
+  if (d.inIntune)    b.push('<span class="off-badge">Intune</span>');
+  if (d.inEntra)     b.push('<span class="off-badge">Entra</span>');
+  if (d.inAutopilot) b.push('<span class="off-badge">Autopilot</span>');
+  if (d.coManaged)   b.push('<span class="off-badge warn">Co-Mgmt</span>');
+  return b.join(' ') || '—';
+}
+
+function renderOff() {
+  const body = document.getElementById('offBody');
+  if (!OffState.items.length) {
+    body.innerHTML = `<tr><td colspan="7" class="pol-empty">Keine Geräte gefunden.</td></tr>`;
+    offUpdateSel();
+    return;
+  }
+  body.innerHTML = OffState.items.map(d => {
+    const k = offKey(d);
+    const checked = OffState.selected.has(k) ? 'checked' : '';
+    return `<tr data-key="${escapeHtml(k)}">
+      <td><input type="checkbox" class="off-row-check" data-key="${escapeHtml(k)}" ${checked}></td>
+      <td>${escapeHtml(d.deviceName || '—')}</td>
+      <td>${escapeHtml(d.serialNumber || '—')}</td>
+      <td>${escapeHtml(((d.operatingSystem || '') + ' ' + (d.osVersion || '')).trim() || '—')}</td>
+      <td>${escapeHtml(d.primaryUser || '—')}</td>
+      <td>${polFmtDate(d.lastSync)}</td>
+      <td>${offSvcBadges(d)}</td>
+    </tr>`;
+  }).join('');
+  body.querySelectorAll('.off-row-check').forEach(cb => {
+    cb.addEventListener('change', () => {
+      if (cb.checked) OffState.selected.add(cb.dataset.key); else OffState.selected.delete(cb.dataset.key);
+      offUpdateSel();
+    });
+  });
+  body.querySelectorAll('tr[data-key]').forEach(tr => {
+    tr.addEventListener('click', e => {
+      if (e.target.classList.contains('off-row-check')) return;
+      const cb = tr.querySelector('.off-row-check');
+      cb.checked = !cb.checked;
+      cb.dispatchEvent(new Event('change'));
+    });
+  });
+  offUpdateSel();
+}
+
+function offUpdateSel() {
+  const n = OffState.selected.size;
+  document.getElementById('offSelCount').textContent = `${n} ausgewählt`;
+  document.getElementById('offBtn').disabled = n === 0;
+}
+
+function openOffboardModal() {
+  const devs = offSelectedDevices();
+  if (!devs.length) return;
+  document.getElementById('offConfirmList').innerHTML = devs.map(d => `
+    <div class="off-confirm-row"><b>${escapeHtml(d.deviceName || '—')}</b>
+      — Intune: ${d.intuneDeviceId ? '✓' : '–'}, Entra: ${d.entraObjectId ? '✓' : '–'}, Autopilot: ${d.autopilotId ? '✓' : '–'}</div>
+  `).join('');
+  document.getElementById('offModalInfo').textContent = `${devs.length} Gerät(e)`;
+  document.getElementById('offConfirmChk').checked = false;
+  document.getElementById('offExecuteBtn').disabled = true;
+  document.getElementById('offResults').innerHTML = '';
+  document.getElementById('offKeys').innerHTML = '<div class="lbl">Recovery-Keys</div><div class="muted">Wird geladen…</div>';
+  openModal('modalOffboard');
+  offLoadKeys(devs);
+}
+
+async function offLoadKeys(devs) {
+  const box = document.getElementById('offKeys');
+  const parts = [];
+  for (const d of devs) {
+    try {
+      const res = await api('/api/offboard/keys', {
+        method: 'POST',
+        body: { intuneDeviceId: d.intuneDeviceId, azureADDeviceId: d.azureADDeviceId, operatingSystem: d.operatingSystem },
+        timeoutMs: 60000,
+      });
+      const k = res.keys || {};
+      let html = `<div class="off-key-dev"><b>${escapeHtml(d.deviceName || '—')}</b>`;
+      (k.bitlocker || []).forEach(b => { html += `<div class="off-key">BitLocker${b.volumeType ? ' (' + escapeHtml(b.volumeType) + ')' : ''}: <code>${escapeHtml(b.key)}</code></div>`; });
+      if (k.fileVault) html += `<div class="off-key">FileVault: <code>${escapeHtml(k.fileVault)}</code></div>`;
+      if (k.laps) html += `<div class="off-key">LAPS${k.laps.account ? ' (' + escapeHtml(k.laps.account) + ')' : ''}: <code>${escapeHtml(k.laps.password)}</code></div>`;
+      if (k.notes && k.notes.length) html += `<div class="muted">${k.notes.map(escapeHtml).join(' · ')}</div>`;
+      html += '</div>';
+      parts.push(html);
+    } catch (e) {
+      parts.push(`<div class="off-key-dev"><b>${escapeHtml(d.deviceName || '—')}</b> <span class="muted">Keys-Fehler: ${escapeHtml(e.message)}</span></div>`);
+    }
+  }
+  box.innerHTML = `<div class="lbl">🔑 Recovery-Keys — vor dem Löschen sichern!</div>${parts.join('')}`;
+}
+
+async function offExecute() {
+  const devs = offSelectedDevices();
+  if (!devs.length) return;
+  const services = {
+    entra:     document.querySelector('input[name="offEntra"]:checked').value,
+    intune:    document.getElementById('offSvcIntune').checked,
+    autopilot: document.getElementById('offSvcAutopilot').checked,
+  };
+  if (services.entra === 'none' && !services.intune && !services.autopilot) {
+    toast('Keinen Dienst ausgewählt.', 'warn');
+    return;
+  }
+  const payload = devs.map(d => ({
+    deviceName: d.deviceName, intuneDeviceId: d.intuneDeviceId,
+    entraObjectId: d.entraObjectId, autopilotId: d.autopilotId,
+  }));
+  document.getElementById('offExecuteBtn').disabled = true;
+  setLoading('Offboarding läuft…');
+  try {
+    const res = await api('/api/offboard/execute', { method: 'POST', body: { devices: payload, services }, timeoutMs: 180000 });
+    const results = res.results || [];
+    document.getElementById('offResults').innerHTML =
+      `<div class="lbl">Ergebnis (${res.successCount}/${res.total})</div>` +
+      results.map(r => `<div class="off-result ${r.success ? 'ok' : 'fail'}">${r.success ? '✓' : '✗'} ${escapeHtml(r.deviceName)} — ${escapeHtml(r.service)} ${escapeHtml(r.action)}${r.error ? ': ' + escapeHtml(r.error) : ''}</div>`).join('');
+    toast(`${res.successCount}/${res.total} Aktionen erfolgreich.`, res.successCount === res.total ? 'ok' : 'warn', 'Offboarding');
+    // Erfolgreich vollständig offgeboardete Geräte aus der Liste nehmen.
+    const doneNames = new Set(results.filter(r => r.success).map(r => r.deviceName));
+    if (doneNames.size) {
+      OffState.items = OffState.items.filter(d => !doneNames.has(d.deviceName) || results.some(r => r.deviceName === d.deviceName && !r.success));
+      OffState.selected = new Set();
+      renderOff();
+    }
+  } catch (e) {
+    toast('Offboarding fehlgeschlagen: ' + e.message, 'err');
+    document.getElementById('offExecuteBtn').disabled = false;
+  } finally {
+    clearLoading();
+  }
+}
+
+document.getElementById('offSearchBtn')?.addEventListener('click', offSearch);
+document.getElementById('offSearch')?.addEventListener('keydown', e => { if (e.key === 'Enter') offSearch(); });
+document.getElementById('offCheckAll')?.addEventListener('change', e => {
+  OffState.items.forEach(d => { const k = offKey(d); if (e.target.checked) OffState.selected.add(k); else OffState.selected.delete(k); });
+  renderOff();
+});
+document.getElementById('offBtn')?.addEventListener('click', openOffboardModal);
+document.getElementById('offConfirmChk')?.addEventListener('change', e => {
+  document.getElementById('offExecuteBtn').disabled = !e.target.checked;
+});
+document.getElementById('offExecuteBtn')?.addEventListener('click', offExecute);

www/index.html

@@ -37,6 +37,7 @@
     <button class="nav-tab" data-view="report" aria-selected="false">App Report</button>
     <button class="nav-tab" data-view="devices" aria-selected="false">Geräte</button>
     <button class="nav-tab" data-view="policies" aria-selected="false">Policies</button>
+    <button class="nav-tab" data-view="offboard" aria-selected="false">Offboarding</button>
   </nav>
 
   <div class="header-actions">
@@ -125,7 +126,7 @@
   <section class="panel panel-targets">
     <div class="panel-head">
       <div class="panel-title">
-        <h2>Abteilungen &amp; Benutzer</h2>
+        <h2>Gruppen &amp; Benutzer</h2>
         <span id="targetCount" class="count-badge">0</span>
       </div>
       <button id="btnReloadTargets" class="icon-btn" title="Neu laden" aria-label="Neu laden">
@@ -134,7 +135,7 @@
     </div>
 
     <div class="mode-segment" role="tablist">
-      <button class="seg active" data-mode="dept" role="tab">Abteilung</button>
+      <button class="seg active" data-mode="dept" role="tab">Gruppe</button>
       <button class="seg" data-mode="user" role="tab">Benutzer</button>
     </div>
 
@@ -192,6 +193,11 @@
         <option value="srcIntune">Nur Intune-Apps</option>
         <!-- Vendor-Optionen werden dynamisch von rebuildVendorFilterOptions() ergaenzt -->
       </select>
+      <select id="appPlatformFilter" class="select" title="Nach Plattform filtern">
+        <option value="all">Alle Plattformen</option>
+        <option value="windows">Windows</option>
+        <option value="macos">macOS</option>
+      </select>
       <select id="appCategoryFilter" class="select" title="Nach App-Kategorie filtern">
         <option value="">Alle Kategorien</option>
         <!-- Kategorie-Optionen werden dynamisch von rebuildCategoryFilterOptions() befuellt -->
@@ -243,7 +249,7 @@
         <div class="summary-section">
           <div class="summary-section-title">Ausgewählte Empfänger</div>
           <div class="summary-row sub">
-            <span class="muted">Abteilungsgruppen</span>
+            <span class="muted">Gruppen</span>
             <span id="sumGroupsSel">0</span>
           </div>
           <div class="summary-row sub">
@@ -254,7 +260,7 @@
         <div class="summary-section">
           <div class="summary-section-title">Zuweisungen erhalten</div>
           <div class="summary-row sub">
-            <span class="muted">Abteilungsgruppen</span>
+            <span class="muted">Gruppen</span>
             <span id="sumGroupsOps">0</span>
           </div>
           <div class="summary-row sub">
@@ -611,6 +617,44 @@
   </div>
 </section>
 
+<!-- ======================= OFFBOARDING ======================= -->
+<section class="off-view hidden" id="offView">
+  <div class="off-bar">
+    <select id="offSearchType" class="input" style="height:34px;max-width:170px;">
+      <option value="name">Gerätename</option>
+      <option value="serial">Seriennummer</option>
+    </select>
+    <input id="offSearch" class="input" placeholder="Suchen… (Enter)" style="max-width:320px;height:34px;">
+    <button class="btn btn-secondary btn-sm" id="offSearchBtn">Suchen</button>
+    <span class="off-bar-spacer" style="flex:1;"></span>
+    <span id="offSelCount" class="muted">0 ausgewählt</span>
+    <button class="btn btn-danger btn-sm" id="offBtn" disabled>Offboarding…</button>
+  </div>
+  <div class="off-note muted">
+    Entfernt Geräte aus <b>Intune</b>, <b>Autopilot</b> und <b>Entra ID</b>. BitLocker-/FileVault-Keys und
+    LAPS-Passwörter werden vor dem Löschen angezeigt. Benötigt zusätzliche Berechtigungen &amp; Admin-Rollen
+    (siehe <code>docs/App-Registration.md</code>) — im Read-Only-Modus gesperrt.
+  </div>
+  <div class="off-table-wrap">
+    <table class="pol-table off-table" id="offTable">
+      <thead>
+        <tr>
+          <th style="width:34px;"><input type="checkbox" id="offCheckAll"></th>
+          <th>Gerät</th>
+          <th>Seriennr.</th>
+          <th>OS</th>
+          <th>Benutzer</th>
+          <th>Letzter Sync</th>
+          <th>Dienste</th>
+        </tr>
+      </thead>
+      <tbody id="offBody">
+        <tr><td colspan="7" class="pol-hint">Nach Geräten suchen…</td></tr>
+      </tbody>
+    </table>
+  </div>
+</section>
+
 <!-- MODAL: Wipe -->
 <div class="modal-backdrop hidden" id="wipeModalBackdrop">
   <div class="modal" style="max-width:420px;">
@@ -672,6 +716,13 @@
                 <span class="cg-mode-desc">Neue Required-Gruppe nach Naming-Schema erstellen und zuweisen.</span>
               </span>
             </label>
+            <label class="cg-mode">
+              <input type="radio" name="cgMode" value="req-existing">
+              <span class="cg-mode-body">
+                <span class="cg-mode-title">Bestehende Gruppe</span>
+                <span class="cg-mode-desc">Eine vorhandene Entra-Gruppe als Required zuweisen.</span>
+              </span>
+            </label>
             <label class="cg-mode">
               <input type="radio" name="cgMode" value="req-allusers">
               <span class="cg-mode-body">
@@ -700,6 +751,13 @@
                 <span class="cg-mode-desc">Neue Available-Gruppe nach Naming-Schema erstellen und zuweisen.</span>
               </span>
             </label>
+            <label class="cg-mode">
+              <input type="radio" name="cgMode" value="avail-existing">
+              <span class="cg-mode-body">
+                <span class="cg-mode-title">Bestehende Gruppe</span>
+                <span class="cg-mode-desc">Eine vorhandene Entra-Gruppe als Available zuweisen.</span>
+              </span>
+            </label>
             <label class="cg-mode">
               <input type="radio" name="cgMode" value="avail-allusers">
               <span class="cg-mode-body">
@@ -723,6 +781,12 @@
         <input type="text" id="cgGroupName" class="input">
         <div id="cgStatus" class="form-hint"></div>
       </div>
+      <div class="form-group" id="cgExistingGroup" hidden>
+        <label class="lbl" for="cgExistingSearch">Bestehende Gruppe suchen</label>
+        <input type="search" id="cgExistingSearch" class="input" placeholder="Gruppenname… (min. 2 Zeichen)" autocomplete="off">
+        <div id="cgExistingResults" class="cg-existing-results"></div>
+        <div id="cgExistingSelected" class="form-hint"></div>
+      </div>
       <label class="check-chip" id="cgAssignToAppWrap">
         <input type="checkbox" id="cgAssignToApp" checked>
         <span>Gruppe direkt der App zuweisen</span>
@@ -813,6 +877,29 @@
   </div>
 </div>
 
+<!-- MODAL: Policy-Import (optional umbenennen) -->
+<div id="modalPolImport" class="modal hidden">
+  <div class="modal-backdrop" data-close></div>
+  <div class="modal-box modal-lg">
+    <div class="modal-head">
+      <h3>Policies importieren</h3>
+      <button class="modal-close" data-close aria-label="Schließen">×</button>
+    </div>
+    <div class="modal-body">
+      <div class="form-hint" style="margin-bottom:12px;">
+        Namen können vor dem Import angepasst werden. Die Policies werden als
+        <b>Neuanlage</b> im verbundenen Tenant erstellt — bestehende bleiben unverändert.
+      </div>
+      <div id="polImportList"></div>
+    </div>
+    <div class="modal-foot">
+      <span id="polImportInfo" class="muted" style="margin-right:auto;"></span>
+      <button class="btn btn-secondary" data-close>Abbrechen</button>
+      <button class="btn btn-primary" id="polImportConfirm">Importieren</button>
+    </div>
+  </div>
+</div>
+
 <!-- MODAL: Policy-Zuweisung nach Import -->
 <div id="modalPolAssign" class="modal hidden">
   <div class="modal-backdrop" data-close></div>
@@ -835,28 +922,99 @@
     </div>
   </div>
 </div>
+
+<!-- MODAL: Geräte-Offboarding -->
+<div id="modalOffboard" class="modal hidden">
+  <div class="modal-backdrop" data-close></div>
+  <div class="modal-box modal-lg">
+    <div class="modal-head">
+      <h3>Geräte offboarden</h3>
+      <button class="modal-close" data-close aria-label="Schließen">×</button>
+    </div>
+    <div class="modal-body">
+      <div class="off-warn">⚠ Entfernt die Geräte aus den gewählten Diensten. Löschen ist <b>nicht umkehrbar</b>. Recovery-Keys unbedingt vorher sichern.</div>
+      <div id="offConfirmList" class="off-confirm-list"></div>
+
+      <div class="off-services">
+        <div class="lbl">Dienste</div>
+        <div class="off-svc-row">
+          <span class="off-svc-label">Entra ID:</span>
+          <label class="off-radio"><input type="radio" name="offEntra" value="none" checked> nichts tun</label>
+          <label class="off-radio"><input type="radio" name="offEntra" value="disable"> deaktivieren</label>
+          <label class="off-radio"><input type="radio" name="offEntra" value="delete"> löschen</label>
+        </div>
+        <label class="check-chip"><input type="checkbox" id="offSvcIntune" checked><span>Aus Intune löschen</span></label>
+        <label class="check-chip"><input type="checkbox" id="offSvcAutopilot"><span>Aus Autopilot löschen</span></label>
+      </div>
+
+      <div id="offKeys" class="off-keys"></div>
+
+      <label class="check-chip off-confirm-chip"><input type="checkbox" id="offConfirmChk"><span>Ich verstehe, dass die Geräte gelöscht/entfernt werden.</span></label>
+      <div id="offResults"></div>
+    </div>
+    <div class="modal-foot">
+      <span id="offModalInfo" class="muted" style="margin-right:auto;"></span>
+      <button class="btn btn-secondary" data-close>Abbrechen</button>
+      <button class="btn btn-danger" id="offExecuteBtn" disabled>Offboarding ausführen</button>
+    </div>
+  </div>
+</div>
 <style>
-  .pol-assign-row { border:1px solid var(--border, #d9dce3); border-radius:8px; padding:12px 14px; margin-bottom:12px; }
+  /* Nutzt die Theme-Variablen der App -> passt sich Light/Dark automatisch an. */
-  .pol-assign-head { display:flex; align-items:center; gap:8px; margin-bottom:10px; }
+  .pol-assign-row { border:1px solid var(--hairline); border-radius:8px; padding:12px 14px; margin-bottom:12px; overflow-wrap:anywhere; }
-  .pol-assign-head .pol-name { font-weight:600; }
+  .pol-assign-head { display:flex; align-items:baseline; gap:8px; margin-bottom:10px; flex-wrap:wrap; }
+  .pol-assign-head .pol-name { font-weight:600; color:var(--ink); min-width:0; word-break:break-word; overflow-wrap:anywhere; }
+  .pol-assign-head .pol-type-badge { flex:0 0 auto; }
   .pol-assign-pickers { display:flex; gap:16px; flex-wrap:wrap; }
   .pol-assign-picker { flex:1; min-width:220px; }
-  .pol-assign-picker > .lbl { display:block; font-size:12px; margin-bottom:4px; opacity:.85; }
+  .pol-assign-picker > .lbl { display:block; font-size:12px; margin-bottom:4px; color:var(--body); }
-  .pol-assign-picker[data-kind="exclude"] > .lbl { color:#cb2a7a; }
+  .pol-assign-picker[data-kind="exclude"] > .lbl { color:var(--pink); }
   .pol-assign-chips { display:flex; flex-wrap:wrap; gap:6px; margin-bottom:6px; }
   .pol-assign-chip { display:inline-flex; align-items:center; gap:6px; padding:2px 8px; border-radius:12px;
-    background:var(--chip-bg, #eef0f5); font-size:12px; }
+    background:var(--surface-strong); color:var(--ink); font-size:12px; }
-  .pol-assign-chip.exclude { background:#fbe3ef; }
+  .pol-assign-chip.exclude { background:rgba(236,72,153,0.18); color:var(--ink); }
-  .pol-assign-chip button { border:none; background:none; cursor:pointer; font-size:14px; line-height:1; padding:0; opacity:.6; }
+  .pol-assign-chip button { border:none; background:none; cursor:pointer; font-size:14px; line-height:1; padding:0; color:var(--muted); }
-  .pol-assign-chip button:hover { opacity:1; }
+  .pol-assign-chip button:hover { color:var(--ink); }
   .pol-assign-search-wrap { position:relative; }
   .pol-assign-dropdown { position:absolute; z-index:20; left:0; right:0; top:100%; margin-top:2px;
-    background:var(--panel, #fff); border:1px solid var(--border, #d9dce3); border-radius:6px;
+    background:var(--canvas); border:1px solid var(--hairline); border-radius:6px;
-    max-height:200px; overflow-y:auto; box-shadow:0 6px 18px rgba(0,0,0,.12); }
+    max-height:200px; overflow-y:auto; box-shadow:0 6px 18px rgba(0,0,0,.25); }
-  .pol-assign-dropdown .opt { padding:6px 10px; cursor:pointer; font-size:13px; }
+  .pol-assign-dropdown .opt { padding:6px 10px; cursor:pointer; font-size:13px; color:var(--body); }
-  .pol-assign-dropdown .opt:hover { background:var(--chip-bg, #eef0f5); }
+  .pol-assign-dropdown .opt:hover { background:var(--surface-soft); }
-  .pol-assign-dropdown .opt .desc { font-size:11px; opacity:.6; }
+  .pol-assign-dropdown .opt .desc { font-size:11px; color:var(--muted); }
-  .pol-assign-dropdown .msg { padding:6px 10px; font-size:12px; opacity:.6; }
+  .pol-assign-dropdown .msg { padding:6px 10px; font-size:12px; color:var(--muted); }
+  .pol-import-row { display:flex; align-items:center; gap:10px; padding:8px 0; border-bottom:1px solid var(--hairline); }
+  .pol-import-row:last-child { border-bottom:none; }
+  .pol-import-name { flex:1; min-width:0; }
+  .pol-import-row .pol-type-badge { flex:0 0 auto; }
+  /* Offboarding */
+  .off-view { padding:16px 20px; }
+  .off-bar { display:flex; align-items:center; gap:10px; margin-bottom:10px; flex-wrap:wrap; }
+  .off-note { font-size:12.5px; margin-bottom:12px; line-height:1.5; }
+  .off-table-wrap { overflow-x:auto; }
+  .off-table td, .off-table th { white-space:nowrap; }
+  .off-badge { display:inline-block; padding:1px 7px; border-radius:10px; font-size:11px; background:var(--surface-strong); color:var(--ink); margin-right:3px; }
+  .off-badge.warn { background:rgba(245,158,11,0.22); }
+  .off-warn { background:rgba(239,68,68,0.14); border:1px solid rgba(239,68,68,0.35); color:var(--ink);
+    border-radius:8px; padding:10px 12px; font-size:13px; margin-bottom:12px; }
+  .off-confirm-list { margin-bottom:12px; }
+  .off-confirm-row { font-size:13px; padding:4px 0; border-bottom:1px solid var(--hairline); overflow-wrap:anywhere; }
+  .off-confirm-row:last-child { border-bottom:none; }
+  .off-services { margin:12px 0; padding:12px; border:1px solid var(--hairline); border-radius:8px; }
+  .off-services .lbl { display:block; font-size:12px; color:var(--body); margin-bottom:8px; }
+  .off-svc-row { display:flex; align-items:center; gap:14px; flex-wrap:wrap; margin-bottom:10px; }
+  .off-svc-label { font-size:13px; color:var(--ink); font-weight:600; }
+  .off-radio { display:inline-flex; align-items:center; gap:5px; font-size:13px; cursor:pointer; }
+  .off-keys { margin:12px 0; }
+  .off-keys .lbl { display:block; font-size:12px; color:var(--pink); margin-bottom:6px; }
+  .off-key-dev { border:1px solid var(--hairline); border-radius:6px; padding:8px 10px; margin-bottom:6px; font-size:12.5px; overflow-wrap:anywhere; }
+  .off-key { margin-top:3px; }
+  .off-key code { background:var(--surface-strong); color:var(--ink); padding:1px 5px; border-radius:4px; user-select:all; }
+  .off-confirm-chip { margin-top:8px; }
+  .off-result { font-size:13px; padding:3px 0; overflow-wrap:anywhere; }
+  .off-result.ok { color:var(--success); }
+  .off-result.fail { color:var(--error); }
+  #offResults .lbl { display:block; font-size:12px; color:var(--body); margin:10px 0 4px; }
 </style>
 
 <!-- MODAL: Hilfe -->

www/styles.css

@@ -4020,6 +4020,67 @@ body.members-page {
   color: var(--muted);
 }
 
+/* "Bestehende Gruppe" — Suchergebnis-Liste im Zuweisungs-Dialog */
+.cg-existing-results {
+  margin-top: 8px;
+  max-height: 220px;
+  overflow-y: auto;
+  border: 1px solid var(--hairline-soft);
+  border-radius: var(--r-xs);
+}
+.cg-existing-results:empty { display: none; }
+.cg-existing-item {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  width: 100%;
+  text-align: left;
+  padding: 8px 12px;
+  background: transparent;
+  border: none;
+  border-bottom: 1px solid var(--hairline-soft);
+  cursor: pointer;
+  color: inherit;
+}
+.cg-existing-item:last-child { border-bottom: none; }
+.cg-existing-item:hover { background: var(--hover, rgba(127,127,127,0.08)); }
+.cg-existing-item.is-selected { background: var(--accent-soft); }
+.cg-existing-name { font-size: 13px; font-weight: 600; }
+.cg-existing-desc { font-size: 11px; color: var(--muted); }
+.cg-existing-empty { padding: 10px 12px; font-size: 12px; color: var(--muted); }
+
+/* Ausgewaehlte Gruppen als Chips (Mehrfachauswahl) */
+.cg-existing-chips {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+  margin-top: 8px;
+}
+.cg-chip {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  padding: 3px 6px 3px 10px;
+  background: var(--accent-soft);
+  color: var(--brand-accent);
+  border-radius: 999px;
+  font-size: 12px;
+  font-weight: 600;
+  max-width: 100%;
+}
+.cg-chip-name { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 220px; }
+.cg-chip-x {
+  border: none;
+  background: transparent;
+  color: inherit;
+  cursor: pointer;
+  font-size: 15px;
+  line-height: 1;
+  padding: 0 2px;
+  opacity: 0.75;
+}
+.cg-chip-x:hover { opacity: 1; }
+
 .cg-mode {
   display: flex;
   align-items: flex-start;