v0.1.32 — Bulk-Offboarding aus dem Geraete-Tab, Geraete-Ladefehler behoben

- Bulk-Offboarding aus dem Geraete-Tab (Checkboxen + Alle, POST /api/offboard/resolve)
- Fix "Geraete konnten nicht geladen werden" (400): managementState raus dem $select,
  $orderby entfernt, Namensfilter-Fallback auf deviceName, beta-Endpoint
- Bessere Graph-Fehler-Diagnose (Graph-Body an die Meldung anhaengen)
- Offboard: Grund fuer nicht gefundene Autopilot-Zuordnung sichtbar (autopilotNote)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,39 @@ Versionierung folgt [Semantic Versioning](https://semver.org/lang/de/) — solan
 
 ---
 
+## [0.1.32] - 2026-09-11
+
+Bulk-Offboarding aus dem Geräte-Tab, Geräte-Ladefehler behoben, bessere Graph-Diagnose.
+
+### Neu
+
+- **Bulk-Offboarding aus dem Geräte-Tab**: Geräte per Checkbox (inkl. „Alle sichtbaren") auswählen und über den Button **„Offboarden"** direkt in den Offboard-Dialog übergeben — kombinierbar mit dem Gruppen-Filter (z. B. alle Geräte einer Gruppe). Die Auswahl wird server-seitig zu vollständigen Offboard-Objekten aufgelöst (Entra-Object-Id + Autopilot-Id nachgeladen). Neuer Endpoint `POST /api/offboard/resolve`. Im Read-Only-Modus ausgeblendet.
+
+### Behoben
+
+- **„Geräte konnten nicht geladen werden" (400 BadRequest)**: Intunes DeviceFE-Backend lehnte die Abfrage ab. Ursachen entfernt: `managementState` ist kein gültiges `$select`-Feld (raus), `$orderby` wird nicht mehr gesendet (Sortierung macht das Frontend), und der Namensfilter fällt bei nicht unterstütztem `startswith` automatisch auf `deviceName`-only zurück. Geräte-Endpoints nutzen jetzt `beta` (wie der Offboard-Abruf).
+- **Bessere Graph-Fehler-Diagnose**: Bei Nicht-Retry-Fehlern wird der **Graph-Fehler-Body** an die Meldung gehängt (statt nur „BadRequest") — die eigentliche Ursache steht jetzt im Log/Toast.
+- **Offboarding**: Wird eine Autopilot-Zuordnung nicht gefunden, zeigt der Dialog jetzt den **Grund** (fehlende Berechtigung vs. kein Seriennummer-Treffer), statt kommentarlos „Autopilot: –".
+
+---
+
+## [0.1.31] - 2026-09-11
+
+Policy-Konsolidierung, Geräte-Export nach Gruppe, Gruppen-in-Gruppen, Geräte-Fixes.
+
+### Neu
+
+- **Policies zusammenführen** (Settings Catalog): Mehrere Settings-Catalog-Policies zu **einer neuen** Policy vereinen. Gleiche Einstellungen werden einmal übernommen, **Konflikte** (gleiche `settingDefinitionId`, anderer Wert) werden vor dem Anlegen angezeigt und pro Konflikt aufgelöst. Button „Konsolidieren" im Policies-Tab (ab 2 gewählten Settings-Catalog-Policies). Neuer Endpoint `POST /api/policies/consolidate`.
+- **Geräte nach Gruppe exportieren**: Im **Geräte**-Tab neuer **Gruppen-Filter** (Live-Suche) — die Liste zeigt nur die Geräte der Gruppen-User (inkl. verschachtelter Gruppen) — plus **CSV-Export** der aktuell angezeigten Liste. Kombinierbar mit Suche/OS/Compliance. Neuer Endpoint `GET /api/groups/{id}/devices/export`.
+- **Gruppen zu Gruppen hinzufügen**: Im Group-Management-Tab „Benutzer | Gruppen hinzufügen" ein Umschalter **Benutzer / Gruppen** — eine bestehende Gruppe als Mitglied (verschachtelte Gruppe) zur gewählten Gruppe hinzufügen.
+
+### Behoben
+
+- **Geräte „Invalid Date"**: `lastSyncDateTime`/`enrolledDateTime` werden jetzt server-seitig als ISO 8601 normalisiert (`ConvertTo-IsoDate`) — vorher kam unter PowerShell 5.1 ein nicht parsbares Format an. Anzeige zusätzlich robust (ungültig → „—").
+- **Geräte-Sortierung**: Die Spalten-Sortierung war komplett wirkungslos (Header-Feldnamen ≠ Item-Properties). Jetzt sortieren alle Spalten korrekt, **Datums-Spalten numerisch** nach Zeitstempel (Klick auf „Letzter Sync" / „Eingeschrieben").
+
+---
+
 ## [0.1.30] - 2026-09-03
 
 Policy-Bulk-Import gehärtet, macOS-Apps, Gruppen-Suche & Direkt-Zuweisung an Apps.

README.md

@@ -90,7 +90,7 @@ Schlaegt diese fehl, wird automatisch auf die **Read-Only-App-ID** (`clientIdRo`
 
 - App-Zuweisung (Required / Available hinzufuegen und entfernen)
 - Gruppen erstellen und loeschen
-- Tab „Benutzer hinzufuegen" im Group Management
+- Tab „Benutzer | Gruppen hinzufuegen" im Group Management
 - Tab „CSV-Import" im Group Management
 - Session-Ausfuehren-Button
 - Alle Rename-/Delete-Buttons
@@ -132,10 +132,10 @@ App-Registrierung automatisch anlegt/konfiguriert:**
 | Tab                | Beschreibung                                                |
 |--------------------|-------------------------------------------------------------|
 | App Management     | Haupt-Ansicht: Apps laden, Gruppen zuweisen / entfernen     |
-| Group Management   | Mitglieder anzeigen, exportieren, Benutzer hinzufuegen, CSV-Import |
+| Group Management   | Mitglieder anzeigen/exportieren, Benutzer **und Gruppen** hinzufuegen, CSV-Import |
 | App Report         | Installationszaehler pro App, Geraete-Export als CSV        |
-| Geräte             | Geraete suchen, Detail-Panel, Aktionen (Sync, Wipe, …)      |
-| Policies           | Policies exportieren (JSON-Download) und importieren (Neuanlage) |
+| Geräte             | Geraete suchen, Filter (auch nach **Gruppe**), CSV-Export, **Bulk-Offboarding**, Detail-Panel, Aktionen (Sync, Wipe, …) |
+| Policies           | Policies exportieren/importieren (Neuanlage) und **zusammenfuehren** (Settings Catalog) |
 
 ---
 
@@ -148,10 +148,11 @@ App-Registrierung automatisch anlegt/konfiguriert:**
 - Filter zum Einschraenken der Anzeige
 - **Als CSV exportieren** laedt alle Mitglieder als `members-<Gruppe>-<Datum>.csv`
 
-### Benutzer hinzufuegen *(nur Read/Write)*
+### Benutzer | Gruppen hinzufuegen *(nur Read/Write)*
 
-- Benutzer per Name, UPN oder E-Mail suchen
-- Mehrere Benutzer auswaehlen und gemeinsam hinzufuegen
+- Umschalter **Benutzer / Gruppen** oben im Tab
+- Benutzer per Name, UPN oder E-Mail suchen — oder Gruppen per Name (verschachtelte Gruppen)
+- Mehrere Eintraege auswaehlen und gemeinsam zur gewaehlten Gruppe hinzufuegen
 
 ### CSV-Import *(nur Read/Write)*
 
@@ -235,6 +236,16 @@ neu an. Unterstuetzte Typen:
 > bekommen bei Bedarf einen Default-`scheduledActionsForRule`-Block, den Graph
 > beim Anlegen zwingend verlangt.
 
+### Konsolidieren *(nur Read/Write, nur Settings Catalog)*
+
+- Mindestens zwei **Settings-Catalog**-Policies per Checkbox waehlen →
+  **„Konsolidieren"**
+- Die Einstellungen werden zu **einer neuen** Policy vereint (Neuanlage) — gleiche
+  `settingDefinitionId` mit gleichem Wert wird einmal uebernommen
+- **Konflikte** (gleiche Einstellung, unterschiedlicher Wert) werden vor dem
+  Anlegen angezeigt; pro Konflikt waehlst du, welche Policy gewinnt
+- Voraussetzung: gleiche Plattform. Zuweisungen werden nicht uebernommen.
+
 ### Benoetigt Graph-Berechtigung
 
 `DeviceManagementConfiguration.ReadWrite.All` (Import) bzw.
@@ -295,8 +306,9 @@ Intune Manager/
 | POST    | `/api/groups/resolve-upns`                | Read      | UPN-Liste → UserId + DisplayName         |
 | GET     | `/api/groups/{id}/members`                | Read      | Mitglieder einer Gruppe                  |
 | GET     | `/api/groups/{id}/members/export`         | Read      | Mitglieder als CSV                       |
-| POST    | `/api/groups/{id}/members`                | **Write** | Benutzer zur Gruppe hinzufuegen          |
-| DELETE  | `/api/groups/{id}/members/{uid}`          | **Write** | Benutzer aus Gruppe entfernen            |
+| POST    | `/api/groups/{id}/members`                | **Write** | Benutzer/Gruppen zur Gruppe hinzufuegen  |
+| DELETE  | `/api/groups/{id}/members/{uid}`          | **Write** | Benutzer/Gruppe aus Gruppe entfernen     |
+| GET     | `/api/groups/{id}/devices/export`         | Read+MDM  | Geraete der Gruppen-User als CSV         |
 | GET     | `/api/users?q=`                           | Read      | Benutzer suchen                          |
 | GET     | `/api/apps`                               | Read      | Apps laden (cached)                      |
 | POST    | `/api/apps/refresh`                       | Read      | Apps neu laden                           |
@@ -311,6 +323,7 @@ Intune Manager/
 | POST    | `/api/policies/export`                     | Read+Cfg  | Ausgewaehlte Policies als JSON exportieren |
 | GET     | `/api/policies/exports`                    | —         | Server-Archiv der Exporte auflisten      |
 | POST    | `/api/policies/import`                     | **Write** | Policies als Neuanlage importieren       |
+| POST    | `/api/policies/consolidate`                | **Write** | Settings-Catalog-Policies zusammenfuehren |
 
 > **Read+MDM** = benoetigt zusaetzlich `DeviceManagementManagedDevices.Read.All`
 > **Read+Cfg** = benoetigt `DeviceManagementConfiguration.Read.All` (Export) bzw. `.ReadWrite.All` (Import)

Start.ps1

@@ -189,7 +189,7 @@ $script:State = [pscustomobject]@{
     Session        = @()      # geplante Zuweisungen
 }
 
-$script:ToolVersion = "0.1.30"
+$script:ToolVersion = "0.1.32"
 $script:BuildStamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
 
 Write-Host ""

installer/build-local.ps1

@@ -12,7 +12,7 @@ if (Test-Path "$x64Dotnet\dotnet.exe") {
     $env:DOTNET_ROOT = "C:\Program Files\dotnet"
 }
 
-$version      = "0.1.30"
+$version      = "0.1.32"
 $src          = "\\Mac\Home\ClaudePRJ\Intune Manager"
 $stage        = "$env:TEMP\IntuneManagerStage"
 $installerDir = "$src\installer"

src/Api.ps1

@@ -58,10 +58,12 @@ function Invoke-ApiHandler {
         "GET /api/policies/exports"       { return Get-PolicyExportsEndpoint }
         "POST /api/policies/import"       { return Import-PoliciesEndpoint -Body $Body }
         "POST /api/policies/assign"       { return Invoke-PolicyAssignEndpoint -Body $Body }
+        "POST /api/policies/consolidate"  { return Invoke-PolicyConsolidateEndpoint -Body $Body }
         "POST /api/policies/git-snapshot" { return Invoke-PolicyGitSnapshotEndpoint }
         "POST /api/pickfolder"            { return Invoke-FolderPickerEndpoint -Body $Body }
 
         "GET /api/offboard/search"        { return Search-OffboardDevicesEndpoint -Query $Query }
+        "POST /api/offboard/resolve"      { return Get-OffboardResolveEndpoint -Body $Body }
         "POST /api/offboard/keys"         { return Get-OffboardKeysEndpoint -Body $Body }
         "POST /api/offboard/execute"      { return Invoke-OffboardExecuteEndpoint -Body $Body }
     }
@@ -71,6 +73,9 @@ function Invoke-ApiHandler {
     if ($Method -eq "GET" -and $Path -match "^/api/groups/([^/]+)/members/export$") {
         return Get-GroupMembersExportEndpoint -GroupId $matches[1]
     }
+    if ($Method -eq "GET" -and $Path -match "^/api/groups/([^/]+)/devices/export$") {
+        return Get-GroupDevicesExportEndpoint -GroupId $matches[1]
+    }
 
     if ($Method -eq "GET" -and $Path -match "^/api/groups/([^/]+)/members$") {
         return Get-GroupMembersEndpoint -GroupId $matches[1]
@@ -1608,6 +1613,117 @@ function Get-GroupMembersExportEndpoint {
     }
 }
 
+function Get-GroupDevicesExportEndpoint {
+    # Loest die User einer Gruppe (inkl. verschachtelter Untergruppen) auf und liefert
+    # deren Intune-Geraete (Geraete, deren PRIMAERER Benutzer in der Gruppe ist) fuer
+    # einen CSV-Export. Geraete werden per $batch ueber userId eq '<id>' geholt.
+    param([string]$GroupId)
+    $err = Test-Connected
+    if ($err) { return $err }
+    if ([string]::IsNullOrWhiteSpace($GroupId)) { return @{ __status = 400; error = "GroupId fehlt" } }
+
+    $groupName = $GroupId
+    try {
+        $g = Get-GraphGroupById -Id $GroupId -Property @("id","displayName")
+        if ($g.displayName) { $groupName = [string]$g.displayName }
+    } catch {
+        return @{ __status = 404; error = "Gruppe nicht gefunden: $($_.Exception.Message)" }
+    }
+
+    Write-Host "[GRP-DEV-EXPORT] Geraete-Export fuer Gruppe '$groupName' ($GroupId)" -ForegroundColor Cyan
+    $sw = [System.Diagnostics.Stopwatch]::StartNew()
+
+    # User aufloesen + deduplizieren (nur eindeutige Entra-User-Ids)
+    $allUsers = @(Resolve-GroupMembersWithNesting -GroupId $GroupId -GroupName $groupName)
+    $seen    = @{}
+    $userIds = [System.Collections.Generic.List[string]]::new()
+    $userMap = @{}   # userId -> @{ Upn; DisplayName } (aus den Gruppen-Mitgliedern)
+    foreach ($u in $allUsers) {
+        $uid = [string]$u.Id
+        if ($uid -and -not $seen.ContainsKey($uid)) {
+            $seen[$uid] = $true
+            $userIds.Add($uid)
+            $userMap[$uid] = @{ Upn = [string]$u.UserPrincipalName; DisplayName = [string]$u.DisplayName }
+        }
+    }
+    if ($userIds.Count -eq 0) {
+        return @{ ok = $true; groupId = $GroupId; groupName = $groupName; userCount = 0; items = @(); count = 0; resolvedMs = [int]$sw.ElapsedMilliseconds }
+    }
+
+    $select    = 'id,deviceName,userDisplayName,userPrincipalName,operatingSystem,osVersion,complianceState,serialNumber,model,manufacturer,lastSyncDateTime,enrolledDateTime'
+    $batchSize = 20
+    $devSeen   = @{}
+    $items     = [System.Collections.Generic.List[object]]::new()
+    $ids       = $userIds.ToArray()
+    $script:GrpDevErrors = @()
+
+    for ($i = 0; $i -lt $ids.Count; $i += $batchSize) {
+        $chunk    = $ids[$i .. [Math]::Min($i + $batchSize - 1, $ids.Count - 1)]
+        $requests = @()
+        for ($j = 0; $j -lt $chunk.Count; $j++) {
+            # Kanonischer Weg: die managedDevices-Navigation des Users. Zuverlaessiger
+            # als $filter=userId eq '..' auf /deviceManagement/managedDevices.
+            $requests += @{ id = [string]($i + $j); method = 'GET'; url = "/users/$($chunk[$j])/managedDevices?`$select=$select" }
+        }
+        $body = @{ requests = $requests } | ConvertTo-Json -Depth 5 -Compress
+        try {
+            $resp = Invoke-MgGraphRequestRetry -Uri 'https://graph.microsoft.com/beta/$batch' -Method POST -Body $body -ContentType 'application/json'
+            foreach ($r in @($resp.responses)) {
+                if ([int]$r.status -ne 200) {
+                    if (@($script:GrpDevErrors).Count -lt 3) {
+                        $em = $null
+                        try { $em = [string]$r.body.error.message } catch {}
+                        $script:GrpDevErrors += "HTTP $($r.status)$(if ($em) { ": $em" })"
+                    }
+                    continue
+                }
+                # Batch-Request-Id -> Index in $ids -> Gruppen-User (fuer UPN/Name-Fallback,
+                # da managedDevice.userPrincipalName bei Graph oft leer ist).
+                $owner = $null
+                $reqIdx = -1; if ([int]::TryParse([string]$r.id, [ref]$reqIdx)) {
+                    if ($reqIdx -ge 0 -and $reqIdx -lt $ids.Count) { $owner = $userMap[$ids[$reqIdx]] }
+                }
+                foreach ($d in @($r.body.value)) {
+                    $did = [string]$d.id
+                    if (-not $did -or $devSeen.ContainsKey($did)) { continue }
+                    $devSeen[$did] = $true
+                    $upn  = if ($d.userPrincipalName) { [string]$d.userPrincipalName } elseif ($owner) { $owner.Upn } else { '' }
+                    $udn  = if ($d.userDisplayName)   { [string]$d.userDisplayName }   elseif ($owner) { $owner.DisplayName } else { '' }
+                    $items.Add([pscustomobject]@{
+                        Id                = $did
+                        DeviceName        = [string]$d.deviceName
+                        UserDisplayName   = $udn
+                        UserPrincipalName = $upn
+                        OS                = [string]$d.operatingSystem
+                        OSVersion         = [string]$d.osVersion
+                        ComplianceState   = [string]$d.complianceState
+                        SerialNumber      = [string]$d.serialNumber
+                        Model             = [string]$d.model
+                        Manufacturer      = [string]$d.manufacturer
+                        LastSync          = ConvertTo-IsoDate $d.lastSyncDateTime
+                        EnrolledDateTime  = ConvertTo-IsoDate $d.enrolledDateTime
+                    })
+                }
+            }
+        } catch {
+            Write-Host "  [GRP-DEV-EXPORT] Batch-Fehler: $($_.Exception.Message)" -ForegroundColor DarkYellow
+        }
+    }
+
+    $sw.Stop()
+    Write-Host "  -> $($items.Count) Geraete fuer $($userIds.Count) User, $($sw.ElapsedMilliseconds)ms" -ForegroundColor Green
+    return @{
+        ok         = $true
+        groupId    = $GroupId
+        groupName  = $groupName
+        userCount  = $userIds.Count
+        items      = @($items.ToArray())
+        count      = $items.Count
+        resolvedMs = [int]$sw.ElapsedMilliseconds
+        errors     = @($script:GrpDevErrors)
+    }
+}
+
 # ============================================================
 # Users
 # ============================================================
@@ -1669,12 +1785,14 @@ function Search-DevicesEndpoint {
     $err = Test-Connected
     if ($err) { return $err }
 
-    $q          = [string]$Query.q
+    $q          = ([string]$Query.q) -replace "'", "''"   # OData-Escape fuer Apostroph
     $os         = [string]$Query.os
     $compliance = [string]$Query.compliance
     $top        = 50
 
-    $select = 'id,deviceName,userDisplayName,userPrincipalName,operatingSystem,osVersion,complianceState,lastSyncDateTime,managementState,serialNumber,model,manufacturer,enrolledDateTime'
+    # HINWEIS: 'managementState' ist KEIN gueltiges $select-Feld auf managedDevices
+    # -> fuehrt zu 400 BadRequest. Bewusst weggelassen.
+    $select = 'id,deviceName,userDisplayName,userPrincipalName,operatingSystem,osVersion,complianceState,lastSyncDateTime,serialNumber,model,manufacturer,enrolledDateTime'
 
     # Ohne Suchbegriff: alle Geräte (erste Seite)
     # Mit Suchbegriff: Graph unterstuetzt startswith nur auf deviceName/userDisplayName/userPrincipalName.
@@ -1683,22 +1801,36 @@ function Search-DevicesEndpoint {
     $snItems   = @()
 
     if ($q -and $q.Length -ge 2) {
-        $filters = @()
-        $nameFilter = "(startswith(deviceName,'$q') or startswith(userDisplayName,'$q') or startswith(userPrincipalName,'$q'))"
-        $filters += $nameFilter
-        if ($os)         { $filters += "operatingSystem eq '$os'" }
-        if ($compliance) { $filters += "complianceState eq '$compliance'" }
-        $filterStr = '$filter=' + [uri]::EscapeDataString(($filters -join ' and ')) + '&'
-        $uri = "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?${filterStr}`$select=$select&`$top=$top&`$orderby=deviceName"
-        $resp = Invoke-MgGraphRequestRetry -Uri $uri -Method GET
-        $nameItems = @($resp.value)
+        $osComp = @()
+        if ($os)         { $osComp += "operatingSystem eq '$os'" }
+        if ($compliance) { $osComp += "complianceState eq '$compliance'" }
+        # Voller Namensfilter vs. nur deviceName. Manche Intune-Backends (DeviceFE)
+        # unterstuetzen startswith NUR auf deviceName -> bei "Unsupported parameter"
+        # (400) auf deviceName-only zurueckfallen. Kein $orderby mit $filter.
+        $nameVariants = @(
+            "(startswith(deviceName,'$q') or startswith(userDisplayName,'$q') or startswith(userPrincipalName,'$q'))",
+            "startswith(deviceName,'$q')"
+        )
+        for ($vi = 0; $vi -lt $nameVariants.Count; $vi++) {
+            $filters   = @($nameVariants[$vi]) + $osComp
+            $filterStr = '$filter=' + [uri]::EscapeDataString(($filters -join ' and ')) + '&'
+            $uri = "https://graph.microsoft.com/beta/deviceManagement/managedDevices?${filterStr}`$select=$select&`$top=$top"
+            try {
+                $resp = Invoke-MgGraphRequestRetry -Uri $uri -Method GET
+                $nameItems = @($resp.value)
+                break
+            } catch {
+                if ($vi -eq $nameVariants.Count - 1) { throw }   # letzter Versuch -> durchreichen
+                Write-Host "  [DEVICES] Namensfilter nicht unterstuetzt -> Fallback auf deviceName-only" -ForegroundColor DarkYellow
+            }
+        }
 
         # Seriennummer: exakter Vergleich (Graph unterstuetzt kein startswith auf serialNumber)
         $snFilters = @("serialNumber eq '$q'")
         if ($os)         { $snFilters += "operatingSystem eq '$os'" }
         if ($compliance) { $snFilters += "complianceState eq '$compliance'" }
         $snFilter = '$filter=' + [uri]::EscapeDataString(($snFilters -join ' and ')) + '&'
-        $snUri = "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?${snFilter}`$select=$select&`$top=10"
+        $snUri = "https://graph.microsoft.com/beta/deviceManagement/managedDevices?${snFilter}`$select=$select&`$top=10"
         try {
             $snResp = Invoke-MgGraphRequestRetry -Uri $snUri -Method GET
             $snItems = @($snResp.value)
@@ -1708,7 +1840,9 @@ function Search-DevicesEndpoint {
         if ($os)         { $filters += "operatingSystem eq '$os'" }
         if ($compliance) { $filters += "complianceState eq '$compliance'" }
         $filterStr = if ($filters.Count -gt 0) { '$filter=' + [uri]::EscapeDataString(($filters -join ' and ')) + '&' } else { '' }
-        $uri = "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?${filterStr}`$select=$select&`$top=$top&`$orderby=deviceName"
+        # Kein $orderby: das Intune-DeviceFE-Backend lehnt es (mit/ohne Filter) teils ab.
+        # Die Sortierung macht ohnehin das Frontend.
+        $uri = "https://graph.microsoft.com/beta/deviceManagement/managedDevices?${filterStr}`$select=$select&`$top=$top"
         $resp = Invoke-MgGraphRequestRetry -Uri $uri -Method GET
         $nameItems = @($resp.value)
     }
@@ -1728,12 +1862,12 @@ function Search-DevicesEndpoint {
             OS               = $d.operatingSystem
             OSVersion        = $d.osVersion
             ComplianceState  = $d.complianceState
-            LastSync         = $d.lastSyncDateTime
+            LastSync         = ConvertTo-IsoDate $d.lastSyncDateTime
             ManagementState  = $d.managementState
             SerialNumber     = $d.serialNumber
             Model            = $d.model
             Manufacturer     = $d.manufacturer
-            EnrolledDateTime = $d.enrolledDateTime
+            EnrolledDateTime = ConvertTo-IsoDate $d.enrolledDateTime
         }
     }
     return @{ items = $items; count = $items.Count }
@@ -1744,8 +1878,9 @@ function Get-DeviceEndpoint {
     $err = Test-Connected
     if ($err) { return $err }
 
-    $select = 'id,deviceName,userDisplayName,userPrincipalName,operatingSystem,osVersion,complianceState,lastSyncDateTime,managementState,serialNumber,model,manufacturer,enrolledDateTime,imei,wiFiMacAddress,azureADDeviceId,joinType,deviceEnrollmentType,managedDeviceOwnerType,totalStorageSpaceInBytes,freeStorageSpaceInBytes'
-    $d = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/$DeviceId`?`$select=$select" -Method GET
+    # 'managementState' entfernt: kein gueltiges $select-Feld auf managedDevices (400).
+    $select = 'id,deviceName,userDisplayName,userPrincipalName,operatingSystem,osVersion,complianceState,lastSyncDateTime,serialNumber,model,manufacturer,enrolledDateTime,imei,wiFiMacAddress,azureADDeviceId,joinType,deviceEnrollmentType,managedDeviceOwnerType,totalStorageSpaceInBytes,freeStorageSpaceInBytes'
+    $d = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/deviceManagement/managedDevices/$DeviceId`?`$select=$select" -Method GET
 
     $totalGB = if ($d.totalStorageSpaceInBytes) { [math]::Round($d.totalStorageSpaceInBytes / 1GB, 1) } else { $null }
     $freeGB  = if ($d.freeStorageSpaceInBytes)  { [math]::Round($d.freeStorageSpaceInBytes  / 1GB, 1) } else { $null }
@@ -1758,12 +1893,12 @@ function Get-DeviceEndpoint {
         OS               = $d.operatingSystem
         OSVersion        = $d.osVersion
         ComplianceState  = $d.complianceState
-        LastSync         = $d.lastSyncDateTime
+        LastSync         = ConvertTo-IsoDate $d.lastSyncDateTime
         ManagementState  = $d.managementState
         SerialNumber     = $d.serialNumber
         Model            = $d.model
         Manufacturer     = $d.manufacturer
-        EnrolledDateTime = $d.enrolledDateTime
+        EnrolledDateTime = ConvertTo-IsoDate $d.enrolledDateTime
         Imei             = $d.imei
         WiFiMac          = $d.wiFiMacAddress
         AzureADDeviceId  = $d.azureADDeviceId

src/Graph.ps1

@@ -71,6 +71,11 @@ function Invoke-MgGraphRequestRetry {
                 Start-Sleep -Seconds $wait
                 continue
             }
+            # Nicht-Retry-Fehler: den Graph-Fehler-Body (mit dem eigentlichen Grund)
+            # an die Meldung haengen — sonst steht im Log nur "BadRequest".
+            $gbody = $null
+            try { $gbody = [string]$_.ErrorDetails.Message } catch {}
+            if ($gbody) { throw [System.Exception]::new("$msg | Graph: $gbody", $_.Exception) }
             throw
         }
     }

src/Offboard.ps1

@@ -55,6 +55,15 @@ function Search-OffboardDevicesEndpoint {
         return @{ __status = 500; error = "Graph-Fehler bei der Suche: $m" }
     }
     if ($intune.Count -eq 0) { return @{ items = @(); count = 0 } }
+    return @{ items = @(Resolve-OffboardItems -IntuneDevices $intune); count = $intune.Count }
+}
+
+# Reichert Intune-managedDevice-Objekte mit Entra-Objekt-Id + Autopilot-Id an
+# (per $batch) und liefert die Offboard-Item-Struktur fuers Frontend.
+function Resolve-OffboardItems {
+    param([object[]]$IntuneDevices)
+    $intune = @($IntuneDevices)
+    if ($intune.Count -eq 0) { return @() }
 
     # Entra-Objekt (fuer Delete) + Autopilot-Identity (fuer Delete) per Batch nachladen.
     $reqs = @()
@@ -77,9 +86,23 @@ function Search-OffboardDevicesEndpoint {
     $items = @()
     $idx   = 0
     foreach ($d in $intune) {
-        $entra = $null; $autop = $null
+        $ser   = [string]$d.serialNumber
+        $entra = $null; $autop = $null; $apNote = ''
         $er = $batch["e$idx"]; if ($er -and [int]$er.status -eq 200) { $entra = @($er.body.value)[0] }
-        $ar = $batch["a$idx"]; if ($ar -and [int]$ar.status -eq 200) { $autop = @($ar.body.value)[0] }
+        $ar = $batch["a$idx"]
+        if ($ar) {
+            $ast = [int]$ar.status
+            if ($ast -eq 200) {
+                $autop = @($ar.body.value)[0]
+                if (-not $autop) { $apNote = 'Kein Autopilot-Treffer fuer Seriennummer' }
+            } else {
+                $acode = ''; try { $acode = [string]$ar.body.error.code } catch {}
+                $apNote = "Autopilot-Lookup fehlgeschlagen: HTTP $ast" + $(if ($acode) { " ($acode)" } else { '' })
+                Write-Host "  [OFFBOARD] Autopilot-Lookup ($($d.deviceName), SN=$ser): HTTP $ast $acode" -ForegroundColor DarkYellow
+            }
+        } elseif (-not $ser) {
+            $apNote = 'Keine Seriennummer am Intune-Geraet'
+        }
         $items += [pscustomobject]@{
             deviceName      = [string]$d.deviceName
             serialNumber    = [string]$d.serialNumber
@@ -94,13 +117,39 @@ function Search-OffboardDevicesEndpoint {
             entraObjectId   = if ($entra) { [string]$entra.id } else { '' }
             entraEnabled    = if ($entra) { [bool]$entra.accountEnabled } else { $null }
             autopilotId     = if ($autop) { [string]$autop.id } else { '' }
+            autopilotNote   = $apNote
             inIntune        = $true
             inEntra         = [bool]$entra
             inAutopilot     = [bool]$autop
         }
         $idx++
     }
-    return @{ items = @($items); count = $items.Count }
+    return @($items)
+}
+
+# Offboard-Items zu einer Liste von Intune-Device-Ids aufloesen (fuer Bulk-
+# Offboarding aus dem Geraete-Tab). Body: { ids: [intuneDeviceId, ...] }
+function Get-OffboardResolveEndpoint {
+    param($Body)
+    $err = Test-Connected
+    if ($err) { return $err }
+    $ids = @(Get-PolicyProp $Body 'ids') | Where-Object { $_ }
+    if (@($ids).Count -eq 0) { return @{ items = @(); count = 0 } }
+
+    $sel  = 'id,deviceName,serialNumber,operatingSystem,osVersion,userPrincipalName,lastSyncDateTime,azureADDeviceId,managedDeviceOwnerType,managementAgent'
+    $reqs = @()
+    $i    = 0
+    foreach ($id in $ids) {
+        $reqs += @{ id = "d$i"; method = 'GET'; url = "/deviceManagement/managedDevices/$([string]$id)?`$select=$sel" }
+        $i++
+    }
+    $batch = Invoke-GraphBatch -Requests $reqs
+    $devs  = @()
+    foreach ($k in @($batch.Keys)) {
+        $r = $batch[$k]
+        if ($r -and [int]$r.status -eq 200 -and $r.body) { $devs += $r.body }
+    }
+    return @{ items = @(Resolve-OffboardItems -IntuneDevices $devs); count = @($devs).Count }
 }
 
 # Recovery-Keys eines Geraets holen (vor dem Loeschen). Body:

src/PolicyIO.ps1

@@ -738,6 +738,161 @@ function Invoke-PolicyAssignEndpoint {
     return @{ ok = $true; assignedCount = $ok; results = @($results) }
 }
 
+# ============================================================
+# Settings-Catalog-Policies zu EINER neuen Policy zusammenfuehren
+# ============================================================
+
+# settingDefinitionId eines Settings-Elements (Wrapper { settingInstance, id }).
+function Get-SettingDefinitionId {
+    param($SettingElement)
+    $si = Get-PolicyProp $SettingElement 'settingInstance'
+    if (-not $si) { $si = $SettingElement }
+    return [string](Get-PolicyProp $si 'settingDefinitionId')
+}
+
+# Kanonische, stabil sortierte JSON-Darstellung der settingInstance -> Wert-Vergleich
+# fuer die Konflikt-Erkennung (gleiche Definition, unterschiedlicher Wert = Konflikt).
+function Get-SettingCanonicalJson {
+    param($SettingElement)
+    $si = Get-PolicyProp $SettingElement 'settingInstance'
+    if (-not $si) { $si = $SettingElement }
+    return ((ConvertTo-StableObject $si) | ConvertTo-Json -Depth 50 -Compress)
+}
+
+# Body: { ids:[...], mode:"preview"|"create", name?, description?, resolutions?:{ <defId>:<sourceId> } }
+# Nur Settings Catalog. Fuehrt die 'settings' mehrerer Policies zu einer neuen zusammen.
+# Gleiche settingDefinitionId + gleicher Wert -> einmal uebernommen. Gleiche Definition,
+# anderer Wert -> Konflikt: Default gewinnt die zuerst gewaehlte Policy, per 'resolutions'
+# ueberschreibbar. Import erfolgt als Neuanlage (nie Ueberschreiben).
+function Invoke-PolicyConsolidateEndpoint {
+    param($Body)
+    try { Assert-GraphConnected } catch { return @{ __status = 401; error = 'Nicht mit Microsoft Graph verbunden' } }
+
+    $ids  = @(Get-PolicyProp $Body 'ids') | Where-Object { $_ }
+    if (@($ids).Count -lt 2) { return @{ __status = 400; error = 'Bitte mindestens zwei Settings-Catalog-Policies auswaehlen.' } }
+
+    $mode        = [string](Get-PolicyProp $Body 'mode'); if (-not $mode) { $mode = 'preview' }
+    $resolutions = Get-PolicyProp $Body 'resolutions'
+
+    # Details laden (Reihenfolge = Auswahlreihenfolge = Default-Konfliktgewinner)
+    $sources = @()
+    foreach ($id in $ids) {
+        $detail = $null
+        try { $detail = Get-GraphPolicyDetail -Type 'settingscatalog' -Id ([string]$id) } catch {}
+        if (-not $detail) { return @{ __status = 400; error = "Policy $id konnte nicht geladen werden." } }
+        $sources += @{
+            id           = [string]$id
+            name         = [string](Get-PolicyProp $detail 'name')
+            platforms    = [string](Get-PolicyProp $detail 'platforms')
+            technologies = [string](Get-PolicyProp $detail 'technologies')
+            settings     = @(Get-PolicyProp $detail 'settings')
+        }
+    }
+
+    # Plattform muss uebereinstimmen - sonst kein sinnvoller Merge.
+    $platforms = @($sources | ForEach-Object { $_.platforms } | Where-Object { $_ } | Sort-Object -Unique)
+    if ($platforms.Count -gt 1) {
+        return @{ __status = 400; error = "Unterschiedliche Plattformen ($($platforms -join ', ')) - Zusammenfuehren nicht moeglich." }
+    }
+    $mergedPlatform = if ($platforms.Count -ge 1) { $platforms[0] } else { 'windows10' }
+    # Technologies vereinen (Union).
+    $techSet = [ordered]@{}
+    foreach ($s in $sources) { foreach ($t in ($s.technologies -split ',')) { $tt = $t.Trim(); if ($tt) { $techSet[$tt] = $true } } }
+    $mergedTech = (@($techSet.Keys) -join ','); if (-not $mergedTech) { $mergedTech = 'mdm' }
+
+    # Nach settingDefinitionId gruppieren (Reihenfolge der Definitionen beibehalten).
+    $groups = [ordered]@{}
+    foreach ($s in $sources) {
+        foreach ($el in @($s.settings)) {
+            if (-not $el) { continue }
+            $defId = Get-SettingDefinitionId $el
+            if (-not $defId) { continue }
+            if (-not $groups.Contains($defId)) { $groups[$defId] = @() }
+            $groups[$defId] += @{ sourceId = $s.id; sourceName = $s.name; element = $el; canon = (Get-SettingCanonicalJson $el) }
+        }
+    }
+
+    $mergedSettings = @()
+    $conflicts      = @()
+    foreach ($defId in @($groups.Keys)) {
+        $entries  = @($groups[$defId])
+        $distinct = @($entries | Group-Object -Property { $_.canon })
+        if ($distinct.Count -eq 1) {
+            $mergedSettings += $entries[0].element
+            continue
+        }
+        # Konflikt: Gewinner bestimmen (resolutions[defId] = sourceId, sonst erste Quelle).
+        $resSource = if ($resolutions) { [string](Get-PolicyProp $resolutions $defId) } else { '' }
+        $chosen = $null
+        if ($resSource) { $chosen = @($entries | Where-Object { $_.sourceId -eq $resSource })[0] }
+        if (-not $chosen) { $chosen = $entries[0] }
+        $mergedSettings += $chosen.element
+        $conflicts += @{
+            settingDefinitionId = $defId
+            chosenSourceId      = $chosen.sourceId
+            variants            = @($distinct | ForEach-Object {
+                @{
+                    sourceIds   = @($_.Group | ForEach-Object { $_.sourceId })
+                    sourceNames = @($_.Group | ForEach-Object { $_.sourceName } | Select-Object -Unique)
+                }
+            })
+        }
+    }
+
+    if ($mode -ne 'create') {
+        return @{
+            ok            = $true
+            mode          = 'preview'
+            platform      = $mergedPlatform
+            technologies  = $mergedTech
+            totalSettings = @($mergedSettings).Count
+            conflictCount = @($conflicts).Count
+            conflicts     = @($conflicts)
+            sources       = @($sources | ForEach-Object { @{ id = $_.id; name = $_.name; settingCount = @($_.settings).Count } })
+        }
+    }
+
+    # --- create ---
+    if ($script:State.ReadOnly) { return @{ __status = 403; error = 'Read-Only-Modus: Zusammenfuehren ist deaktiviert.' } }
+    $name = [string](Get-PolicyProp $Body 'name')
+    if ([string]::IsNullOrWhiteSpace($name)) { return @{ __status = 400; error = 'Name fuer die neue Policy fehlt.' } }
+    $desc = [string](Get-PolicyProp $Body 'description')
+
+    # settings fuer den POST vorbereiten: Wrapper mit @odata.type, read-only 'id' weg,
+    # Arrays reparieren (gleiche Behandlung wie beim Import).
+    $outSettings = @()
+    foreach ($el in $mergedSettings) {
+        $si = Get-PolicyProp $el 'settingInstance'
+        if (-not $si) { $si = $el }
+        $outSettings += [ordered]@{
+            '@odata.type'   = '#microsoft.graph.deviceManagementConfigurationSetting'
+            settingInstance = $si
+        }
+    }
+    $outSettings = @(Repair-SettingsCatalogArrays $outSettings)
+
+    $newBody = [ordered]@{
+        name              = $name
+        description       = $desc
+        platforms         = $mergedPlatform
+        technologies      = $mergedTech
+        templateReference = @{ templateFamily = 'none'; templateId = '' }
+        settings          = $outSettings
+    }
+    $json = $newBody | ConvertTo-Json -Depth 50
+    if ($json -match 'System\.Collections\.Hashtable|System\.Object\[\]') {
+        return @{ __status = 500; error = 'Interner Serialisierungsfehler beim Zusammenfuehren (stringifizierte Objekte).' }
+    }
+    try {
+        $created = Invoke-MgGraphRequestRetry -Uri 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies' -Method POST -Body $json -ContentType 'application/json'
+        return @{ ok = $true; mode = 'create'; newId = [string](Get-PolicyProp $created 'id'); name = $name; settingsCount = @($outSettings).Count; conflictCount = @($conflicts).Count }
+    } catch {
+        $msg = $_.Exception.Message
+        try { if ($_.ErrorDetails.Message) { $msg = $_.ErrorDetails.Message } } catch {}
+        return @{ __status = 500; error = $msg }
+    }
+}
+
 # ============================================================
 # Policy-Snapshot nach Git (voller Export, stabile Dateinamen)
 # ============================================================

www/app.js

@@ -3317,6 +3317,7 @@ function membersTabLink(id, name) {
   return `<a class="entra-link members-link" href="${url}" target="_blank" rel="noopener" title="Mitglieder von ${escapeHtml(name || 'Gruppe')} im Intune-Portal öffnen" onclick="event.stopPropagation()">${MEMBERS_ICON}</a>`;
 }
 
+
 function teamsChatLink(upn, name) {
   // Microsoft-Teams Deep-Link: oeffnet IMMER den installierten Desktop-Client
   // ueber den msteams:-Protocol-Handler. Web-Variante (https://) wird hier
@@ -4825,6 +4826,7 @@ const GexState = {
   activeTab: 'export',
   userSearchResults: [],
   selectedUsers: new Map(),
+  addMode: 'user',        // 'user' | 'group' — was im "Hinzufuegen"-Pane gesucht/addiert wird
 };
 
 function openGroupExportModal() {
@@ -4843,7 +4845,13 @@ function openGroupExportModal() {
   document.getElementById('gexMembersTitle').textContent = 'Mitglieder';
   document.getElementById('gexStats').textContent = '';
   document.getElementById('gexExportBtn').disabled = true;
-  // Add-Tab zurücksetzen
+  // Add-Tab zurücksetzen (Modus auf Benutzer)
+  GexState.addMode = 'user';
+  document.querySelectorAll('.gex-addmode-btn').forEach(b => b.classList.toggle('active', b.dataset.addmode === 'user'));
+  const gexAddTitle = document.getElementById('gexAddSearchTitle');
+  if (gexAddTitle) gexAddTitle.textContent = 'Benutzer suchen';
+  const gexUS = document.getElementById('gexUserSearch');
+  if (gexUS) gexUS.placeholder = 'Name, UPN oder E-Mail…';
   document.getElementById('gexUserSearch').value = '';
   document.getElementById('gexUserResults').innerHTML = '<div class="gex-hint">Mindestens 2 Zeichen eingeben.</div>';
   document.getElementById('gexSelectedUsers').innerHTML = '<div class="gex-hint">Noch keine Benutzer ausgewählt.</div>';
@@ -5221,14 +5229,49 @@ document.getElementById('gexUserSearch')?.addEventListener('input', e => {
 
 async function _gexDoUserSearch(q) {
   try {
-    const data = await api(`/api/users?q=${encodeURIComponent(q)}`);
-    GexState.userSearchResults = data.items || [];
+    if (GexState.addMode === 'group') {
+      // Gruppen suchen; die Zielgruppe selbst rausfiltern. UPN-Feld traegt zur
+      // Anzeige die Beschreibung bzw. "Gruppe" (nur fuers Rendering, Add nutzt Id).
+      const data = await api(`/api/groups/search?q=${encodeURIComponent(q)}`);
+      const targetId = GexState.selectedGroup ? GexState.selectedGroup.Id : null;
+      GexState.userSearchResults = (data.items || [])
+        .filter(g => g.Id !== targetId)
+        .map(g => ({ Id: g.Id, DisplayName: g.DisplayName, UserPrincipalName: g.Description || 'Gruppe', _isGroup: true }));
+    } else {
+      const data = await api(`/api/users?q=${encodeURIComponent(q)}`);
+      GexState.userSearchResults = data.items || [];
+    }
     _gexRenderUserResults();
   } catch (e) {
     document.getElementById('gexUserResults').innerHTML = `<div class="gex-error">Suche fehlgeschlagen: ${escapeHtml(e.message)}</div>`;
   }
 }
 
+// Umschalter Benutzer/Gruppen im "Hinzufuegen"-Pane.
+document.querySelectorAll('.gex-addmode-btn').forEach(btn => {
+  btn.addEventListener('click', () => {
+    const mode = btn.dataset.addmode;
+    if (GexState.addMode === mode) return;
+    GexState.addMode = mode;
+    document.querySelectorAll('.gex-addmode-btn').forEach(b => b.classList.toggle('active', b === btn));
+    // Auswahl + Suche zuruecksetzen
+    GexState.selectedUsers.clear();
+    GexState.userSearchResults = [];
+    _gexRenderSelectedUsers();
+    _gexUpdateAddBtn();
+    const search = document.getElementById('gexUserSearch');
+    if (search) search.value = '';
+    const isGroup = mode === 'group';
+    const title = document.getElementById('gexAddSearchTitle');
+    if (title) title.textContent = isGroup ? 'Gruppen suchen' : 'Benutzer suchen';
+    if (search) search.placeholder = isGroup ? 'Gruppenname…' : 'Name, UPN oder E-Mail…';
+    document.getElementById('gexUserResults').innerHTML = '<div class="gex-hint">Mindestens 2 Zeichen eingeben.</div>';
+    const selHint = document.getElementById('gexSelectedUsers');
+    if (selHint) selHint.innerHTML = `<div class="gex-hint">Noch keine ${isGroup ? 'Gruppen' : 'Benutzer'} ausgewählt.</div>`;
+    if (search) search.focus();
+  });
+});
+
 function _gexRenderUserResults() {
   const el = document.getElementById('gexUserResults');
   if (!el) return;
@@ -5309,10 +5352,11 @@ document.getElementById('gexAddBtn')?.addEventListener('click', async () => {
       method: 'POST',
       body: { userIds },
     });
+    const kindLbl = GexState.addMode === 'group' ? 'Gruppe(n)' : 'Benutzer';
     if (data.errors > 0) {
       toast(`${data.success} von ${data.total} hinzugefügt, ${data.errors} Fehler.`, 'warn');
     } else {
-      toast(`${data.success} Benutzer zu „${GexState.selectedGroup.DisplayName}" hinzugefügt.`, 'ok');
+      toast(`${data.success} ${kindLbl} zu „${GexState.selectedGroup.DisplayName}" hinzugefügt.`, 'ok');
       GexState.selectedUsers.clear();
       _gexRenderSelectedUsers();
       document.getElementById('gexUserSearch').value = '';
@@ -5725,12 +5769,15 @@ function notifyCsvImportGroupSelected(groupId, groupName) {
 // Geräte-Tab
 // ============================================================
 const DevState = {
-  items: [],
+  items: [],          // aktuell geladener Satz (bei Gruppe: alle Geraete der Gruppe)
   filtered: [],
   selected: null,
   sortCol: 'deviceName',
   sortAsc: true,
-  loaded: false
+  loaded: false,
+  groupId: null,      // aktiver Gruppen-Filter (null = alle Geraete)
+  groupName: '',
+  checked: new Set()  // per Checkbox ausgewaehlte Geraete-Ids (fuer Bulk-Offboarding)
 };
 
 async function devLoadAll() {
@@ -5743,38 +5790,98 @@ function devShowLoading(on) {
 }
 
 async function devFetch() {
-  const q   = document.getElementById('devSearch').value.trim();
-  const os  = document.getElementById('devOsFilter').value;
-  const cmp = document.getElementById('devComplianceFilter').value;
-
+  DevState.checked.clear();   // neue Datenladung -> Auswahl zuruecksetzen
   devShowLoading(true);
   try {
-    const params = new URLSearchParams();
-    if (q)   params.set('q', q);
-    if (os)  params.set('os', os);
-    if (cmp) params.set('compliance', cmp);
-    const data = await api('/api/devices?' + params.toString());
-    DevState.items    = data.items || [];
-    DevState.filtered = DevState.items;
-    devSort();
+    if (DevState.groupId) {
+      // Gruppen-Modus: alle Geraete der Gruppen-User holen, dann clientseitig filtern.
+      const data = await api(`/api/groups/${encodeURIComponent(DevState.groupId)}/devices/export`, { timeoutMs: 180000 });
+      DevState.items = data.items || [];
+      if (DevState.items.length === 0 && (data.errors || []).length) {
+        toast(`Graph-Fehler: ${data.errors[0]}`, 'err', 'Geräte');
+      }
+      devApplyClientFilters();   // sortiert + rendert
+    } else {
+      const q   = document.getElementById('devSearch').value.trim();
+      const os  = document.getElementById('devOsFilter').value;
+      const cmp = document.getElementById('devComplianceFilter').value;
+      const params = new URLSearchParams();
+      if (q)   params.set('q', q);
+      if (os)  params.set('os', os);
+      if (cmp) params.set('compliance', cmp);
+      const data = await api('/api/devices?' + params.toString());
+      DevState.items    = data.items || [];
+      DevState.filtered = DevState.items;
+      devSort();
+    }
   } catch (e) {
-    toast('Geräte konnten nicht geladen werden: ' + e, 'error');
+    toast('Geräte konnten nicht geladen werden: ' + (e.message || e), 'error');
   } finally {
     devShowLoading(false);
   }
 }
 
+// Ein Geraet gegen die aktuellen UI-Filter pruefen (fuer den Gruppen-Modus,
+// wo serverseitig nicht gefiltert wird).
+function devPassesFilters(d, q, os, cmp) {
+  if (os  && !(d.OS || '').toLowerCase().includes(os.toLowerCase())) return false;
+  if (cmp && (d.ComplianceState || '') !== cmp) return false;
+  if (q) {
+    const hay = `${d.DeviceName || ''} ${d.UserDisplayName || ''} ${d.UserPrincipalName || ''} ${d.SerialNumber || ''}`.toLowerCase();
+    if (!hay.includes(q)) return false;
+  }
+  return true;
+}
+
+function devApplyClientFilters() {
+  const q   = document.getElementById('devSearch').value.trim().toLowerCase();
+  const os  = document.getElementById('devOsFilter').value;
+  const cmp = document.getElementById('devComplianceFilter').value;
+  DevState.filtered = DevState.items.filter(d => devPassesFilters(d, q, os, cmp));
+  devSort();
+}
+
+// Filteraenderung: bei aktiver Gruppe nur clientseitig neu filtern (kein Re-Fetch),
+// sonst serverseitig neu laden.
 function devApplyFilters() {
-  devFetch();
+  if (DevState.groupId) devApplyClientFilters();
+  else devFetch();
+}
+
+// Header-data-col (Graph-Feldnamen) -> tatsaechliche Item-Property.
+const DEV_COL_MAP = {
+  deviceName:        'DeviceName',
+  userDisplayName:   'UserDisplayName',
+  operatingSystem:   'OS',
+  complianceState:   'ComplianceState',
+  lastSyncDateTime:  'LastSync',
+  enrolledDateTime:  'EnrolledDateTime',
+};
+const DEV_DATE_COLS = new Set(['LastSync', 'EnrolledDateTime']);
+
+function devFmtDate(iso) {
+  if (!iso) return '—';
+  const d = new Date(iso);
+  if (isNaN(d.getTime())) return '—';
+  return d.toLocaleDateString('de-DE') + ' ' +
+         d.toLocaleTimeString('de-DE', { hour: '2-digit', minute: '2-digit' });
 }
 
 function devSort() {
-  const col = DevState.sortCol;
-  const asc = DevState.sortAsc;
+  const col = DEV_COL_MAP[DevState.sortCol] || DevState.sortCol;
+  const asc = DevState.sortAsc ? 1 : -1;
+  const isDate = DEV_DATE_COLS.has(col);
   DevState.filtered.sort((a, b) => {
-    const av = (a[col] || '').toString().toLowerCase();
-    const bv = (b[col] || '').toString().toLowerCase();
-    return asc ? av.localeCompare(bv) : bv.localeCompare(av);
+    if (isDate) {
+      // Nach Zeitstempel sortieren; ungueltige/fehlende Daten ans Ende.
+      const at = Date.parse(a[col]); const bt = Date.parse(b[col]);
+      const av = isNaN(at) ? -Infinity : at;
+      const bv = isNaN(bt) ? -Infinity : bt;
+      return (av - bv) * asc;
+    }
+    const sa = (a[col] ?? '').toString().toLowerCase();
+    const sb = (b[col] ?? '').toString().toLowerCase();
+    return sa.localeCompare(sb, 'de', { numeric: true }) * asc;
   });
   devRender();
 }
@@ -5783,6 +5890,8 @@ function devRender() {
   const tbody = document.getElementById('devTableBody');
   const empty = document.getElementById('devEmpty');
   document.getElementById('devCount').textContent = DevState.filtered.length;
+  const expBtn = document.getElementById('btnDevExport');
+  if (expBtn) expBtn.disabled = DevState.filtered.length === 0;
 
   if (DevState.filtered.length === 0) {
     tbody.innerHTML = '';
@@ -5803,11 +5912,13 @@ function devRender() {
 
   let html = '';
   for (const d of DevState.filtered) {
-    const sync  = d.LastSync ? new Date(d.LastSync).toLocaleDateString('de-DE') : '—';
+    const sync  = devFmtDate(d.LastSync);
     const cmpCls = d.ComplianceState === 'compliant' ? 'dev-badge-ok'
                  : d.ComplianceState === 'noncompliant' ? 'dev-badge-err' : 'dev-badge-unk';
     const sel = DevState.selected && DevState.selected.Id === d.Id ? ' class="dev-row-selected"' : '';
+    const chk = DevState.checked.has(d.Id) ? 'checked' : '';
     html += `<tr data-id="${escapeHtml(d.Id)}"${sel}>
+      <td class="dev-col-check"><input type="checkbox" class="dev-row-check" data-id="${escapeHtml(d.Id)}" ${chk}></td>
       <td>${escapeHtml(d.DeviceName || '—')}</td>
       <td>${escapeHtml(d.UserDisplayName || '—')}</td>
       <td>${escapeHtml(d.OS || '—')}</td>
@@ -5817,13 +5928,41 @@ function devRender() {
   }
   tbody.innerHTML = html;
 
+  tbody.querySelectorAll('.dev-row-check').forEach(cb => {
+    cb.addEventListener('click', e => e.stopPropagation());
+    cb.addEventListener('change', () => {
+      if (cb.checked) DevState.checked.add(cb.dataset.id);
+      else DevState.checked.delete(cb.dataset.id);
+      devUpdateCheckSel();
+    });
+  });
   tbody.querySelectorAll('tr').forEach(tr => {
-    tr.addEventListener('click', () => {
+    tr.addEventListener('click', e => {
+      if (e.target.classList.contains('dev-row-check')) return;
       const id = tr.dataset.id;
       const device = DevState.filtered.find(d => d.Id === id);
       if (device) devSelectDevice(device);
     });
   });
+  devUpdateCheckSel();
+}
+
+// Checkbox-Auswahl -> Offboard-Button + Zähler + Header-Checkbox synchronisieren.
+function devUpdateCheckSel() {
+  // Nur sichtbare (gefilterte) Geraete zaehlen.
+  const visibleIds = DevState.filtered.map(d => d.Id);
+  const n = visibleIds.filter(id => DevState.checked.has(id)).length;
+  const btn = document.getElementById('btnDevOffboard');
+  if (btn) {
+    btn.disabled = n === 0;
+    const c = document.getElementById('devOffboardCount');
+    if (c) c.textContent = n;
+  }
+  const all = document.getElementById('devCheckAll');
+  if (all) {
+    all.checked = n > 0 && n === visibleIds.length;
+    all.indeterminate = n > 0 && n < visibleIds.length;
+  }
 }
 
 async function devSelectDevice(device) {
@@ -5851,8 +5990,8 @@ function devRenderDetail(d) {
   document.getElementById('devDetailName').textContent = d.DeviceName || '—';
   document.getElementById('devDetailSub').textContent  = `${d.Manufacturer || ''} ${d.Model || ''}`.trim() || '—';
 
-  const sync     = d.LastSync         ? new Date(d.LastSync).toLocaleString('de-DE')         : '—';
-  const enrolled = d.EnrolledDateTime ? new Date(d.EnrolledDateTime).toLocaleDateString('de-DE') : '—';
+  const sync     = devFmtDate(d.LastSync);
+  const enrolled = devFmtDate(d.EnrolledDateTime);
   const storage  = (d.TotalStorageGB != null)
     ? `${d.FreeStorageGB} GB frei / ${d.TotalStorageGB} GB gesamt` : null;
 
@@ -5987,10 +6126,132 @@ document.getElementById('devActions')?.addEventListener('click', async (e) => {
 let devSearchDebounce = null;
 document.getElementById('devSearch').addEventListener('input', () => {
   clearTimeout(devSearchDebounce);
-  devSearchDebounce = setTimeout(devFetch, 400);
+  devSearchDebounce = setTimeout(devApplyFilters, 400);
 });
-document.getElementById('devOsFilter').addEventListener('change', devFetch);
-document.getElementById('devComplianceFilter').addEventListener('change', devFetch);
+document.getElementById('devOsFilter').addEventListener('change', devApplyFilters);
+document.getElementById('devComplianceFilter').addEventListener('change', devApplyFilters);
+
+// Gruppen-Filter (Live-Suche) + CSV-Export
+let _devGroupTimer = null, _devGroupAbort = null;
+
+document.getElementById('devGroupSearch')?.addEventListener('input', e => {
+  clearTimeout(_devGroupTimer);
+  const term = e.target.value.trim();
+  const results = document.getElementById('devGroupResults');
+  // Text geaendert -> aktiven Gruppen-Filter loesen (bis eine Gruppe gewaehlt wird)
+  if (DevState.groupId) {
+    DevState.groupId = null; DevState.groupName = '';
+    document.getElementById('devGroupClear').hidden = true;
+    devFetch();
+  }
+  if (term.length < 2) { if (results) { results.classList.add('hidden'); results.innerHTML = ''; } return; }
+  _devGroupTimer = setTimeout(() => devGroupSearch(term), 250);
+});
+
+async function devGroupSearch(term) {
+  const results = document.getElementById('devGroupResults');
+  if (!results) return;
+  if (_devGroupAbort) { try { _devGroupAbort.abort(); } catch {} }
+  _devGroupAbort = new AbortController();
+  results.classList.remove('hidden');
+  results.innerHTML = '<div class="cg-existing-empty">Suche…</div>';
+  try {
+    const resp = await fetch('/api/groups/search?q=' + encodeURIComponent(term), { signal: _devGroupAbort.signal });
+    let data = {}; try { data = await resp.json(); } catch {}
+    if (_devGroupAbort.signal.aborted) return;
+    if (!resp.ok) throw new Error(data.error || `HTTP ${resp.status}`);
+    const gs = data.items || [];
+    if (gs.length === 0) { results.innerHTML = '<div class="cg-existing-empty">Keine Treffer</div>'; return; }
+    results.innerHTML = gs.map(g =>
+      `<button type="button" class="cg-existing-item" data-gid="${escapeHtml(g.Id)}" data-gname="${escapeHtml(g.DisplayName)}">
+        <span class="cg-existing-name">${escapeHtml(g.DisplayName)}</span>
+        ${g.Description ? `<span class="cg-existing-desc">${escapeHtml(g.Description)}</span>` : ''}
+      </button>`).join('');
+  } catch (e) {
+    if (e.name === 'AbortError') return;
+    results.innerHTML = `<div class="cg-existing-empty">Fehler: ${escapeHtml(e.message)}</div>`;
+  }
+}
+
+document.getElementById('devGroupResults')?.addEventListener('click', e => {
+  const btn = e.target.closest('.cg-existing-item');
+  if (!btn) return;
+  DevState.groupId   = btn.dataset.gid;
+  DevState.groupName = btn.dataset.gname;
+  document.getElementById('devGroupSearch').value = btn.dataset.gname;
+  document.getElementById('devGroupClear').hidden = false;
+  document.getElementById('devGroupResults').classList.add('hidden');
+  devFetch();
+});
+
+document.getElementById('devGroupClear')?.addEventListener('click', () => {
+  DevState.groupId = null; DevState.groupName = '';
+  document.getElementById('devGroupSearch').value = '';
+  document.getElementById('devGroupClear').hidden = true;
+  document.getElementById('devGroupResults').classList.add('hidden');
+  devFetch();
+});
+
+// Klick ausserhalb schliesst die Ergebnisliste
+document.addEventListener('click', e => {
+  const wrap = document.getElementById('devGroupWrap');
+  if (wrap && !wrap.contains(e.target)) {
+    document.getElementById('devGroupResults')?.classList.add('hidden');
+  }
+});
+
+function devExportCsv() {
+  const items = DevState.filtered || [];
+  if (items.length === 0) { toast('Keine Geräte zum Exportieren.', 'warn'); return; }
+  const header = ['DeviceName','UserDisplayName','UserPrincipalName','OS','OSVersion','ComplianceState','SerialNumber','Model','Manufacturer','LastSync','EnrolledDateTime'];
+  const rows = [header];
+  for (const d of items) {
+    rows.push([
+      d.DeviceName || '', d.UserDisplayName || '', d.UserPrincipalName || '',
+      d.OS || '', d.OSVersion || '', d.ComplianceState || '',
+      d.SerialNumber || '', d.Model || '', d.Manufacturer || '',
+      d.LastSync ? devFmtDate(d.LastSync) : '', d.EnrolledDateTime ? devFmtDate(d.EnrolledDateTime) : '',
+    ]);
+  }
+  const csv  = rows.map(r => r.map(v => `"${String(v).replace(/"/g, '""')}"`).join(',')).join('\r\n');
+  const blob = new Blob(['' + csv], { type: 'text/csv;charset=utf-8;' });
+  const url  = URL.createObjectURL(blob);
+  const scope = DevState.groupName ? DevState.groupName.replace(/[^a-zA-Z0-9_-]/g, '_') : 'alle';
+  const a = Object.assign(document.createElement('a'), { href: url, download: `devices-${scope}-${new Date().toISOString().slice(0,10)}.csv` });
+  a.click();
+  URL.revokeObjectURL(url);
+  toast(`${items.length} Geräte exportiert${DevState.groupName ? ` (Gruppe „${DevState.groupName}")` : ''}.`, 'ok');
+}
+
+document.getElementById('btnDevExport')?.addEventListener('click', devExportCsv);
+
+// Alle sichtbaren Geraete an-/abwaehlen
+document.getElementById('devCheckAll')?.addEventListener('change', e => {
+  const on = e.target.checked;
+  DevState.filtered.forEach(d => { if (on) DevState.checked.add(d.Id); else DevState.checked.delete(d.Id); });
+  // Checkboxen in der Tabelle spiegeln, ohne komplett neu zu rendern
+  document.querySelectorAll('#devTableBody .dev-row-check').forEach(cb => { cb.checked = on; });
+  devUpdateCheckSel();
+});
+
+// Ausgewaehlte Geraete offboarden -> IDs aufloesen (Entra/Autopilot) und Dialog oeffnen
+async function devOffboardSelected() {
+  const ids = DevState.filtered.filter(d => DevState.checked.has(d.Id)).map(d => d.Id);
+  if (ids.length === 0) { toast('Keine Geräte ausgewählt.', 'warn'); return; }
+  setLoading(`Löse ${ids.length} Gerät(e) für Offboarding auf…`);
+  try {
+    const res = await api('/api/offboard/resolve', { method: 'POST', body: { ids }, timeoutMs: 120000 });
+    const items = res.items || [];
+    if (items.length === 0) { toast('Geräte konnten nicht aufgelöst werden.', 'err'); return; }
+    // Offboard-Dialog mit genau diesen Geräten öffnen (unabhängig vom Offboard-Tab).
+    openOffboardModal(items);
+  } catch (e) {
+    toast('Offboarding-Auflösung fehlgeschlagen: ' + e.message, 'err');
+  } finally {
+    clearLoading();
+  }
+}
+document.getElementById('btnDevOffboard')?.addEventListener('click', devOffboardSelected);
 
 // Sortierung
 document.querySelectorAll('#devTable th.sortable').forEach(th => {
@@ -6112,9 +6373,19 @@ function renderPolicies() {
 }
 
 function polUpdateSelCount() {
-  const n = PolState.selected.size;
+  const keys = [...PolState.selected];
+  const n = keys.length;
   document.getElementById('polSelCount').textContent = n;
   document.getElementById('btnPolExport').disabled = n === 0;
+  // Konsolidieren nur bei >=2 Policies UND alle vom Typ Settings Catalog.
+  const btnC = document.getElementById('btnPolConsolidate');
+  if (btnC) {
+    const allSc = n >= 2 && keys.every(k => k.startsWith('settingscatalog::'));
+    btnC.disabled = !allSc;
+    btnC.title = allSc
+      ? 'Ausgewählte Settings-Catalog-Policies zu einer neuen Policy zusammenführen'
+      : 'Mindestens zwei Policies vom Typ „Settings Catalog" auswählen';
+  }
 }
 
 function polSyncCheckAll() {
@@ -6173,6 +6444,109 @@ async function polExportSelected() {
   }
 }
 
+// =============================================================
+// Policies konsolidieren (Settings Catalog -> eine neue Policy)
+// =============================================================
+let _polConsSelIds = [];         // ausgewaehlte settingscatalog-Ids (Reihenfolge = Default-Gewinner)
+let _polConsPreview = null;      // Preview-Response
+const _polConsResolutions = {};  // settingDefinitionId -> gewaehlte sourceId
+
+async function openPolConsolidate() {
+  const keys = [...PolState.selected].filter(k => k.startsWith('settingscatalog::'));
+  if (keys.length < 2) { toast('Mindestens zwei Settings-Catalog-Policies auswählen.', 'warn'); return; }
+  _polConsSelIds = keys.map(k => k.slice('settingscatalog::'.length));
+  _polConsPreview = null;
+  Object.keys(_polConsResolutions).forEach(k => delete _polConsResolutions[k]);
+
+  document.getElementById('polConsSummary').innerHTML = '<span class="spinner" style="width:14px;height:14px;border-width:2px;"></span> Analysiere…';
+  document.getElementById('polConsConflicts').innerHTML = '';
+  document.getElementById('polConsName').value = '';
+  document.getElementById('polConsDesc').value = '';
+  document.getElementById('polConsConfirm').disabled = true;
+  document.getElementById('polConsInfo').textContent = '';
+  openModal('modalPolConsolidate');
+
+  try {
+    const res = await api('/api/policies/consolidate', { method: 'POST', body: { ids: _polConsSelIds, mode: 'preview' }, timeoutMs: 120000 });
+    _polConsPreview = res;
+    renderPolConsPreview(res);
+  } catch (e) {
+    document.getElementById('polConsSummary').innerHTML = `<span class="pol-cons-err">Analyse fehlgeschlagen: ${escapeHtml(e.message)}</span>`;
+  }
+}
+
+function polConsSourceName(id) {
+  const s = ((_polConsPreview && _polConsPreview.sources) || []).find(x => x.id === id);
+  return s ? s.name : id;
+}
+
+function renderPolConsPreview(res) {
+  const sources = res.sources || [];
+  document.getElementById('polConsSummary').innerHTML = `
+    <div><b>${sources.length}</b> Policies · Plattform <b>${escapeHtml(res.platform || '—')}</b></div>
+    <div><b>${res.totalSettings}</b> Einstellungen gesamt · <b class="${res.conflictCount ? 'pol-cons-warn' : ''}">${res.conflictCount}</b> Konflikt(e)</div>
+    <ul class="pol-cons-src">${sources.map(s => `<li>${escapeHtml(s.name)} <span class="muted">(${s.settingCount})</span></li>`).join('')}</ul>`;
+
+  const cWrap = document.getElementById('polConsConflicts');
+  const conflicts = res.conflicts || [];
+  if (conflicts.length === 0) {
+    cWrap.innerHTML = '<div class="form-hint ok">Keine Konflikte — alle gemeinsamen Einstellungen sind identisch.</div>';
+  } else {
+    cWrap.innerHTML = `<div class="pol-cons-conf-head">Konflikte — welcher Wert soll gewinnen?</div>` +
+      conflicts.map((c, ci) => {
+        _polConsResolutions[c.settingDefinitionId] = c.chosenSourceId;   // Default merken
+        const opts = (c.variants || []).map(v => {
+          const sid = (v.sourceIds || [])[0];
+          const label = (v.sourceNames || []).join(', ') || polConsSourceName(sid);
+          const checked = sid === c.chosenSourceId ? 'checked' : '';
+          return `<label class="pol-cons-opt">
+            <input type="radio" name="polcons-${ci}" data-def="${escapeHtml(c.settingDefinitionId)}" data-src="${escapeHtml(sid)}" ${checked}>
+            <span>${escapeHtml(label)}</span>
+          </label>`;
+        }).join('');
+        return `<div class="pol-cons-conf">
+          <div class="pol-cons-def" title="${escapeHtml(c.settingDefinitionId)}">${escapeHtml(c.settingDefinitionId)}</div>
+          <div class="pol-cons-opts">${opts}</div>
+        </div>`;
+      }).join('');
+    cWrap.querySelectorAll('input[type="radio"][data-def]').forEach(r => {
+      r.addEventListener('change', () => { _polConsResolutions[r.dataset.def] = r.dataset.src; });
+    });
+  }
+
+  document.getElementById('polConsName').value = `Konsolidiert – ${sources.length ? sources[0].name : 'Policy'}`;
+  document.getElementById('polConsInfo').textContent = `${res.totalSettings} Einstellungen → 1 Policy`;
+  document.getElementById('polConsConfirm').disabled = false;
+}
+
+async function polDoConsolidate() {
+  if (!_polConsPreview) return;
+  const name = document.getElementById('polConsName').value.trim();
+  if (!name) { toast('Bitte einen Namen angeben.', 'warn'); return; }
+  const desc = document.getElementById('polConsDesc').value.trim();
+  const btn = document.getElementById('polConsConfirm');
+  btn.disabled = true;
+  setLoading('Führe Policies zusammen…');
+  try {
+    const res = await api('/api/policies/consolidate', {
+      method: 'POST',
+      body: { ids: _polConsSelIds, mode: 'create', name, description: desc, resolutions: _polConsResolutions },
+      timeoutMs: 180000,
+    });
+    toast(`Neue Policy „${res.name}" erstellt (${res.settingsCount} Einstellungen, ${res.conflictCount} Konflikt(e) aufgelöst).`, 'ok', 'Konsolidiert');
+    closeModal('modalPolConsolidate');
+    await loadPolicies();
+  } catch (e) {
+    toast('Zusammenführen fehlgeschlagen: ' + e.message, 'err');
+    btn.disabled = false;
+  } finally {
+    clearLoading();
+  }
+}
+
+document.getElementById('btnPolConsolidate')?.addEventListener('click', openPolConsolidate);
+document.getElementById('polConsConfirm')?.addEventListener('click', polDoConsolidate);
+
 // Datei-Inhalt -> Liste von Envelopes { exportType, policy, ... }
 function polExtractEnvelopes(parsed, fileName) {
   if (parsed && Array.isArray(parsed.policies)) return parsed.policies;
@@ -6502,7 +6876,7 @@ document.querySelectorAll('#polTable th.sortable').forEach(th => {
 // =============================================================
 // OFFBOARDING: Geräte aus Intune / Autopilot / Entra entfernen
 // =============================================================
-const OffState = { items: [], selected: new Set() };
+const OffState = { items: [], selected: new Set(), pending: [] };
 function offKey(d) { return d.intuneDeviceId; }
 function offSelectedDevices() { return OffState.items.filter(d => OffState.selected.has(offKey(d))); }
 
@@ -6575,12 +6949,13 @@ function offUpdateSel() {
   document.getElementById('offBtn').disabled = n === 0;
 }
 
-function openOffboardModal() {
-  const devs = offSelectedDevices();
+function openOffboardModal(devsArg) {
+  const devs = Array.isArray(devsArg) ? devsArg : offSelectedDevices();
   if (!devs.length) return;
+  OffState.pending = devs;
   document.getElementById('offConfirmList').innerHTML = devs.map(d => `
     <div class="off-confirm-row"><b>${escapeHtml(d.deviceName || '—')}</b>
-      — Intune: ${d.intuneDeviceId ? '✓' : '–'}, Entra: ${d.entraObjectId ? '✓' : '–'}, Autopilot: ${d.autopilotId ? '✓' : '–'}</div>
+      — Intune: ${d.intuneDeviceId ? '✓' : '–'}, Entra: ${d.entraObjectId ? '✓' : '–'}, Autopilot: ${d.autopilotId ? '✓' : '–'}${(!d.autopilotId && d.autopilotNote) ? ` <span class="off-note" style="color:var(--warning,#e0a030);">(${escapeHtml(d.autopilotNote)})</span>` : ''}</div>
   `).join('');
   document.getElementById('offModalInfo').textContent = `${devs.length} Gerät(e)`;
   document.getElementById('offConfirmChk').checked = false;
@@ -6617,7 +6992,7 @@ async function offLoadKeys(devs) {
 }
 
 async function offExecute() {
-  const devs = offSelectedDevices();
+  const devs = (OffState.pending && OffState.pending.length) ? OffState.pending : offSelectedDevices();
   if (!devs.length) return;
   const services = {
     entra:     document.querySelector('input[name="offEntra"]:checked').value,

www/index.html

@@ -297,7 +297,7 @@
     <!-- Tab-Leiste -->
     <div class="gex-tab-bar group-mgmt-tabs">
       <button class="gex-tab active" data-tab="export">Mitglieder &amp; Export</button>
-      <button class="gex-tab gex-add-pane" data-tab="add">Benutzer hinzufügen</button>
+      <button class="gex-tab gex-add-pane" data-tab="add">Benutzer | Gruppen hinzufügen</button>
       <button class="gex-tab gex-add-pane" data-tab="import">CSV-Import</button>
       <button class="gex-tab" data-tab="user">Benutzer</button>
     </div>
@@ -386,7 +386,11 @@
 
       <!-- Rechte Spalte: Benutzer hinzufügen -->
       <div class="gex-right hidden" id="gexPaneAdd">
-        <div class="gex-section-title">Benutzer suchen</div>
+        <div class="gex-addmode">
+          <button type="button" class="gex-addmode-btn active" data-addmode="user">Benutzer</button>
+          <button type="button" class="gex-addmode-btn" data-addmode="group">Gruppen</button>
+        </div>
+        <div class="gex-section-title" id="gexAddSearchTitle">Benutzer suchen</div>
         <div class="search-wrap" style="margin-bottom:10px;">
           <svg class="search-ico" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="11" cy="11" r="7"/><path d="M21 21l-4.3-4.3"/></svg>
           <input type="search" id="gexUserSearch" class="input input-search" placeholder="Name, UPN oder E-Mail…" autocomplete="off">
@@ -492,6 +496,21 @@
       <option value="noncompliant">Non-Compliant</option>
       <option value="unknown">Unbekannt</option>
     </select>
+    <div id="devGroupWrap" style="position:relative;">
+      <input type="search" id="devGroupSearch" placeholder="Nach Gruppe filtern…" autocomplete="off"
+        style="height:34px;padding:0 24px 0 10px;border:1px solid var(--hairline);border-radius:6px;background:var(--canvas);color:var(--ink);font-size:12.5px;width:200px;box-sizing:border-box;">
+      <button id="devGroupClear" type="button" title="Gruppen-Filter entfernen" hidden
+        style="position:absolute;right:6px;top:50%;transform:translateY(-50%);background:none;border:none;color:var(--muted);cursor:pointer;font-size:16px;line-height:1;padding:0;">×</button>
+      <div id="devGroupResults" class="dev-group-results hidden"></div>
+    </div>
+    <button id="btnDevExport" class="btn btn-secondary btn-sm" disabled title="Angezeigte Geräte als CSV exportieren">
+      <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg>
+      CSV
+    </button>
+    <button id="btnDevOffboard" class="btn btn-danger btn-sm dev-offboard-btn" disabled title="Ausgewählte Geräte offboarden (Intune / Autopilot / Entra)">
+      <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4"/><polyline points="16 17 21 12 16 7"/><line x1="21" y1="12" x2="9" y2="12"/></svg>
+      Offboarden (<span id="devOffboardCount">0</span>)
+    </button>
   </div>
 
   <div class="dev-layout">
@@ -500,6 +519,7 @@
       <table class="dev-table" id="devTable">
         <thead>
           <tr>
+            <th class="dev-col-check"><input type="checkbox" id="devCheckAll" title="Alle sichtbaren auswählen"></th>
             <th class="sortable" data-col="deviceName">Gerät <span class="sort-ico"></span></th>
             <th class="sortable" data-col="userDisplayName">Benutzer <span class="sort-ico"></span></th>
             <th class="sortable" data-col="operatingSystem">OS <span class="sort-ico"></span></th>
@@ -594,6 +614,10 @@
       <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="3"/><line x1="12" y1="3" x2="12" y2="9"/><line x1="12" y1="15" x2="12" y2="21"/><circle cx="12" cy="3" r="1"/><circle cx="12" cy="21" r="1"/></svg>
       Git-Snapshot
     </button>
+    <button class="btn btn-secondary btn-sm pol-write" id="btnPolConsolidate" disabled title="Ausgewählte Settings-Catalog-Policies zu einer neuen Policy zusammenführen">
+      <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M7 3v6a3 3 0 0 0 3 3h4a3 3 0 0 1 3 3v6"/><polyline points="3 7 7 3 11 7"/><polyline points="13 17 17 21 21 17"/></svg>
+      Konsolidieren
+    </button>
     <button class="btn btn-primary btn-sm" id="btnPolExport" disabled title="Ausgewählte Policies als JSON exportieren">
       <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg>
       Export (<span id="polSelCount">0</span>)
@@ -900,6 +924,38 @@
   </div>
 </div>
 
+<!-- MODAL: Policies konsolidieren (Settings Catalog) -->
+<div id="modalPolConsolidate" class="modal hidden">
+  <div class="modal-backdrop" data-close></div>
+  <div class="modal-box modal-lg">
+    <div class="modal-head">
+      <h3>Policies zusammenführen</h3>
+      <button class="modal-close" data-close aria-label="Schließen">×</button>
+    </div>
+    <div class="modal-body">
+      <div class="form-hint" style="margin-bottom:12px;">
+        Die Einstellungen der ausgewählten <b>Settings-Catalog</b>-Policies werden zu
+        <b>einer neuen</b> Policy vereint (Neuanlage — die Originale bleiben unverändert).
+      </div>
+      <div id="polConsSummary" class="pol-cons-summary"></div>
+      <div id="polConsConflicts"></div>
+      <div class="form-group" style="margin-top:12px;">
+        <label class="lbl" for="polConsName">Name der neuen Policy</label>
+        <input type="text" id="polConsName" class="input" placeholder="z. B. Konsolidiert – Defender macOS">
+      </div>
+      <div class="form-group">
+        <label class="lbl" for="polConsDesc">Beschreibung (optional)</label>
+        <input type="text" id="polConsDesc" class="input">
+      </div>
+    </div>
+    <div class="modal-foot">
+      <span id="polConsInfo" class="muted" style="margin-right:auto;"></span>
+      <button class="btn btn-secondary" data-close>Abbrechen</button>
+      <button class="btn btn-primary" id="polConsConfirm" disabled>Zusammenführen</button>
+    </div>
+  </div>
+</div>
+
 <!-- MODAL: Policy-Zuweisung nach Import -->
 <div id="modalPolAssign" class="modal hidden">
   <div class="modal-backdrop" data-close></div>

www/styles.css

@@ -1129,6 +1129,21 @@ a.target-link:hover {
 }
 .target-row:hover .entra-link,
 .ex-member-row:hover .entra-link { opacity: 1; }
+
+/* Gruppen-Filter-Dropdown im Geraete-Tab (nutzt .cg-existing-item fuer die Zeilen) */
+.dev-group-results {
+  position: absolute;
+  z-index: 40;
+  top: 38px;
+  left: 0;
+  min-width: 220px;
+  max-height: 260px;
+  overflow-y: auto;
+  background: var(--canvas);
+  border: 1px solid var(--hairline);
+  border-radius: 6px;
+  box-shadow: 0 8px 24px rgba(0,0,0,0.28);
+}
 .entra-link:hover {
   background: var(--surface-soft);
   color: var(--brand-accent);
@@ -1327,6 +1342,7 @@ html[data-theme="dark"] .entra-link.teams-link:hover {
   border-radius: var(--r-md);
 }
 
+
 .member-row {
   display: flex;
   align-items: center;
@@ -4615,6 +4631,25 @@ html[data-theme="dark"] .numInputWrapper span.arrowDown {
   flex-shrink: 0;
 }
 
+/* Umschalter Benutzer/Gruppen im "Hinzufuegen"-Pane */
+.gex-addmode { display: flex; gap: 6px; margin-bottom: 12px; }
+.gex-addmode-btn {
+  flex: 1;
+  padding: 6px 10px;
+  border: 1px solid var(--hairline);
+  border-radius: var(--r-sm, 6px);
+  background: var(--canvas);
+  color: var(--muted);
+  font-size: 12.5px;
+  font-weight: 600;
+  cursor: pointer;
+}
+.gex-addmode-btn.active {
+  background: var(--accent-soft);
+  color: var(--brand-accent);
+  border-color: var(--brand-accent);
+}
+
 .gex-tab {
   padding: 10px 18px;
   font-size: 13px;
@@ -4934,6 +4969,7 @@ body.read-only .gex-add-pane,
 body.read-only .gex-tab[data-tab="add"],
 body.read-only .gex-tab[data-tab="import"],
 body.read-only #gexPaneImport,
+body.read-only .dev-offboard-btn,
 body.read-only .pol-write {
   display: none !important;
 }
@@ -5338,6 +5374,8 @@ body.read-only .app-row {
 }
 .dev-table thead th.sortable { cursor: pointer; }
 .dev-table thead th.sortable:hover { color: var(--text); }
+.dev-col-check { width: 34px; text-align: center; padding-left: 6px; padding-right: 6px; }
+.dev-col-check input { cursor: pointer; }
 .dev-table tbody tr {
   cursor: pointer;
   border-bottom: 1px solid var(--hairline-soft);
@@ -5428,6 +5466,31 @@ body.read-only .app-row {
   border: 1px solid var(--border);
   border-radius: 6px;
 }
+
+/* Policies konsolidieren — Modal */
+.pol-cons-summary { font-size: 13px; line-height: 1.6; }
+.pol-cons-summary .pol-cons-warn { color: var(--pink, #e0567a); }
+.pol-cons-err { color: var(--pink, #e0567a); font-size: 13px; }
+.pol-cons-src { margin: 6px 0 0; padding-left: 18px; font-size: 12px; }
+.pol-cons-src li { margin: 1px 0; }
+.pol-cons-conf-head { margin: 14px 0 6px; font-weight: 600; font-size: 13px; }
+.pol-cons-conf {
+  border: 1px solid var(--hairline-soft, var(--border));
+  border-radius: var(--r-xs, 6px);
+  padding: 8px 10px;
+  margin-bottom: 6px;
+}
+.pol-cons-def {
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  font-size: 11px;
+  color: var(--muted);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  margin-bottom: 6px;
+}
+.pol-cons-opts { display: flex; flex-wrap: wrap; gap: 6px 16px; }
+.pol-cons-opt { display: inline-flex; align-items: center; gap: 6px; font-size: 12px; cursor: pointer; }
 .pol-table { width: 100%; border-collapse: collapse; font-size: 13px; }
 .pol-table thead { position: sticky; top: 0; z-index: 2; background: var(--bg2); }
 .pol-table th {