v0.1.35 — Settings-Catalog-Import-Fix und Update-Check hinter Proxy

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Settings-Catalog-Import: choiceSettingCollectionValue als Array erzwingen
2026-09-15 17:50:27 +02:00 · 2026-09-15 17:49:30 +02:00 · 2026-09-14 10:59:02 +02:00 · 2026-09-14 09:49:43 +02:00 · 2026-09-14 07:49:14 +02:00 · 2026-09-13 15:59:30 +02:00
11 changed files with 637 additions and 36 deletions
@@ -5,6 +5,55 @@ Versionierung folgt [Semantic Versioning](https://semver.org/lang/de/) — solan

 ---

+## [0.1.35] - 2026-09-15
+
+Settings-Catalog-Import-Fix und Update-Check hinter Proxy.
+
+### Behoben
+
+- **Settings-Catalog-Import** (400 „Property choiceSettingCollectionValue … does not match schema"): `choiceSettingCollectionValue` fehlte in der Array-Normalisierung. Beim JSON-Roundtrip unter PowerShell 5.1 wurde ein Ein-Element-`choiceSettingCollectionValue` zum Einzelobjekt entpackt und von Graph abgelehnt (z. B. „Default Defender Antivirus Policy"). Wird jetzt wie `group-`/`simpleSettingCollectionValue` behandelt.
+- **Update-Check hinter authentifiziertem Proxy** (HTTP 407): Der Versions-Check schlug hinter Unternehmens-Proxys (NTLM/Kerberos) still fehl, weil `Invoke-RestMethod` keine Anmeldeinformationen an den Proxy sendete. Die angemeldeten Windows-Credentials werden jetzt an den System-Proxy durchgereicht; optionaler expliziter Proxy über `settings.json → update.proxy`.
+
+---
+
+## [0.1.34] - 2026-09-14
+
+Verwaltungsart in der Geräteliste, Autopilot-Zeitstempel im Detail.
+
+### Neu
+
+- **Spalte „Verwaltung"** in der Geräteliste: zeigt je Gerät, ob es **Intune** (reines MDM) oder **Co-Managed** (ConfigMgr + Intune) ist — abgeleitet aus `managementAgent`. Farbige Badges, sortierbar, auch im CSV-Export und im Detail-Panel.
+- **Autopilot-Infos im Geräte-Detail**: Beim Auswählen eines Windows-Geräts wird die Autopilot-Identity per Seriennummer nachgeladen und zeigt **Registrierungsstatus**, **Profil zugewiesen am** (`deploymentProfileAssignedDateTime`) und **letzter Autopilot-Kontakt** (`lastContactedDateTime`). Hinweis: Ein exaktes Autopilot-Importdatum liefert Microsoft Graph nicht; angezeigt werden die verfügbaren Zeitstempel. Kein Performance-Einfluss auf die Liste (Lookup nur pro ausgewähltem Gerät), keine neue Berechtigung nötig.
+
+---
+
+## [0.1.33] - 2026-09-13
+
+Offboarding-Report und Update-Hinweis.
+
+### Neu
+
+- **Offboarding-Report**: Nach dem Ausführen erzeugt das Offboarding einen **HTML-Report** (`/reports/offboard-report-<zeit>.html`) im Stil des Zuweisungs-Reports — mit KPIs (Geräte / Aktionen / Erfolg / Fehler) und **pro Gerät** einer Tabelle der ausgeführten Löschungen (Dienst · Aktion · Status · Meldung). Das Ergebnis im Dialog ist jetzt ebenfalls **pro Gerät gruppiert**, plus ein Button „HTML-Report öffnen".
+- **Update-Hinweis**: Beim Start prüft die App (nicht-blockierend) die neueste Release-Version über **Gitea** und zeigt bei einer neueren Version ein **Badge in der Kopfzeile** mit Link zur Release-Seite (dort MSI herunterladen → In-Place-Upgrade). Nur Lesezugriff; optionaler read-only Token via `settings.json → update.token`, falls das Repo privat ist. Neuer Endpoint `GET /api/update/check`.
+
+---
+
+## [0.1.32] - 2026-09-11
+
+Bulk-Offboarding aus dem Geräte-Tab, Geräte-Ladefehler behoben, bessere Graph-Diagnose.
+
+### Neu
+
+- **Bulk-Offboarding aus dem Geräte-Tab**: Geräte per Checkbox (inkl. „Alle sichtbaren") auswählen und über den Button **„Offboarden"** direkt in den Offboard-Dialog übergeben — kombinierbar mit dem Gruppen-Filter (z. B. alle Geräte einer Gruppe). Die Auswahl wird server-seitig zu vollständigen Offboard-Objekten aufgelöst (Entra-Object-Id + Autopilot-Id nachgeladen). Neuer Endpoint `POST /api/offboard/resolve`. Im Read-Only-Modus ausgeblendet.
+
+### Behoben
+
+- **„Geräte konnten nicht geladen werden" (400 BadRequest)**: Intunes DeviceFE-Backend lehnte die Abfrage ab. Ursachen entfernt: `managementState` ist kein gültiges `$select`-Feld (raus), `$orderby` wird nicht mehr gesendet (Sortierung macht das Frontend), und der Namensfilter fällt bei nicht unterstütztem `startswith` automatisch auf `deviceName`-only zurück. Geräte-Endpoints nutzen jetzt `beta` (wie der Offboard-Abruf).
+- **Bessere Graph-Fehler-Diagnose**: Bei Nicht-Retry-Fehlern wird der **Graph-Fehler-Body** an die Meldung gehängt (statt nur „BadRequest") — die eigentliche Ursache steht jetzt im Log/Toast.
+- **Offboarding**: Wird eine Autopilot-Zuordnung nicht gefunden, zeigt der Dialog jetzt den **Grund** (fehlende Berechtigung vs. kein Seriennummer-Treffer), statt kommentarlos „Autopilot: –".
+
+---
+
 ## [0.1.31] - 2026-09-11

 Policy-Konsolidierung, Geräte-Export nach Gruppe, Gruppen-in-Gruppen, Geräte-Fixes.
@@ -134,7 +134,7 @@ App-Registrierung automatisch anlegt/konfiguriert:**
 | App Management     | Haupt-Ansicht: Apps laden, Gruppen zuweisen / entfernen     |
 | Group Management   | Mitglieder anzeigen/exportieren, Benutzer **und Gruppen** hinzufuegen, CSV-Import |
 | App Report         | Installationszaehler pro App, Geraete-Export als CSV        |
-| Geräte             | Geraete suchen, Filter (auch nach **Gruppe**), CSV-Export, Detail-Panel, Aktionen (Sync, Wipe, …) |
+| Geräte             | Geraete suchen, Filter (auch nach **Gruppe**), CSV-Export, **Bulk-Offboarding**, Detail-Panel, Aktionen (Sync, Wipe, …) |
 | Policies           | Policies exportieren/importieren (Neuanlage) und **zusammenfuehren** (Settings Catalog) |

 ---
@@ -189,7 +189,7 @@ $script:State = [pscustomobject]@{
    Session        = @()      # geplante Zuweisungen
 }

-$script:ToolVersion = "0.1.31"
+$script:ToolVersion = "0.1.35"
 $script:BuildStamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

 Write-Host ""
@@ -12,7 +12,7 @@ if (Test-Path "$x64Dotnet\dotnet.exe") {
    $env:DOTNET_ROOT = "C:\Program Files\dotnet"
 }

-$version      = "0.1.31"
+$version      = "0.1.35"
 $src          = "\\Mac\Home\ClaudePRJ\Intune Manager"
 $stage        = "$env:TEMP\IntuneManagerStage"
 $installerDir = "$src\installer"
@@ -21,6 +21,7 @@ function Invoke-ApiHandler {
        "POST /api/settings/test"    { return Test-SettingsEndpoint -Body $Body }
        "POST /api/settings/logo"    { return Save-LogoEndpoint -Body $Body }
        "DELETE /api/settings/logo"  { return Remove-LogoEndpoint }
+        "GET /api/update/check"      { return Get-UpdateCheckEndpoint }
        "POST /api/connect"          { return Invoke-ConnectEndpoint }
        "POST /api/connect/token"    { return Invoke-ConnectWithTokenEndpoint -Body $Body }
        "POST /api/connect/start"    { return Start-DeviceCodeConnect }
@@ -63,6 +64,7 @@ function Invoke-ApiHandler {
        "POST /api/pickfolder"            { return Invoke-FolderPickerEndpoint -Body $Body }

        "GET /api/offboard/search"        { return Search-OffboardDevicesEndpoint -Query $Query }
+        "POST /api/offboard/resolve"      { return Get-OffboardResolveEndpoint -Body $Body }
        "POST /api/offboard/keys"         { return Get-OffboardKeysEndpoint -Body $Body }
        "POST /api/offboard/execute"      { return Invoke-OffboardExecuteEndpoint -Body $Body }
    }
@@ -135,6 +137,83 @@ function Invoke-ApiHandler {
    return $null
 }

+# ============================================================
+# Update-Check (neueste Release-Version von Gitea vergleichen)
+# ============================================================
+
+# Semver-Vergleich: 1 wenn A>B, -1 wenn A<B, 0 gleich. Fuehrendes 'v' und
+# Pre-Release/Build-Suffixe werden ignoriert; fehlende Teile zaehlen als 0.
+function Compare-SemVer {
+    param([string]$A, [string]$B)
+    $clean = {
+        param($s)
+        $s = ([string]$s).Trim().TrimStart('v','V')
+        $s = ($s -split '[-+ ]')[0]
+        @($s -split '\.' | ForEach-Object { [int]([regex]::Match($_, '\d+').Value -as [int]) })
+    }
+    $pa = & $clean $A
+    $pb = & $clean $B
+    $len = [Math]::Max($pa.Count, $pb.Count)
+    for ($i = 0; $i -lt $len; $i++) {
+        $x = if ($i -lt $pa.Count) { [int]$pa[$i] } else { 0 }
+        $y = if ($i -lt $pb.Count) { [int]$pb[$i] } else { 0 }
+        if ($x -gt $y) { return 1 }
+        if ($x -lt $y) { return -1 }
+    }
+    return 0
+}
+
+# Prueft die neueste Release-Version. Quelle standardmaessig das Gitea-Repo;
+# ueber Settings.update.apiUrl / .token ueberschreibbar (falls Repo privat).
+# Braucht KEINE Graph-Verbindung. Fehler werden still zurueckgegeben (kein Banner).
+function Get-UpdateCheckEndpoint {
+    $current = [string]$script:ToolVersion
+    $out = @{ current = $current; latest = ''; updateAvailable = $false; releaseUrl = ''; error = '' }
+
+    $api   = 'https://git.wende.it/api/v1/repos/marco/Intune-Manager/releases/latest'
+    $token = ''
+    try {
+        if ($script:Settings.update) {
+            if ($script:Settings.update.apiUrl) { $api   = [string]$script:Settings.update.apiUrl }
+            if ($script:Settings.update.token)  { $token = [string]$script:Settings.update.token }
+        }
+    } catch {}
+
+    $headers = @{ 'User-Agent' = 'IntuneManager' }
+    if ($token) { $headers['Authorization'] = "token $token" }
+
+    try { [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12 } catch {}
+
+    # Proxy: Hinter authentifizierten Unternehmens-Proxys (NTLM/Kerberos) scheitert
+    # Invoke-RestMethod sonst mit "407 Proxyauthentifizierung erforderlich", weil
+    # standardmaessig keine Anmeldeinformationen an den Proxy gesendet werden. Die
+    # angemeldeten Windows-Credentials an den (System-)Proxy durchreichen. Optional
+    # laesst sich ein expliziter Proxy ueber Settings.update.proxy setzen.
+    $proxyArgs = @{}
+    try {
+        $proxyUrl = ''
+        if ($script:Settings.update -and $script:Settings.update.proxy) { $proxyUrl = [string]$script:Settings.update.proxy }
+        if ($proxyUrl) {
+            $proxyArgs['Proxy'] = $proxyUrl
+            $proxyArgs['ProxyUseDefaultCredentials'] = $true
+        } elseif ([System.Net.WebRequest]::DefaultWebProxy) {
+            [System.Net.WebRequest]::DefaultWebProxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials
+        }
+    } catch {}
+
+    try {
+        $rel = Invoke-RestMethod -Uri $api -Headers $headers -Method GET -TimeoutSec 8 @proxyArgs
+        $latest = ([string]$rel.tag_name).TrimStart('v','V')
+        $out.latest          = $latest
+        $out.releaseUrl      = [string]$rel.html_url
+        $out.updateAvailable = ((Compare-SemVer $latest $current) -gt 0)
+    } catch {
+        $out.error = $_.Exception.Message
+        Write-Host "[UPDATE] Versions-Check fehlgeschlagen: $($_.Exception.Message)" -ForegroundColor DarkGray
+    }
+    return $out
+}
+
 # ============================================================
 # Status & Connection
 # ============================================================
@@ -1649,7 +1728,7 @@ function Get-GroupDevicesExportEndpoint {
        return @{ ok = $true; groupId = $GroupId; groupName = $groupName; userCount = 0; items = @(); count = 0; resolvedMs = [int]$sw.ElapsedMilliseconds }
    }

-    $select    = 'id,deviceName,userDisplayName,userPrincipalName,operatingSystem,osVersion,complianceState,serialNumber,model,manufacturer,lastSyncDateTime,enrolledDateTime'
+    $select    = 'id,deviceName,userDisplayName,userPrincipalName,operatingSystem,osVersion,complianceState,serialNumber,model,manufacturer,lastSyncDateTime,enrolledDateTime,managementAgent'
    $batchSize = 20
    $devSeen   = @{}
    $items     = [System.Collections.Generic.List[object]]::new()
@@ -1696,6 +1775,8 @@ function Get-GroupDevicesExportEndpoint {
                        OS                = [string]$d.operatingSystem
                        OSVersion         = [string]$d.osVersion
                        ComplianceState   = [string]$d.complianceState
+                        ManagementAgent   = [string]$d.managementAgent
+                        ManagementType    = Get-ManagementType ([string]$d.managementAgent)
                        SerialNumber      = [string]$d.serialNumber
                        Model             = [string]$d.model
                        Manufacturer      = [string]$d.manufacturer
@@ -1779,17 +1860,28 @@ function Get-UserMemberOfEndpoint {
 # Devices
 # ============================================================

+# Verwaltungsart aus dem Graph-Feld 'managementAgent' ableiten.
+# 'configurationManagerClientMdm' / 'configurationManagerClientMdmEas' -> Co-Managed
+# (ConfigMgr + Intune), alles andere -> reines Intune (MDM).
+function Get-ManagementType {
+    param([string]$Agent)
+    if ($Agent -match 'configurationManager') { return 'Co-Managed' }
+    return 'Intune'
+}
+
 function Search-DevicesEndpoint {
    param($Query)
    $err = Test-Connected
    if ($err) { return $err }

-    $q          = [string]$Query.q
+    $q          = ([string]$Query.q) -replace "'", "''"   # OData-Escape fuer Apostroph
    $os         = [string]$Query.os
    $compliance = [string]$Query.compliance
    $top        = 50

-    $select = 'id,deviceName,userDisplayName,userPrincipalName,operatingSystem,osVersion,complianceState,lastSyncDateTime,managementState,serialNumber,model,manufacturer,enrolledDateTime'
+    # HINWEIS: 'managementState' ist KEIN gueltiges $select-Feld auf managedDevices
+    # -> fuehrt zu 400 BadRequest. Bewusst weggelassen.
+    $select = 'id,deviceName,userDisplayName,userPrincipalName,operatingSystem,osVersion,complianceState,lastSyncDateTime,serialNumber,model,manufacturer,enrolledDateTime,managementAgent'

    # Ohne Suchbegriff: alle Geräte (erste Seite)
    # Mit Suchbegriff: Graph unterstuetzt startswith nur auf deviceName/userDisplayName/userPrincipalName.
@@ -1798,22 +1890,36 @@ function Search-DevicesEndpoint {
    $snItems   = @()

    if ($q -and $q.Length -ge 2) {
-        $filters = @()
-        $nameFilter = "(startswith(deviceName,'$q') or startswith(userDisplayName,'$q') or startswith(userPrincipalName,'$q'))"
-        $filters += $nameFilter
-        if ($os)         { $filters += "operatingSystem eq '$os'" }
-        if ($compliance) { $filters += "complianceState eq '$compliance'" }
-        $filterStr = '$filter=' + [uri]::EscapeDataString(($filters -join ' and ')) + '&'
-        $uri = "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?${filterStr}`$select=$select&`$top=$top&`$orderby=deviceName"
-        $resp = Invoke-MgGraphRequestRetry -Uri $uri -Method GET
-        $nameItems = @($resp.value)
+        $osComp = @()
+        if ($os)         { $osComp += "operatingSystem eq '$os'" }
+        if ($compliance) { $osComp += "complianceState eq '$compliance'" }
+        # Voller Namensfilter vs. nur deviceName. Manche Intune-Backends (DeviceFE)
+        # unterstuetzen startswith NUR auf deviceName -> bei "Unsupported parameter"
+        # (400) auf deviceName-only zurueckfallen. Kein $orderby mit $filter.
+        $nameVariants = @(
+            "(startswith(deviceName,'$q') or startswith(userDisplayName,'$q') or startswith(userPrincipalName,'$q'))",
+            "startswith(deviceName,'$q')"
+        )
+        for ($vi = 0; $vi -lt $nameVariants.Count; $vi++) {
+            $filters   = @($nameVariants[$vi]) + $osComp
+            $filterStr = '$filter=' + [uri]::EscapeDataString(($filters -join ' and ')) + '&'
+            $uri = "https://graph.microsoft.com/beta/deviceManagement/managedDevices?${filterStr}`$select=$select&`$top=$top"
+            try {
+                $resp = Invoke-MgGraphRequestRetry -Uri $uri -Method GET
+                $nameItems = @($resp.value)
+                break
+            } catch {
+                if ($vi -eq $nameVariants.Count - 1) { throw }   # letzter Versuch -> durchreichen
+                Write-Host "  [DEVICES] Namensfilter nicht unterstuetzt -> Fallback auf deviceName-only" -ForegroundColor DarkYellow
+            }
+        }

        # Seriennummer: exakter Vergleich (Graph unterstuetzt kein startswith auf serialNumber)
        $snFilters = @("serialNumber eq '$q'")
        if ($os)         { $snFilters += "operatingSystem eq '$os'" }
        if ($compliance) { $snFilters += "complianceState eq '$compliance'" }
        $snFilter = '$filter=' + [uri]::EscapeDataString(($snFilters -join ' and ')) + '&'
-        $snUri = "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?${snFilter}`$select=$select&`$top=10"
+        $snUri = "https://graph.microsoft.com/beta/deviceManagement/managedDevices?${snFilter}`$select=$select&`$top=10"
        try {
            $snResp = Invoke-MgGraphRequestRetry -Uri $snUri -Method GET
            $snItems = @($snResp.value)
@@ -1823,7 +1929,9 @@ function Search-DevicesEndpoint {
        if ($os)         { $filters += "operatingSystem eq '$os'" }
        if ($compliance) { $filters += "complianceState eq '$compliance'" }
        $filterStr = if ($filters.Count -gt 0) { '$filter=' + [uri]::EscapeDataString(($filters -join ' and ')) + '&' } else { '' }
-        $uri = "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?${filterStr}`$select=$select&`$top=$top&`$orderby=deviceName"
+        # Kein $orderby: das Intune-DeviceFE-Backend lehnt es (mit/ohne Filter) teils ab.
+        # Die Sortierung macht ohnehin das Frontend.
+        $uri = "https://graph.microsoft.com/beta/deviceManagement/managedDevices?${filterStr}`$select=$select&`$top=$top"
        $resp = Invoke-MgGraphRequestRetry -Uri $uri -Method GET
        $nameItems = @($resp.value)
    }
@@ -1845,6 +1953,8 @@ function Search-DevicesEndpoint {
            ComplianceState  = $d.complianceState
            LastSync         = ConvertTo-IsoDate $d.lastSyncDateTime
            ManagementState  = $d.managementState
+            ManagementAgent  = [string]$d.managementAgent
+            ManagementType   = Get-ManagementType ([string]$d.managementAgent)
            SerialNumber     = $d.serialNumber
            Model            = $d.model
            Manufacturer     = $d.manufacturer
@@ -1859,12 +1969,38 @@ function Get-DeviceEndpoint {
    $err = Test-Connected
    if ($err) { return $err }

-    $select = 'id,deviceName,userDisplayName,userPrincipalName,operatingSystem,osVersion,complianceState,lastSyncDateTime,managementState,serialNumber,model,manufacturer,enrolledDateTime,imei,wiFiMacAddress,azureADDeviceId,joinType,deviceEnrollmentType,managedDeviceOwnerType,totalStorageSpaceInBytes,freeStorageSpaceInBytes'
-    $d = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/$DeviceId`?`$select=$select" -Method GET
+    # 'managementState' entfernt: kein gueltiges $select-Feld auf managedDevices (400).
+    $select = 'id,deviceName,userDisplayName,userPrincipalName,operatingSystem,osVersion,complianceState,lastSyncDateTime,serialNumber,model,manufacturer,enrolledDateTime,imei,wiFiMacAddress,azureADDeviceId,joinType,deviceEnrollmentType,managedDeviceOwnerType,managementAgent,totalStorageSpaceInBytes,freeStorageSpaceInBytes'
+    $d = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/deviceManagement/managedDevices/$DeviceId`?`$select=$select" -Method GET

    $totalGB = if ($d.totalStorageSpaceInBytes) { [math]::Round($d.totalStorageSpaceInBytes / 1GB, 1) } else { $null }
    $freeGB  = if ($d.freeStorageSpaceInBytes)  { [math]::Round($d.freeStorageSpaceInBytes  / 1GB, 1) } else { $null }

+    # Autopilot-Identity per Seriennummer nachladen (nur Windows, fehlertolerant).
+    # HINWEIS: Ein echtes "Import-/Registrierungsdatum" liefert Graph nicht; verfuegbar
+    # sind nur Profil-Zuweisung (deploymentProfileAssignedDateTime) und letzter Kontakt.
+    $inAutopilot     = $false
+    $apProfileAssign = $null
+    $apLastContact   = $null
+    $sn = [string]$d.serialNumber
+    if ($sn -and ([string]$d.operatingSystem).ToLower() -eq 'windows') {
+        try {
+            $snEsc  = $sn -replace "'", "''"
+            $apFilt = [Uri]::EscapeDataString("contains(serialNumber,'$snEsc')")
+            $apSel  = 'id,serialNumber,deploymentProfileAssignedDateTime,lastContactedDateTime,enrollmentState'
+            $apUri  = "https://graph.microsoft.com/beta/deviceManagement/windowsAutopilotDeviceIdentities?`$filter=$apFilt&`$select=$apSel&`$top=1"
+            $apResp = Invoke-MgGraphRequestRetry -Uri $apUri -Method GET
+            $autop  = @($apResp.value)[0]
+            if ($autop) {
+                $inAutopilot     = $true
+                $apProfileAssign = ConvertTo-IsoDate $autop.deploymentProfileAssignedDateTime
+                $apLastContact   = ConvertTo-IsoDate $autop.lastContactedDateTime
+            }
+        } catch {
+            Write-Host "  [DEVICE] Autopilot-Lookup (SN=$sn): $($_.Exception.Message)" -ForegroundColor DarkYellow
+        }
+    }
+
    return @{
        Id               = $d.id
        DeviceName       = $d.deviceName
@@ -1875,6 +2011,8 @@ function Get-DeviceEndpoint {
        ComplianceState  = $d.complianceState
        LastSync         = ConvertTo-IsoDate $d.lastSyncDateTime
        ManagementState  = $d.managementState
+        ManagementAgent  = [string]$d.managementAgent
+        ManagementType   = Get-ManagementType ([string]$d.managementAgent)
        SerialNumber     = $d.serialNumber
        Model            = $d.model
        Manufacturer     = $d.manufacturer
@@ -1887,6 +2025,9 @@ function Get-DeviceEndpoint {
        OwnerType        = $d.managedDeviceOwnerType
        TotalStorageGB   = $totalGB
        FreeStorageGB    = $freeGB
+        InAutopilot            = $inAutopilot
+        AutopilotProfileAssigned = $apProfileAssign
+        AutopilotLastContacted   = $apLastContact
    }
 }

@@ -3585,3 +3726,198 @@ footer code{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;bac
    [IO.File]::WriteAllText($path, $html, [System.Text.Encoding]::UTF8)
    return $path
 }
+
+# HTML-Report fuers Geraete-Offboarding — pro Geraet die ausgefuehrten Loeschungen
+# (Entra/Intune/Autopilot) mit Status + Meldung. Liegt in Api.ps1 (BOM) wegen Umlauten.
+function New-OffboardHtmlReport {
+    param($Devices, $Results, [int]$Success, [int]$Errors, [int]$Total, [string]$EntraAction, [bool]$DoIntune, [bool]$DoAutopilot)
+
+    Add-Type -AssemblyName System.Web
+    function _e { param($s) if ($null -eq $s) { return "" } return [System.Web.HttpUtility]::HtmlEncode([string]$s) }
+
+    $ts      = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"
+    $tsHuman = Get-Date -Format "dd.MM.yyyy HH:mm:ss"
+    $name    = "offboard-report-$ts.html"
+    $path    = Join-Path $script:Config.ReportDir $name
+    $user    = $env:USERNAME
+    $machine = $env:COMPUTERNAME
+    $tenant  = if ($script:State.TenantId) { $script:State.TenantId } else { "" }
+    $account = if ($script:State.Account)  { $script:State.Account }  else { "" }
+    $devCount = @($Devices).Count
+
+    $bannerCls = if ($Errors -gt 0) { "banner-err" } else { "banner-ok" }
+    $bannerTxt = if ($Errors -gt 0) { "$Errors von $Total Aktion(en) fehlgeschlagen - Details unten" } else { "Alle $Success Aktion(en) erfolgreich" }
+
+    # Dienst-Zusammenfassung (was angefordert wurde)
+    $svcParts = @()
+    if     ($EntraAction -eq 'delete')  { $svcParts += "Entra ID: geloescht" }
+    elseif ($EntraAction -eq 'disable') { $svcParts += "Entra ID: deaktiviert" }
+    if ($DoIntune)    { $svcParts += "Intune: geloescht" }
+    if ($DoAutopilot) { $svcParts += "Autopilot: geloescht" }
+    $svcTxt = if ($svcParts.Count -gt 0) { ($svcParts -join " &middot; ") } else { "keine" }
+
+    # Ergebnisse pro Geraet gruppieren (Reihenfolge = Geraeteliste)
+    $byDev = [ordered]@{}
+    foreach ($d in @($Devices)) { $dn = [string]$d.deviceName; if ($dn -and -not $byDev.Contains($dn)) { $byDev[$dn] = @() } }
+    foreach ($r in @($Results)) {
+        $dn = [string]$r.deviceName
+        if (-not $byDev.Contains($dn)) { $byDev[$dn] = @() }
+        $byDev[$dn] += $r
+    }
+
+    $devBlocks = ""
+    foreach ($dn in @($byDev.Keys)) {
+        $rows = @($byDev[$dn])
+        $okC  = @($rows | Where-Object { $_.success }).Count
+        $errC = @($rows | Where-Object { -not $_.success }).Count
+        $rowsHtml = ""
+        foreach ($r in $rows) {
+            $cls = if ($r.success) { "ok" } else { "err" }
+            $ico = if ($r.success) { "&#10003;" } else { "&#33;" }
+            $lbl = if ($r.success) { "Erfolg" } else { "Fehler" }
+            $msg = if ($r.error) { _e $r.error } else { "" }
+            $rowsHtml += "<tr class='row-$cls'>" +
+                "<td class='c-status'><span class='status-pill status-$cls'>$ico $lbl</span></td>" +
+                "<td class='c-svc'>$(_e $r.service)</td>" +
+                "<td class='c-act'>$(_e $r.action)</td>" +
+                "<td class='c-msg'>$msg</td></tr>"
+        }
+        if (-not $rowsHtml) { $rowsHtml = "<tr><td colspan='4' class='c-msg'>Keine ausgefuehrten Aktionen.</td></tr>" }
+        $stats = ""
+        if ($okC -gt 0)  { $stats += "<span class='hd-pill hd-ok'>$okC OK</span>" }
+        if ($errC -gt 0) { $stats += "<span class='hd-pill hd-err'>$errC Fehler</span>" }
+        $devBlocks += "<details class='dev-block' open><summary class='dev-head'>" +
+            "<span class='dev-name'>$(_e $dn)</span><span class='dev-stats'>$stats</span></summary>" +
+            "<div class='dev-body'><table class='res-table'><thead><tr>" +
+            "<th class='c-status'>Status</th><th class='c-svc'>Dienst</th><th class='c-act'>Aktion</th><th class='c-msg'>Meldung</th>" +
+            "</tr></thead><tbody>$rowsHtml</tbody></table></div></details>"
+    }
+    if (-not $devBlocks) { $devBlocks = "<div class='empty'>Keine Ergebnisse.</div>" }
+
+    $html = @"
+<!DOCTYPE html>
+<html lang="de">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Intune Offboarding-Report - $tsHuman</title>
+<link rel="preconnect" href="https://rsms.me/">
+<link rel="stylesheet" href="https://rsms.me/inter/inter.css">
+<style>
+:root{
+  --black-100:#0A0E15;--black-80:#373F4E;--black-60:#667085;
+  --white-100:#FFFFFF;--white-90:#F0F1F5;--white-80:#E0E4EB;--white-70:#D1D6E0;
+  --blue-60:#3566B6;--blue-10:#E0ECFF;
+  --success-100:#008072;--success-60:#A0E3D8;--success-10:#D0FBF5;
+  --error-100:#B21919;--error-60:#EA9E9E;--error-10:#FBE0E0;
+  --warning-100:#8F7200;--warning-60:#F8E081;--warning-10:#FFF3C2;
+  --bg:#F7FAFD;--surface:#FFF;--surface-soft:#F4F7FB;--hairline:var(--white-70);--hairline-soft:var(--white-90);
+  --text-primary:var(--black-100);--text-secondary:var(--black-80);--text-muted:var(--black-60);
+  --r-sm:6px;--r-md:10px;--r-lg:14px;--shadow-soft:0 1px 2px rgba(23,64,130,.04),0 2px 6px rgba(23,64,130,.04);
+}
+*{box-sizing:border-box;margin:0;padding:0}
+html,body{font-family:'Inter',ui-sans-serif,system-ui,-apple-system,'Segoe UI',sans-serif;background:var(--bg);color:var(--text-secondary);line-height:1.5;-webkit-font-smoothing:antialiased}
+body{padding:32px 16px 80px}
+.container{max-width:1100px;margin:0 auto}
+.head{background:var(--surface);border:1px solid var(--hairline);border-radius:var(--r-lg);padding:24px 28px;margin-bottom:20px;box-shadow:var(--shadow-soft)}
+.head-top{display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:16px}
+.brand{display:flex;align-items:center;gap:12px}
+.logo{width:40px;height:40px;border-radius:9px;background:var(--blue-60);color:#fff;display:grid;place-items:center;font-size:20px;font-weight:700}
+.title{font-size:22px;font-weight:700;letter-spacing:-.015em;color:var(--text-primary)}
+.subtitle{font-size:13px;color:var(--text-muted);margin-top:2px}
+.head-meta{display:flex;flex-wrap:wrap;gap:6px}
+.meta-pill{display:inline-flex;align-items:center;gap:6px;font-size:11.5px;background:var(--surface-soft);border:1px solid var(--hairline);padding:5px 10px;border-radius:999px;color:var(--text-secondary);font-weight:500}
+.meta-pill .lbl{color:var(--text-muted);text-transform:uppercase;font-size:10px;letter-spacing:.04em;font-weight:600}
+.meta-pill code{font-family:ui-monospace,Menlo,Consolas,monospace;font-size:11px}
+.banner{margin-top:18px;padding:12px 16px;border-radius:var(--r-md);font-size:13.5px;font-weight:500;display:flex;align-items:center;gap:10px;border:1px solid transparent}
+.banner-ok{background:var(--success-10);border-color:var(--success-60);color:var(--success-100)}
+.banner-err{background:var(--error-10);border-color:var(--error-60);color:var(--error-100)}
+.banner-icon{width:22px;height:22px;border-radius:50%;display:inline-grid;place-items:center;font-size:13px;font-weight:700}
+.banner-ok .banner-icon{background:var(--success-60);color:var(--success-100)}
+.banner-err .banner-icon{background:var(--error-60);color:var(--error-100)}
+.kpis{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:12px;margin-bottom:20px}
+.kpi{background:var(--surface);border:1px solid var(--hairline);border-radius:var(--r-md);padding:18px}
+.kpi-num{font-size:30px;font-weight:700;line-height:1;letter-spacing:-.02em;font-variant-numeric:tabular-nums;color:var(--text-primary)}
+.kpi-lbl{font-size:11px;color:var(--text-muted);text-transform:uppercase;letter-spacing:.04em;font-weight:600;margin-top:6px}
+.kpi.ok .kpi-num{color:var(--success-100)}
+.kpi.err .kpi-num{color:var(--error-100)}
+.section{background:var(--surface);border:1px solid var(--hairline);border-radius:var(--r-lg);padding:22px 24px;margin-bottom:18px;box-shadow:var(--shadow-soft)}
+.section-title{font-size:15px;font-weight:600;color:var(--text-primary);margin-bottom:4px}
+.section-sub{font-size:12px;color:var(--text-muted);margin-bottom:14px}
+.dev-block{border:1px solid var(--hairline);border-radius:var(--r-md);overflow:hidden;margin-bottom:10px;background:var(--surface)}
+.dev-head{cursor:pointer;padding:12px 16px;display:flex;align-items:center;justify-content:space-between;gap:12px;list-style:none}
+.dev-head::-webkit-details-marker{display:none}
+.dev-name{font-size:14px;font-weight:600;color:var(--text-primary)}
+.dev-stats{display:flex;gap:6px}
+.hd-pill{font-size:10.5px;font-weight:700;padding:2px 8px;border-radius:999px}
+.hd-ok{background:var(--success-10);color:var(--success-100)}
+.hd-err{background:var(--error-10);color:var(--error-100)}
+.dev-body{border-top:1px solid var(--hairline-soft)}
+.res-table{width:100%;border-collapse:collapse;font-size:13px}
+.res-table th{text-align:left;font-size:10.5px;text-transform:uppercase;letter-spacing:.04em;color:var(--text-muted);font-weight:600;padding:8px 16px;background:var(--surface-soft);border-bottom:1px solid var(--hairline-soft)}
+.res-table td{padding:9px 16px;border-bottom:1px solid var(--hairline-soft);vertical-align:top}
+.res-table tr:last-child td{border-bottom:none}
+.c-status{width:120px}.c-svc{width:120px;font-weight:600;color:var(--text-primary)}.c-act{width:130px}
+.c-msg{color:var(--error-100)}
+.status-pill{display:inline-flex;align-items:center;gap:4px;font-size:11px;font-weight:600;padding:3px 9px;border-radius:999px;border:1px solid transparent;white-space:nowrap}
+.status-ok{background:var(--success-10);color:var(--success-100);border-color:var(--success-60)}
+.status-err{background:var(--error-10);color:var(--error-100);border-color:var(--error-60)}
+.empty{padding:18px;text-align:center;color:var(--text-muted);font-size:13px;background:var(--surface-soft);border-radius:var(--r-md);border:1px dashed var(--hairline)}
+footer{text-align:center;color:var(--text-muted);font-size:11.5px;margin-top:24px}
+footer code{font-family:ui-monospace,Menlo,Consolas,monospace;background:var(--surface);padding:1px 6px;border-radius:4px;border:1px solid var(--hairline)}
+@media print{body{background:#fff;padding:0}.section,.head,.kpi,.dev-block{box-shadow:none;break-inside:avoid}}
+</style>
+</head>
+<body>
+<div class="container">
+  <header class="head">
+    <div class="head-top">
+      <div class="brand">
+        <div class="logo">I</div>
+        <div>
+          <div class="title">Intune Offboarding-Report</div>
+          <div class="subtitle">$tsHuman &middot; ausgefuehrt von $(_e $user)</div>
+        </div>
+      </div>
+      <div class="head-meta">
+"@
+    if ($account) { $html += "<span class='meta-pill'><span class='lbl'>Account</span> $(_e $account)</span>" }
+    if ($tenant)  { $html += "<span class='meta-pill'><span class='lbl'>Tenant</span> <code>$(_e $tenant)</code></span>" }
+    $html += "<span class='meta-pill'><span class='lbl'>Host</span> $(_e $machine)</span>"
+    $html += @"
+      </div>
+    </div>
+    <div class="banner $bannerCls">
+      <span class="banner-icon">$(if ($Errors -gt 0) { '!' } else { '&#10003;' })</span>
+      <span>$bannerTxt</span>
+    </div>
+  </header>
+
+  <div class="kpis">
+    <div class="kpi tot"><div class="kpi-num">$devCount</div><div class="kpi-lbl">Geraete</div></div>
+    <div class="kpi tot"><div class="kpi-num">$Total</div><div class="kpi-lbl">Aktionen</div></div>
+    <div class="kpi ok"><div class="kpi-num">$Success</div><div class="kpi-lbl">Erfolgreich</div></div>
+    <div class="kpi err"><div class="kpi-num">$Errors</div><div class="kpi-lbl">Fehler</div></div>
+  </div>
+
+  <div class="section">
+    <div class="section-title">Angeforderte Dienste</div>
+    <div class="section-sub">$svcTxt</div>
+  </div>
+
+  <div class="section">
+    <div class="section-title">Ergebnisse pro Geraet</div>
+    <div class="section-sub">Jeder Block zeigt die ausgefuehrten Loeschungen/Aenderungen mit Status und Meldung.</div>
+    $devBlocks
+  </div>
+
+  <footer>
+    Intune Manager &middot; Web Edition <code>v$(_e $script:ToolVersion)</code> &middot; Offboarding-Report
+  </footer>
+</div>
+</body>
+</html>
+"@
+    [IO.File]::WriteAllText($path, $html, [System.Text.Encoding]::UTF8)
+    return $path
+}
@@ -71,6 +71,11 @@ function Invoke-MgGraphRequestRetry {
                Start-Sleep -Seconds $wait
                continue
            }
+            # Nicht-Retry-Fehler: den Graph-Fehler-Body (mit dem eigentlichen Grund)
+            # an die Meldung haengen — sonst steht im Log nur "BadRequest".
+            $gbody = $null
+            try { $gbody = [string]$_.ErrorDetails.Message } catch {}
+            if ($gbody) { throw [System.Exception]::new("$msg | Graph: $gbody", $_.Exception) }
            throw
        }
    }
@@ -55,6 +55,15 @@ function Search-OffboardDevicesEndpoint {
        return @{ __status = 500; error = "Graph-Fehler bei der Suche: $m" }
    }
    if ($intune.Count -eq 0) { return @{ items = @(); count = 0 } }
+    return @{ items = @(Resolve-OffboardItems -IntuneDevices $intune); count = $intune.Count }
+}
+
+# Reichert Intune-managedDevice-Objekte mit Entra-Objekt-Id + Autopilot-Id an
+# (per $batch) und liefert die Offboard-Item-Struktur fuers Frontend.
+function Resolve-OffboardItems {
+    param([object[]]$IntuneDevices)
+    $intune = @($IntuneDevices)
+    if ($intune.Count -eq 0) { return @() }

    # Entra-Objekt (fuer Delete) + Autopilot-Identity (fuer Delete) per Batch nachladen.
    $reqs = @()
@@ -77,9 +86,23 @@ function Search-OffboardDevicesEndpoint {
    $items = @()
    $idx   = 0
    foreach ($d in $intune) {
-        $entra = $null; $autop = $null
+        $ser   = [string]$d.serialNumber
+        $entra = $null; $autop = $null; $apNote = ''
        $er = $batch["e$idx"]; if ($er -and [int]$er.status -eq 200) { $entra = @($er.body.value)[0] }
-        $ar = $batch["a$idx"]; if ($ar -and [int]$ar.status -eq 200) { $autop = @($ar.body.value)[0] }
+        $ar = $batch["a$idx"]
+        if ($ar) {
+            $ast = [int]$ar.status
+            if ($ast -eq 200) {
+                $autop = @($ar.body.value)[0]
+                if (-not $autop) { $apNote = 'Kein Autopilot-Treffer fuer Seriennummer' }
+            } else {
+                $acode = ''; try { $acode = [string]$ar.body.error.code } catch {}
+                $apNote = "Autopilot-Lookup fehlgeschlagen: HTTP $ast" + $(if ($acode) { " ($acode)" } else { '' })
+                Write-Host "  [OFFBOARD] Autopilot-Lookup ($($d.deviceName), SN=$ser): HTTP $ast $acode" -ForegroundColor DarkYellow
+            }
+        } elseif (-not $ser) {
+            $apNote = 'Keine Seriennummer am Intune-Geraet'
+        }
        $items += [pscustomobject]@{
            deviceName      = [string]$d.deviceName
            serialNumber    = [string]$d.serialNumber
@@ -94,13 +117,39 @@ function Search-OffboardDevicesEndpoint {
            entraObjectId   = if ($entra) { [string]$entra.id } else { '' }
            entraEnabled    = if ($entra) { [bool]$entra.accountEnabled } else { $null }
            autopilotId     = if ($autop) { [string]$autop.id } else { '' }
+            autopilotNote   = $apNote
            inIntune        = $true
            inEntra         = [bool]$entra
            inAutopilot     = [bool]$autop
        }
        $idx++
    }
-    return @{ items = @($items); count = $items.Count }
+    return @($items)
+}
+
+# Offboard-Items zu einer Liste von Intune-Device-Ids aufloesen (fuer Bulk-
+# Offboarding aus dem Geraete-Tab). Body: { ids: [intuneDeviceId, ...] }
+function Get-OffboardResolveEndpoint {
+    param($Body)
+    $err = Test-Connected
+    if ($err) { return $err }
+    $ids = @(Get-PolicyProp $Body 'ids') | Where-Object { $_ }
+    if (@($ids).Count -eq 0) { return @{ items = @(); count = 0 } }
+
+    $sel  = 'id,deviceName,serialNumber,operatingSystem,osVersion,userPrincipalName,lastSyncDateTime,azureADDeviceId,managedDeviceOwnerType,managementAgent'
+    $reqs = @()
+    $i    = 0
+    foreach ($id in $ids) {
+        $reqs += @{ id = "d$i"; method = 'GET'; url = "/deviceManagement/managedDevices/$([string]$id)?`$select=$sel" }
+        $i++
+    }
+    $batch = Invoke-GraphBatch -Requests $reqs
+    $devs  = @()
+    foreach ($k in @($batch.Keys)) {
+        $r = $batch[$k]
+        if ($r -and [int]$r.status -eq 200 -and $r.body) { $devs += $r.body }
+    }
+    return @{ items = @(Resolve-OffboardItems -IntuneDevices $devs); count = @($devs).Count }
 }

 # Recovery-Keys eines Geraets holen (vor dem Loeschen). Body:
@@ -232,7 +281,19 @@ function Invoke-OffboardExecuteEndpoint {
            success = $ok; error = $errMsg
        }
    }
-    $okCount = @($results | Where-Object { $_.success }).Count
+    $okCount  = @($results | Where-Object { $_.success }).Count
+    $errCount = $results.Count - $okCount
    Write-Host "  -> $okCount/$($results.Count) erfolgreich" -ForegroundColor DarkGray
-    return @{ ok = $true; successCount = $okCount; total = $results.Count; results = @($results) }
+
+    # HTML-Report erzeugen (pro Geraet die ausgefuehrten Loeschungen) und verlinken.
+    $reportUrl = ""
+    try {
+        $reportFile = New-OffboardHtmlReport -Devices $devices -Results $results -Success $okCount -Errors $errCount -Total $results.Count -EntraAction $entraAction -DoIntune $doIntune -DoAutopilot $doAutopilot
+        if ($reportFile) { $reportUrl = "/reports/" + (Split-Path $reportFile -Leaf) }
+        Write-Host "[OFFBOARD] HTML-Report: $reportFile" -ForegroundColor DarkGray
+    } catch {
+        Write-Host "[OFFBOARD] Report-Erstellung fehlgeschlagen: $($_.Exception.Message)" -ForegroundColor Red
+    }
+
+    return @{ ok = $true; successCount = $okCount; total = $results.Count; results = @($results); reportUrl = [string]$reportUrl }
 }
@@ -230,7 +230,7 @@ function ConvertTo-ImportBody {
 # Arrays. Idempotent: bereits korrekte Arrays bleiben unveraendert.
 function Repair-SettingsCatalogArrays {
    param($Node)
-    $arrayKeys = @('settings','children','groupSettingCollectionValue','simpleSettingCollectionValue','values')
+    $arrayKeys = @('settings','children','groupSettingCollectionValue','simpleSettingCollectionValue','choiceSettingCollectionValue','values')
    # *TemplateReference-Keys tragen ein Objekt ODER null. Ein alter Export mit zu
    # geringer ConvertTo-Json-Tiefe hat solche (tief liegenden) Objekte zu ".ToString()"
    # stringifiziert -> "System.Collections.Hashtable". Graph lehnt das ab
@@ -4784,6 +4784,24 @@ document.getElementById('btnRestoreColors')?.addEventListener('click', () => {
 // Init
 // =============================================================

+// Prueft (nicht-blockierend) auf eine neuere Release-Version und zeigt bei Bedarf
+// das Update-Badge in der Kopfzeile mit Link zur Release-Seite.
+async function checkForUpdate() {
+  try {
+    const res = await api('/api/update/check');
+    if (res && res.updateAvailable && res.releaseUrl) {
+      const badge = document.getElementById('updateBadge');
+      const txt   = document.getElementById('updateBadgeText');
+      if (badge && txt) {
+        txt.textContent = `Update ${res.latest}`;
+        badge.href  = res.releaseUrl;
+        badge.title = `Neue Version ${res.latest} verfügbar (aktuell ${res.current}) — Release-Seite öffnen`;
+        badge.classList.remove('hidden');
+      }
+    }
+  } catch (e) { /* still: Update-Check ist optional */ }
+}
+
 (async function init() {
  renderConnection();
  renderTargets();
@@ -4807,6 +4825,7 @@ document.getElementById('btnRestoreColors')?.addEventListener('click', () => {
  }
  await refreshStatus();
  refreshTenantSwitcher();
+  checkForUpdate();   // nicht-blockierend
  if (State.connected) autoLoadAfterConnect();
  // First-Run: wenn kritische Felder leer sind, Settings-Modal automatisch oeffnen.
  if (setupNeeded) {
@@ -5776,7 +5795,8 @@ const DevState = {
  sortAsc: true,
  loaded: false,
  groupId: null,      // aktiver Gruppen-Filter (null = alle Geraete)
-  groupName: ''
+  groupName: '',
+  checked: new Set()  // per Checkbox ausgewaehlte Geraete-Ids (fuer Bulk-Offboarding)
 };

 async function devLoadAll() {
@@ -5789,6 +5809,7 @@ function devShowLoading(on) {
 }

 async function devFetch() {
+  DevState.checked.clear();   // neue Datenladung -> Auswahl zuruecksetzen
  devShowLoading(true);
  try {
    if (DevState.groupId) {
@@ -5851,12 +5872,20 @@ const DEV_COL_MAP = {
  deviceName:        'DeviceName',
  userDisplayName:   'UserDisplayName',
  operatingSystem:   'OS',
+  managementType:    'ManagementType',
  complianceState:   'ComplianceState',
  lastSyncDateTime:  'LastSync',
  enrolledDateTime:  'EnrolledDateTime',
 };
 const DEV_DATE_COLS = new Set(['LastSync', 'EnrolledDateTime']);

+// Verwaltungsart als Badge: Co-Managed (ConfigMgr + Intune) vs. reines Intune.
+function devMgmtBadge(type) {
+  if (type === 'Co-Managed') return '<span class="dev-badge dev-badge-comgmt">Co-Managed</span>';
+  if (type === 'Intune')     return '<span class="dev-badge dev-badge-intune">Intune</span>';
+  return '<span class="dev-badge dev-badge-unk">—</span>';
+}
+
 function devFmtDate(iso) {
  if (!iso) return '—';
  const d = new Date(iso);
@@ -5914,23 +5943,54 @@ function devRender() {
    const cmpCls = d.ComplianceState === 'compliant' ? 'dev-badge-ok'
                 : d.ComplianceState === 'noncompliant' ? 'dev-badge-err' : 'dev-badge-unk';
    const sel = DevState.selected && DevState.selected.Id === d.Id ? ' class="dev-row-selected"' : '';
+    const chk = DevState.checked.has(d.Id) ? 'checked' : '';
    html += `<tr data-id="${escapeHtml(d.Id)}"${sel}>
+      <td class="dev-col-check"><input type="checkbox" class="dev-row-check" data-id="${escapeHtml(d.Id)}" ${chk}></td>
      <td>${escapeHtml(d.DeviceName || '—')}</td>
      <td>${escapeHtml(d.UserDisplayName || '—')}</td>
      <td>${escapeHtml(d.OS || '—')}</td>
+      <td>${devMgmtBadge(d.ManagementType)}</td>
      <td><span class="dev-badge ${cmpCls}">${escapeHtml(d.ComplianceState || '—')}</span></td>
      <td>${sync}</td>
    </tr>`;
  }
  tbody.innerHTML = html;

+  tbody.querySelectorAll('.dev-row-check').forEach(cb => {
+    cb.addEventListener('click', e => e.stopPropagation());
+    cb.addEventListener('change', () => {
+      if (cb.checked) DevState.checked.add(cb.dataset.id);
+      else DevState.checked.delete(cb.dataset.id);
+      devUpdateCheckSel();
+    });
+  });
  tbody.querySelectorAll('tr').forEach(tr => {
-    tr.addEventListener('click', () => {
+    tr.addEventListener('click', e => {
+      if (e.target.classList.contains('dev-row-check')) return;
      const id = tr.dataset.id;
      const device = DevState.filtered.find(d => d.Id === id);
      if (device) devSelectDevice(device);
    });
  });
+  devUpdateCheckSel();
+}
+
+// Checkbox-Auswahl -> Offboard-Button + Zähler + Header-Checkbox synchronisieren.
+function devUpdateCheckSel() {
+  // Nur sichtbare (gefilterte) Geraete zaehlen.
+  const visibleIds = DevState.filtered.map(d => d.Id);
+  const n = visibleIds.filter(id => DevState.checked.has(id)).length;
+  const btn = document.getElementById('btnDevOffboard');
+  if (btn) {
+    btn.disabled = n === 0;
+    const c = document.getElementById('devOffboardCount');
+    if (c) c.textContent = n;
+  }
+  const all = document.getElementById('devCheckAll');
+  if (all) {
+    all.checked = n > 0 && n === visibleIds.length;
+    all.indeterminate = n > 0 && n < visibleIds.length;
+  }
 }

 async function devSelectDevice(device) {
@@ -5967,12 +6027,16 @@ function devRenderDetail(d) {
    ['Benutzer',      d.UserDisplayName],
    ['UPN',           d.UserPrincipalName],
    ['OS',            d.OS ? `${d.OS} ${d.OSVersion || ''}`.trim() : null],
+    ['Verwaltung',    d.ManagementType],
    ['Compliance',    d.ComplianceState],
    ['Seriennummer',  d.SerialNumber],
    ['IMEI',          d.Imei],
    ['Wi-Fi MAC',     d.WiFiMac],
    ['Speicher',      storage],
    ['Eingeschrieben', enrolled],
+    ['Autopilot',      d.InAutopilot ? 'Registriert' : (d.InAutopilot === false ? 'Nicht in Autopilot' : null)],
+    ['Autopilot-Profil zugewiesen', d.AutopilotProfileAssigned ? devFmtDate(d.AutopilotProfileAssigned) : null],
+    ['Autopilot letzter Kontakt',   d.AutopilotLastContacted ? devFmtDate(d.AutopilotLastContacted) : null],
    ['Letzter Sync',  sync],
    ['Join-Typ',      d.JoinType],
    ['Besitzertyp',   d.OwnerType],
@@ -6171,12 +6235,12 @@ document.addEventListener('click', e => {
 function devExportCsv() {
  const items = DevState.filtered || [];
  if (items.length === 0) { toast('Keine Geräte zum Exportieren.', 'warn'); return; }
-  const header = ['DeviceName','UserDisplayName','UserPrincipalName','OS','OSVersion','ComplianceState','SerialNumber','Model','Manufacturer','LastSync','EnrolledDateTime'];
+  const header = ['DeviceName','UserDisplayName','UserPrincipalName','OS','OSVersion','ManagementType','ComplianceState','SerialNumber','Model','Manufacturer','LastSync','EnrolledDateTime'];
  const rows = [header];
  for (const d of items) {
    rows.push([
      d.DeviceName || '', d.UserDisplayName || '', d.UserPrincipalName || '',
-      d.OS || '', d.OSVersion || '', d.ComplianceState || '',
+      d.OS || '', d.OSVersion || '', d.ManagementType || '', d.ComplianceState || '',
      d.SerialNumber || '', d.Model || '', d.Manufacturer || '',
      d.LastSync ? devFmtDate(d.LastSync) : '', d.EnrolledDateTime ? devFmtDate(d.EnrolledDateTime) : '',
    ]);
@@ -6193,6 +6257,34 @@ function devExportCsv() {

 document.getElementById('btnDevExport')?.addEventListener('click', devExportCsv);

+// Alle sichtbaren Geraete an-/abwaehlen
+document.getElementById('devCheckAll')?.addEventListener('change', e => {
+  const on = e.target.checked;
+  DevState.filtered.forEach(d => { if (on) DevState.checked.add(d.Id); else DevState.checked.delete(d.Id); });
+  // Checkboxen in der Tabelle spiegeln, ohne komplett neu zu rendern
+  document.querySelectorAll('#devTableBody .dev-row-check').forEach(cb => { cb.checked = on; });
+  devUpdateCheckSel();
+});
+
+// Ausgewaehlte Geraete offboarden -> IDs aufloesen (Entra/Autopilot) und Dialog oeffnen
+async function devOffboardSelected() {
+  const ids = DevState.filtered.filter(d => DevState.checked.has(d.Id)).map(d => d.Id);
+  if (ids.length === 0) { toast('Keine Geräte ausgewählt.', 'warn'); return; }
+  setLoading(`Löse ${ids.length} Gerät(e) für Offboarding auf…`);
+  try {
+    const res = await api('/api/offboard/resolve', { method: 'POST', body: { ids }, timeoutMs: 120000 });
+    const items = res.items || [];
+    if (items.length === 0) { toast('Geräte konnten nicht aufgelöst werden.', 'err'); return; }
+    // Offboard-Dialog mit genau diesen Geräten öffnen (unabhängig vom Offboard-Tab).
+    openOffboardModal(items);
+  } catch (e) {
+    toast('Offboarding-Auflösung fehlgeschlagen: ' + e.message, 'err');
+  } finally {
+    clearLoading();
+  }
+}
+document.getElementById('btnDevOffboard')?.addEventListener('click', devOffboardSelected);
+
 // Sortierung
 document.querySelectorAll('#devTable th.sortable').forEach(th => {
  th.addEventListener('click', () => {
@@ -6816,7 +6908,7 @@ document.querySelectorAll('#polTable th.sortable').forEach(th => {
 // =============================================================
 // OFFBOARDING: Geräte aus Intune / Autopilot / Entra entfernen
 // =============================================================
-const OffState = { items: [], selected: new Set() };
+const OffState = { items: [], selected: new Set(), pending: [] };
 function offKey(d) { return d.intuneDeviceId; }
 function offSelectedDevices() { return OffState.items.filter(d => OffState.selected.has(offKey(d))); }

@@ -6889,12 +6981,13 @@ function offUpdateSel() {
  document.getElementById('offBtn').disabled = n === 0;
 }

-function openOffboardModal() {
-  const devs = offSelectedDevices();
+function openOffboardModal(devsArg) {
+  const devs = Array.isArray(devsArg) ? devsArg : offSelectedDevices();
  if (!devs.length) return;
+  OffState.pending = devs;
  document.getElementById('offConfirmList').innerHTML = devs.map(d => `
    <div class="off-confirm-row"><b>${escapeHtml(d.deviceName || '—')}</b>
-      — Intune: ${d.intuneDeviceId ? '✓' : '–'}, Entra: ${d.entraObjectId ? '✓' : '–'}, Autopilot: ${d.autopilotId ? '✓' : '–'}</div>
+      — Intune: ${d.intuneDeviceId ? '✓' : '–'}, Entra: ${d.entraObjectId ? '✓' : '–'}, Autopilot: ${d.autopilotId ? '✓' : '–'}${(!d.autopilotId && d.autopilotNote) ? ` <span class="off-note" style="color:var(--warning,#e0a030);">(${escapeHtml(d.autopilotNote)})</span>` : ''}</div>
  `).join('');
  document.getElementById('offModalInfo').textContent = `${devs.length} Gerät(e)`;
  document.getElementById('offConfirmChk').checked = false;
@@ -6931,7 +7024,7 @@ async function offLoadKeys(devs) {
 }

 async function offExecute() {
-  const devs = offSelectedDevices();
+  const devs = (OffState.pending && OffState.pending.length) ? OffState.pending : offSelectedDevices();
  if (!devs.length) return;
  const services = {
    entra:     document.querySelector('input[name="offEntra"]:checked').value,
@@ -6951,9 +7044,30 @@ async function offExecute() {
  try {
    const res = await api('/api/offboard/execute', { method: 'POST', body: { devices: payload, services }, timeoutMs: 180000 });
    const results = res.results || [];
+    // Ergebnis pro Gerät gruppieren
+    const byDev = new Map();
+    for (const r of results) {
+      if (!byDev.has(r.deviceName)) byDev.set(r.deviceName, []);
+      byDev.get(r.deviceName).push(r);
+    }
+    const devHtml = [...byDev.entries()].map(([name, rows]) => {
+      const errs = rows.filter(r => !r.success).length;
+      const lines = rows.map(r =>
+        `<div class="off-result ${r.success ? 'ok' : 'fail'}">${r.success ? '✓' : '✗'} ${escapeHtml(r.service)} ${escapeHtml(r.action)}${r.error ? ': ' + escapeHtml(r.error) : ''}</div>`
+      ).join('');
+      return `<div class="off-result-dev">
+        <div class="off-result-devname">${escapeHtml(name || '—')}${errs ? ` <span class="off-result-badge">${errs} Fehler</span>` : ''}</div>
+        ${lines}
+      </div>`;
+    }).join('');
+    const reportLink = res.reportUrl
+      ? `<a href="${escapeHtml(res.reportUrl)}" target="_blank" rel="noopener" class="btn btn-secondary btn-sm" style="margin-top:12px;display:inline-flex;align-items:center;gap:6px;">
+          <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/><polyline points="14 2 14 8 20 8"/><line x1="16" y1="13" x2="8" y2="13"/><line x1="16" y1="17" x2="8" y2="17"/><line x1="10" y1="9" x2="8" y2="9"/></svg>
+          HTML-Report öffnen
+        </a>`
+      : '';
    document.getElementById('offResults').innerHTML =
-      `<div class="lbl">Ergebnis (${res.successCount}/${res.total})</div>` +
-      results.map(r => `<div class="off-result ${r.success ? 'ok' : 'fail'}">${r.success ? '✓' : '✗'} ${escapeHtml(r.deviceName)} — ${escapeHtml(r.service)} ${escapeHtml(r.action)}${r.error ? ': ' + escapeHtml(r.error) : ''}</div>`).join('');
+      `<div class="lbl">Ergebnis (${res.successCount}/${res.total})</div>${devHtml}${reportLink}`;
    toast(`${res.successCount}/${res.total} Aktionen erfolgreich.`, res.successCount === res.total ? 'ok' : 'warn', 'Offboarding');
    // Erfolgreich vollständig offgeboardete Geräte aus der Liste nehmen.
    const doneNames = new Set(results.filter(r => r.success).map(r => r.deviceName));
@@ -41,6 +41,10 @@
  </nav>

  <div class="header-actions">
+    <a id="updateBadge" class="update-badge hidden" href="#" target="_blank" rel="noopener" title="Update verfügbar — Release-Seite öffnen">
+      <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 12a9 9 0 1 1-3-6.7"/><polyline points="21 3 21 9 15 9"/></svg>
+      <span id="updateBadgeText">Update</span>
+    </a>
    <button id="btnSettings" class="icon-btn icon-btn-header" title="Einstellungen" aria-label="Einstellungen öffnen">
      <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="3"/><path d="M19.4 15a1.7 1.7 0 0 0 .34 1.86l.06.06a2 2 0 0 1-2.83 2.83l-.06-.06a1.7 1.7 0 0 0-1.86-.34 1.7 1.7 0 0 0-1.04 1.57V21a2 2 0 0 1-4 0v-.09a1.7 1.7 0 0 0-1.1-1.57 1.7 1.7 0 0 0-1.86.34l-.06.06a2 2 0 1 1-2.83-2.83l.06-.06a1.7 1.7 0 0 0 .34-1.86 1.7 1.7 0 0 0-1.57-1.04H3a2 2 0 0 1 0-4h.09A1.7 1.7 0 0 0 4.66 9a1.7 1.7 0 0 0-.34-1.86l-.06-.06a2 2 0 1 1 2.83-2.83l.06.06a1.7 1.7 0 0 0 1.86.34H9a1.7 1.7 0 0 0 1.04-1.57V3a2 2 0 0 1 4 0v.09c0 .68.42 1.29 1.04 1.57.62.27 1.36.13 1.86-.34l.06-.06a2 2 0 1 1 2.83 2.83l-.06.06a1.7 1.7 0 0 0-.34 1.86V9a1.7 1.7 0 0 0 1.57 1.04H21a2 2 0 0 1 0 4h-.09a1.7 1.7 0 0 0-1.51 1z"/></svg>
    </button>
@@ -507,6 +511,10 @@
      <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg>
      CSV
    </button>
+    <button id="btnDevOffboard" class="btn btn-danger btn-sm dev-offboard-btn" disabled title="Ausgewählte Geräte offboarden (Intune / Autopilot / Entra)">
+      <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4"/><polyline points="16 17 21 12 16 7"/><line x1="21" y1="12" x2="9" y2="12"/></svg>
+      Offboarden (<span id="devOffboardCount">0</span>)
+    </button>
  </div>

  <div class="dev-layout">
@@ -515,9 +523,11 @@
      <table class="dev-table" id="devTable">
        <thead>
          <tr>
+            <th class="dev-col-check"><input type="checkbox" id="devCheckAll" title="Alle sichtbaren auswählen"></th>
            <th class="sortable" data-col="deviceName">Gerät <span class="sort-ico"></span></th>
            <th class="sortable" data-col="userDisplayName">Benutzer <span class="sort-ico"></span></th>
            <th class="sortable" data-col="operatingSystem">OS <span class="sort-ico"></span></th>
+            <th class="sortable" data-col="managementType">Verwaltung <span class="sort-ico"></span></th>
            <th class="sortable" data-col="complianceState">Compliance <span class="sort-ico"></span></th>
            <th class="sortable" data-col="lastSyncDateTime">Letzter Sync <span class="sort-ico"></span></th>
          </tr>
@@ -1065,6 +1075,9 @@
  .off-result { font-size:13px; padding:3px 0; overflow-wrap:anywhere; }
  .off-result.ok { color:var(--success); }
  .off-result.fail { color:var(--error); }
+  .off-result-dev { border:1px solid var(--hairline-soft, var(--hairline)); border-radius:8px; padding:8px 12px; margin-bottom:8px; }
+  .off-result-devname { font-weight:600; font-size:13px; margin-bottom:4px; display:flex; align-items:center; gap:8px; }
+  .off-result-badge { font-size:10.5px; font-weight:700; padding:1px 8px; border-radius:999px; background:rgba(245,80,80,0.18); color:var(--error); }
  #offResults .lbl { display:block; font-size:12px; color:var(--body); margin:10px 0 4px; }
 </style>

@@ -335,6 +335,24 @@ h1, h2, h3 {

 .header-actions { display: flex; align-items: center; gap: 12px; }

+/* Update-Hinweis-Badge (neue Version verfuegbar) */
+.update-badge {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  padding: 5px 11px;
+  border-radius: 999px;
+  background: var(--accent-soft);
+  color: var(--brand-accent);
+  border: 1px solid var(--brand-accent);
+  font-size: 12px;
+  font-weight: 600;
+  text-decoration: none;
+  white-space: nowrap;
+  transition: filter var(--tx, 0.15s ease-out);
+}
+.update-badge:hover { filter: brightness(0.96); }
+
 /* Theme-Toggle — Slide-Switch */
 .theme-toggle {
  appearance: none;
@@ -4969,6 +4987,7 @@ body.read-only .gex-add-pane,
 body.read-only .gex-tab[data-tab="add"],
 body.read-only .gex-tab[data-tab="import"],
 body.read-only #gexPaneImport,
+body.read-only .dev-offboard-btn,
 body.read-only .pol-write {
  display: none !important;
 }
@@ -5373,6 +5392,8 @@ body.read-only .app-row {
 }
 .dev-table thead th.sortable { cursor: pointer; }
 .dev-table thead th.sortable:hover { color: var(--text); }
+.dev-col-check { width: 34px; text-align: center; padding-left: 6px; padding-right: 6px; }
+.dev-col-check input { cursor: pointer; }
 .dev-table tbody tr {
  cursor: pointer;
  border-bottom: 1px solid var(--hairline-soft);
@@ -5406,6 +5427,8 @@ body.read-only .app-row {
 .dev-badge-ok  { background: rgba(74,222,128,.15); color: #4ade80; }
 .dev-badge-err { background: rgba(248,113,113,.15); color: #f87171; }
 .dev-badge-unk { background: var(--hairline-soft);  color: var(--muted); }
+.dev-badge-intune { background: rgba(96,165,250,.15); color: #60a5fa; }
+.dev-badge-comgmt { background: rgba(251,191,36,.15); color: #fbbf24; }

 /* Detail-Panel */
 .dev-detail {
Author	SHA1	Message	Date
marcoandClaude Opus 4.8	af301925e9	v0.1.35 — Settings-Catalog-Import-Fix und Update-Check hinter Proxy Build & Release MSI / build-msi (push) Canceled after 0s Details Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-09-15 17:50:27 +02:00
marcoandClaude Opus 4.8	0ae20211c7	Settings-Catalog-Import: choiceSettingCollectionValue als Array erzwingen choiceSettingCollectionValue fehlte in der Array-Key-Liste von Repair-SettingsCatalogArrays. Beim PS-5.1-JSON-Roundtrip wurde ein Ein-Element-choiceSettingCollectionValue zum Einzelobjekt entpackt, worauf Graph den Import mit 400 "Property choiceSettingCollectionValue in payload has a value that does not match schema" ablehnte (z. B. Default Defender Antivirus Policy). Jetzt analog zu group-/simpleSettingCollectionValue behandelt. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-09-15 17:49:30 +02:00
marcoandClaude Opus 4.8	de32f6201c	Update-Check: Proxy-Authentifizierung unterstützen Hinter authentifizierten Unternehmens-Proxys (NTLM/Kerberos) scheiterte der Update-Check mit HTTP 407, weil Invoke-RestMethod keine Anmeldeinformationen an den Proxy sendet. Jetzt werden die angemeldeten Windows-Credentials an den System-Proxy durchgereicht; optionaler expliziter Proxy via settings.json -> update.proxy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-09-14 10:59:02 +02:00
marcoandClaude Opus 4.8	e110763e6a	v0.1.34 — Verwaltungsart-Spalte und Autopilot-Zeitstempel Build & Release MSI / build-msi (push) Canceled after 0s Details Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-09-14 09:49:43 +02:00
marcoandClaude Opus 4.8	dfc1128f31	Geräte-Tab: Verwaltungsart-Spalte und Autopilot-Zeitstempel - Neue Spalte "Verwaltung" (Intune vs. Co-Managed) in der Geräteliste, abgeleitet aus managementAgent; farbige Badges, sortierbar, im CSV-Export und im Detail-Panel. - Detail-Panel zeigt Autopilot-Daten (Registriert, Profil zugewiesen am, letzter Kontakt) per Lookup über die Seriennummer. Ein echtes Importdatum liefert Graph nicht; verfügbar sind nur diese Zeitstempel. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-09-14 07:49:14 +02:00
marcoandClaude Opus 4.8	e4efb0ac32	v0.1.33 — Offboarding-Report und Update-Hinweis Build & Release MSI / build-msi (push) Canceled after 0s Details - Offboarding: HTML-Report pro Geraet (New-OffboardHtmlReport) + reportUrl; Dialog-Ergebnis pro Geraet gruppiert + Report-Link - Update-Check: GET /api/update/check (Gitea releases/latest, Compare-SemVer); Kopfzeilen-Badge bei neuer Version, Link zur Release-Seite; optionaler read-only Token Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-09-13 15:59:30 +02:00
marcoandClaude Opus 4.8	968f47b94f	v0.1.32 — Bulk-Offboarding aus dem Geraete-Tab, Geraete-Ladefehler behoben Build & Release MSI / build-msi (push) Canceled after 0s Details - Bulk-Offboarding aus dem Geraete-Tab (Checkboxen + Alle, POST /api/offboard/resolve) - Fix "Geraete konnten nicht geladen werden" (400): managementState raus dem $select, $orderby entfernt, Namensfilter-Fallback auf deviceName, beta-Endpoint - Bessere Graph-Fehler-Diagnose (Graph-Body an die Meldung anhaengen) - Offboard: Grund fuer nicht gefundene Autopilot-Zuordnung sichtbar (autopilotNote) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-09-11 22:08:46 +02:00