About

Microsoft Intune is a cloud-based management solution that provides for mobile device and operating system management. It provides Unified Endpoint Management of both corporate and BYOD equipment.

Why You Should Integrate

Integrating with a cloud-based management solution like Microsoft Intune will provide visibility and device presence awareness for an environment.

How Does the Integration Work

This integration pulls computer objects from Intune that belong to the inventory of devices accessing organization resources, using the Microsoft Graph API. Both the Microsoft public cloud and the US Government (GCC High) cloud are supported.

This data is only used internally; we do not share it with any parties outside of Arctic Wolf Networks. Refer to our privacy policy for details.

Configuration

Choose a Schema: A schema is a configuration template that defines a specific way to connect, authenticate, and interact with a source. The following are the available schemas
- OAuth2: Will retrieve devices using OAuth2 authentication. Note: OAuth2 will require re-authentication every 90 days, requiring you to edit and re-activate the source.
- Client ID/Secret: Will retrieve computer objects using a client ID/secret from a Microsoft Entra ID (formerly Azure AD) app registration. Customers in the US Government (GCC High) cloud should choose the schema that includes the Intune Region and select gov_cloud_l4.
Configure plugin: Configure the plugin with the required fields.

OAuth2

Client ID/Secret

Field	Description	Example
`Client ID`*	The unique ID of the app created for access.	`00000000-0000-0000-0000-000000000000`
`Client Secret`*	The value of the app secret is used to authenticate with the source.	`***********************`
`Domain`*	The fully qualified domain of your tenant, used to access the source.	`your-domain.com`
`Intune Region`	The Microsoft cloud your tenant resides in. Select `public` for the Microsoft public cloud (default) or `gov_cloud_l4` for the US Government (GCC High) cloud.	`public`

Configure Name: OPTIONAL: You can give the configuration a name to provide an identifiable attribute of the configuration to delineate other similar configurations.
Activate Config: To enable this configuration and begin pulling data select "Activate". If you wish to save the configuration to come back later to finish, select "Save Draft". This will save the configuration, but keep it disabled until Activated.

Source Documentation

Creating credentials

OAuth2

Use an existing Microsoft Entra ID account with admin permissions authorized to grant the permissions defined in the Required Permissions section below.

Client ID/Secret

You'll be asked to provide a client secret that will be used to connect to Microsoft Intune. This will require the creation of an app registration in Microsoft Entra ID in order to provide API-based access. The following link will step you through creating one, How to use Microsoft Entra ID to access the Intune APIs in Microsoft Graph
NOTE: Ensure to input the App Secret Value, not the ID when configuring the plugin.

Required Permissions

OAuth2

The OAuth authentication flow will ask the user to authorize access by requesting the following Microsoft Graph permission

DeviceManagementManagedDevices.Read.All

Client ID/Secret

The following permission types are required to call this API:

Permission type	Permissions
Application	DeviceManagementManagedDevices.Read.All

The permission must be granted admin consent in Microsoft Entra ID for the app registration.

API Documentation

https://learn.microsoft.com/en-us/graph/api/intune-devices-manageddevice-list?view=graph-rest-1.0

Contact Us

If you're having problems configuring an Integration, or if you've found something wrong in this document, please email us at [email protected].

Tags: cloud, epp-edr