Connect Microsoft Intune

Microsoft Intune becomes a device inventory in your CMDB, a set of reads an agent can use on a ticket, and a set of actions a person approves before they run. All three ride one app registration, the same one you may already use for Microsoft Entra.

Goal

Sync your managed devices into FlowLakes, let an agent look one up on a ticket, and decide which device actions a technician may approve.

Before you start

You need:

• An Entra app registration with client credentials (client id, client secret). If you already connected Microsoft Entra, this is the same app registration: one registration, with permissions added as you need them.
• The token URL, in the form https://login.microsoftonline.com/<your tenant id>/oauth2/v2.0/token. The scope field is optional: leave it blank and FlowLakes defaults it to https://graph.microsoft.com/.default for this token URL; it never defaults a scope for any other provider’s token URL.
• Permission to add Graph application permissions to that app registration in Entra, and an admin who can consent to them.
• platform.discovery.write, to create the discovery source, and platform.external.config.write, to create the intune connection and install the Intune Door package.

Grant the Graph permissions

Grant each permission only for what you intend to use. Every permission below is an application permission (not delegated), and every one needs admin consent in Entra.

You want	Permission to grant
Sync managed devices into the CMDB	DeviceManagementManagedDevices.Read.All
Let an agent read device detail, detected apps	DeviceManagementManagedDevices.Read.All
Let an agent read compliance, configuration state, remediation scripts	DeviceManagementConfiguration.Read.All
Let an agent read the app catalogue and install status	DeviceManagementApps.Read.All
Approve sync, defender scan, reboot, remote lock, and (once you enable them) retire and wipe	DeviceManagementManagedDevices.PrivilegedOperations.All
Approve a remediation script assignment	DeviceManagementConfiguration.ReadWrite.All
Approve an app assignment	DeviceManagementApps.ReadWrite.All

A tenant that only wants inventory needs just the first permission. Add the rest as you turn on reads, then the write door.

Sync devices into the CMDB

1. Open Assets & Discovery, Sources and choose Add a source.
2. Pick Microsoft Intune. Give it a name, and bind the credential holding your client id, client secret and token URL. The wizard asks for nothing else: the credential is the one source for the client id, never a second field on the source itself.
3. Select Test Connection to confirm the credential and the DeviceManagementManagedDevices.Read.All permission before you save, rather than finding out on the first scheduled run.
4. Under What to sync, leave Managed devices selected. Set a schedule, the same as any other cloud source.
5. Select Create Source, then Sync Now.

You know it worked when the source’s last run shows devices landed, and your devices appear in Assets & Discovery, Inventory as configuration items, classified by operating system: Windows, macOS and Linux devices as hosts, iOS, iPadOS and Android devices as end user devices. A device’s identity across sources is its serial number first, so a laptop your on-prem agent already found and the same laptop from Intune merge into one record rather than landing twice.

Each synced device carries its vendor and model from Intune. The device’s owner also fills in when the enrolled user’s principal name matches a person in your tenant by email; when it does not match anyone, the owner field is simply left blank, never guessed.

Detected apps, on their own schedule

Detected apps run as a second source rather than on every device sync: one pass over the tenant’s app catalogue, then each app’s own list of reporting devices, not one call per device (Microsoft Graph’s v1.0 API has no per-device detected-apps read; it is app-centric).

1. Add a second Intune source with the same credential.
2. Under What to sync, select Detected apps instead of Managed devices.
3. Set its schedule to once a day.

Let an agent read devices

1. Open the full connections editor (/admin/connections/full) and choose Add instance under Graph Query.
2. Create a named graph_query row called intune, bound to the same credential.
3. Turn it on.
4. On the agent you want this to reach, grant it the intune_query tool, the same way you grant entra_query. A tool is not implied by the connection existing; an agent that does not hold it cannot read Intune even once the row above is on.

This row is never created for you: an agent has nothing to read from Intune until you create it. Once it is on and an agent holds intune_query, that agent can look up a device by id, search by a user’s name, serial number, device name, compliance state or operating system, read the detected-apps catalogue, and read a device’s compliance and configuration state. Every one of these is a read: nothing here changes a device. A device’s user name and user principal name are masked to the model and shown to the person, the same as every other directory lookup; the device’s own fields (name, serial, compliance state, last sync) are not masked.

Two reads Intune exposes only through its beta API are refused by name rather than called: per-device remediation script results and per-app install status. Read the device’s general compliance state instead for the first; nothing in this platform substitutes for the second today.

If the app registration is missing a permission a read needs, the read fails with a named 403 naming the missing permission, never a quiet empty result.

Decide what a person may approve

Device changes are never a model’s direct call. An agent proposes a step, naming the device and the action; a person approves it; only then does FlowLakes carry it out and read the result back.

1. Open the blueprint marketplace (where you installed other door packages) and install Intune Door if it is not already installed. It arrives disabled, with no credential.

2. On the full connections editor (/admin/connections/full), bind the credential to the microsoft-graph-intune-write connection, turn it on, and move its posture from Observe to Assist. At Observe an agent can only record what it would change; no device action can be planned.

3. Review the operations and their risk grade:

   Operation	Risk	What it does
   Sync device	Low	Asks the device to check in and report its latest state
   Windows Defender scan	Low	Starts a Defender scan on a Windows device
   Reboot now	Medium	Restarts the device immediately, no warning to the person at it
   Remote lock	Medium	Locks the device; the person needs their passcode to get back in
   Assign an app	Medium	Replaces the app’s device or group assignments
   Retire	High	Removes company data and the management relationship
   Wipe	High	Resets the device to factory settings

   Assigning a remediation script is not offered: Graph’s v1.0 API has no stable way to confirm the assignment landed, and this platform does not call its beta API. Use Intune’s own admin center for that one action.

4. Retire and wipe ship disabled. If you want a technician to be able to approve either, turn it on by name for this connection; nothing else enables it.

5. Set who signs off on each risk level under Approval Policies, or keep the platform default (your tenant’s administrators).

You know approvals are working when a proposed restart shows up for a technician to approve, and the run’s audit trail names the tenant, device, approver and operation once it executes.

Bulk actions

A technician can ask for one approved operation across several devices in one plan rather than one plan per device. How many devices one plan may change is set by the connection’s posture: at most 5 at Assist and 10 at Trusted, and at most 50 or 200 changes through the connection in any 24 hours. A larger request is refused when it is proposed, with the reason, so nobody approves a change set they cannot review. For a larger estate, propose the most important devices first and the rest in follow-up plans.

The platform also carries a paced bulk runner for very large batches (paced against fanout_calls_per_minute on the connection, cancellable, one recorded outcome per device, a refused device recorded and the run continuing). It is not reachable from a plan today, because the posture limits above refuse any plan of that size. High-risk operations (retire, wipe) are never offered in bulk, approved or not.

Licence add-ons you may need

Everything above assumes your tenant holds Intune Plan 1 (or a Microsoft 365 or Business Premium plan that includes it). Two further Microsoft add-ons sit outside FlowLakes and outside this guide, but are worth checking before you promise a customer or a team the whole picture:

• Enterprise App Management, if you plan to publish from Intune’s app catalogue rather than only assign apps you already manage.
• Remote Help, Microsoft’s own remote assistance tool. FlowLakes does not offer remote control of a device; if your technicians need to see or drive a user’s screen, Remote Help (or your existing remote tool) is the answer, not this connection.

Not in this guide

Real-time alerting, a native endpoint agent, Windows Server and Linux fleets, FlowLakes-authored compliance policy, remote control, and backup are not part of what this connection does. They are planned as a later phase, not ruled out.

Troubleshooting

Symptom	Likely cause	Fix
Sync Now finishes but the source shows no devices landed	The app registration is missing DeviceManagementManagedDevices.Read.All, or admin consent was never granted	Add the permission in Entra, grant admin consent, run the sync again
An agent says the Intune read is not available	The named intune graph_query connection has not been created or is off, or the agent was never granted the intune_query tool	Create and enable the connection under the full connections editor, and grant the agent the tool
A read fails with a named 403	The app registration is missing the application permission that read needs	Add the named permission in Entra, grant admin consent, try again
A proposed restart or scan never reaches an approver	No approval policy resolves for that risk level	Set an approver under Approval Policies, or confirm the platform default ladder covers your tenant
Retire or wipe is refused as disabled	The two high-risk operations ship off by design	Turn the operation on by name for the connection if you want it available
A plan for many devices is refused when proposed	It changes more devices than the connection’s posture allows in one plan	Split it: the most important devices now, the rest in follow-up plans

How it connects

• Devices land through the same discovery pipeline every cloud source uses: CMDB and discovery.
• What an agent may read and propose through a connection, and how approvals and risk grades work generally: External capabilities.
• Store the client secret in the credential store.