Microsoft Intune

Overview

Microsoft Intune is the cloud endpoint management service in Microsoft’s Intune suite, used to enrol and manage Windows PCs, Macs, iOS and Android devices. It holds the enrolled device record (hardware identifiers, operating system version, compliance state, enrolment type, assigned user), the application catalogue and its assignments, and, on Windows, the Defender protection state. Intune is addressed through the Microsoft Graph API, the same API surface that serves Entra ID, so an Intune connection also reaches directory users and groups.

The ReadyWorks connector calls Microsoft Graph directly. It requests an application-level access token from the Microsoft identity platform using the client credentials grant with the .default scope, reads the token from the access_token node, and sends it as Authorization: Bearer on the data calls with Content-Type: application/json. Each job then calls a Graph endpoint, reads the value array, and writes it to its own staging table. Every job that pages uses Graph’s own paging model, following the @odata.nextLink URL until it runs out.

Six of the eleven jobs enumerate. They first call a collection endpoint (all users, all groups, all managed devices, all mobile apps), collect the id of each record, and then make one call per record to fetch its detail. That is how per-device detected applications, per-device hardware, per-group membership and per-app assignment data is assembled. The call volume of those jobs scales with the size of your estate.

In a ReadyWorks context this gives you the managed device estate, the people the devices belong to, the group structure that drives Intune policy and application targeting, and the installed and assigned software. That supports device refresh planning, OS upgrade waves, application rationalisation, and reconciliation of the Intune device list against other sources such as the network, the asset register or an Apple management platform.

Direction: the connector is registered as bidirectional. The only outbound template shipped is a blank generic REST POST scaffold with no endpoint set, so in practice this connector reads from Intune and Entra ID, and the outbound side is a starting point for a write-back job you build yourself.

Connector Properties

Authentication Methods

The connector ships two authentication methods, both of which acquire a Microsoft Graph application token through the client credentials grant. They differ only in what proves the application’s identity: a client secret or a certificate.

NOTE: Both methods need an Entra ID app registration with application permissions granted, rather than delegated permissions, and admin consent given. The shipped jobs need read access to users, groups, managed devices and mobile app data.

NOTE: Both methods are flagged as the default method for the connector. Check which one is preselected when you create a connection rather than assuming.

Method 1: MS Graph Authentication (INTUNE_ms_graph)

Connect to Intune using MS Graph API

The client secret method. You supply the directory (tenant) identifier, the application (client) identifier and a client secret from the Entra ID app registration. The connector posts those to the tenant’s OAuth 2.0 token endpoint with grant_type=client_credentials and scope=https://graph.microsoft.com/.default, and uses the returned access token as a bearer token. The tenant identifier is substituted into the OAuth URI, so the default endpoint value works unchanged for any tenant. Use this method when it is acceptable to store and rotate a secret.

Connection Configuration Fields (9)

Authentication Configuration

Headers sent on the authentication call:

Headers sent on the data calls:

Authentication request body:

cURL options:

Method 2: MS Graph Certificate Based Authentication (INTUNE_4d3c234ce2)

Connect to an Intune using MS Graph API with Certificate

The certificate method. Instead of a client secret, you upload the public certificate and the matching private key registered against the app registration. The MS_GRAPH_JWT authentication flag tells the engine to build and sign a JWT client assertion from that key pair and send it in place of a secret. The same tenant identifier and application identifier fields are used, and the token is acquired from the same OAuth endpoint. Use this method where certificate-based application credentials are required by policy, or where you want a credential lifetime measured in years rather than months.

Connection Configuration Fields (10)

Authentication Configuration

Headers sent on the authentication call:

Headers sent on the data calls:

Authentication request body:

cURL options:

NOTE: Public Certificate and Private Key are both marked optional on this form, but the JWT client assertion cannot be built without them. A connection saved without both will fail at the token request.

NOTE: The certificate you upload must be the one registered on the Entra ID app registration, and the private key must match it. The token request fails with an identity platform error rather than a ReadyWorks error if it does not.

Inbound Job Fields Enabled (44)

Inbound jobs expose the full REST job form, including Graph paging through the pagination group and the three enumeration levels that the per-device and per-group jobs depend on.

Outbound Job Fields Enabled (13)

The outbound job form is fully enabled, which is what lets you turn the shipped REST POST scaffold into a real write-back job.

Inbound Job Templates (11)

Eleven inbound templates ship, covering directory users and groups, the managed device estate, the application catalogue and its assignments, and Windows protection state. Nine call named Graph endpoints and two are blank scaffolds for jobs you write yourself. All eleven ship disabled.

Job Template Configuration

Settings Common to All Eleven Templates

Settings That Vary by Template

Settings That Vary by Template (continued)

Job Parameters and Enumeration

Users

API data parameters:

$select:

id,displayName,givenName,mail,surname,userPrincipalName,businessPhones,city,companyName,country,department,employeeId,faxNumber,jobTitle,mailNickname,mobilePhone,officeLocation,onPremisesExtensionAttributes,onPremisesDistinguishedName,onPremisesDomainName,onPremisesImmutableId,onPremisesUserPrincipalName,otherMails,postalCode,state,streetAddress,usageLocation,userType

User Registered Devices

Enumeration 1 fields:

Group Members

API data parameters:

Enumeration 1 fields:

Detected Apps

Enumeration 1 fields:

Managed Applications Assignments

Enumeration 1 fields:

Managed Devices Hardware

API data parameters:

$select:

id,userId,deviceName,ownerType,managedDeviceOwnerType,managementState,enrolledDateTime,lastSyncDateTime,chassisType,operatingSystem,deviceType,complianceState,managementAgent,osVersion,easActivated,easDeviceId,easActivationDateTime,aadRegistered,azureADRegistered,deviceEnrollmentType,lostModeState,activationLockBypassCode,emailAddress,azureActiveDirectoryDeviceId,azureADDeviceId,deviceRegistrationState,deviceCategoryDisplayName,isSupervised,isEncrypted,userPrincipalName,model,manufacturer,complianceGracePeriodExpirationDateTime,serialNumber,userDisplayName,wiFiMacAddress,deviceHealthAttestationState,totalStorageSpaceInBytes,freeStorageSpaceInBytes,managedDeviceName,partnerReportedThreatState,retireAfterDateTime,autoPilotEnrolled,managementCertificateExpirationDate,windowsActiveMalwareCount,windowsRemediatedMalwareCount,notes,ethernetMacAddress,physicalMemoryInBytes,processorArchitecture,specificationVersion,joinType,skuFamily,skuNumber,managementFeatures,enrollmentProfileName,bootstrapTokenEscrowed,deviceFirmwareConfigurationInterfaceManaged

Enumeration 1 fields:

Protection State

Enumeration 1 fields:

NOTE: All eleven templates ship with Enabled set to No. Enable the ones you need after you have confirmed the app registration permissions are in place.

NOTE: Six templates enumerate: they make one call per user, group, device or application. On a large tenant that is thousands of Graph calls per run, which interacts with both the Graph throttling limits and the Single Authentication setting on the connection.

NOTE: Four templates call beta Graph endpoints. Microsoft does not support beta endpoints for production workloads and can change their shape without notice, so treat the data those jobs return as subject to change between Graph releases.

Outbound Job Templates (1)

One outbound template ships, and it is a generic scaffold rather than a working job.

Job Template Configuration

Settings

Job Parameters and Enumeration

Rest POST API

Outbound fields list:

Return data fields:

NOTE: This template ships disabled and has no endpoint set. It will not do anything until you supply an API End Point, the method and the outbound field list your target endpoint expects.