Connect Microsoft Intune

Agent markdown

Before you start

Microsoft Intune uses admin-consent client credentials (oauth2_client_credentials + platform_oauth_app). Customers do not paste a client secret into Connect.

Engine operator registers one multi-tenant Entra application for Init’s Intune pack (separate from Microsoft Teams). Connection admin/user supplies the customer Entra tenant UUID and a tenant admin completes consent.

You need:

• Permission to register apps in the operator Entra tenant that owns the platform Intune app.
• A Global Administrator (or Application Administrator with consent rights) in the customer Entra tenant.
• The customer Entra directory (tenant) UUID.
• The engine public base URL for the redirect URI.

Configure the provider

One-time platform Entra app (Engine operator)

1. In Microsoft Entra admin center, register a new multi-tenant application for Intune. Do not reuse the Microsoft Teams app.

2. Add a Web redirect URI:

   {FUSE_PUBLIC_URL}/v1/oauth/microsoft_intune/callback

3. Create a client secret for the confidential web client.

4. Under API permissions, add only the Microsoft Graph application permissions required for Init Intune actions (for example DeviceManagementManagedDevices.Read.All and DeviceManagementConfiguration.Read.All). Do not add delegated Teams scopes or unused application permissions.

5. Copy the Application (client) ID and client secret into the Fuse environment as MICROSOFT_INTUNE_OAUTH_CLIENT_ID and MICROSOFT_INTUNE_OAUTH_CLIENT_SECRET. Never commit these values.

These Intune variables are separate from Teams MICROSOFT_OAUTH_CLIENT_ID / MICROSOFT_OAUTH_CLIENT_SECRET.

Per-tenant admin consent (Connection admin/user)

Customers authorize tenant-wide application access through Init Connect. They never submit a client secret.

Connect to Init

1. Connection admin/user starts a Microsoft Intune Connect OAuth session.

2. Supply entra_tenant_id on the OAuth start request (ConnectOauthStartRequest). This is the customer Entra tenant UUID. It is not a Connect credentials body field.

3. Init redirects a tenant admin to:

   https://login.microsoftonline.com/{tenant}/v2.0/adminconsent

   with the platform app’s client ID, the Intune callback redirect URI, and Graph scope https://graph.microsoft.com/.default.

4. The admin reviews and accepts the application permissions.

5. Init completes the admin-consent callback, mints an app-only token for that tenant, and stores the connection. No customer credential fields are submitted.

If Init later expands Graph application permissions on the platform app, customer tenants must re-consent (reconnect through admin consent).

Permissions

Action-required Intune capability labels appear on the generated scope matrix. At the Entra layer, the platform app must already declare matching Graph application permissions; admin consent grants those permissions for the customer tenant via .default.

Only a tenant admin can complete consent. User consent is not sufficient for these application permissions.

Verify the connection

1. Confirm Connect completes and Init shows an active Microsoft Intune connection for the consented tenant.
2. Run Init’s connection test or a safe read such as listing managed devices.
3. Success looks like Graph returning Intune device or policy data without InvalidAuthenticationToken or consent-required errors.

Rotate or revoke access

• Rotate platform client secret (Engine operator): create a new Entra client secret, update MICROSOFT_INTUNE_OAUTH_CLIENT_SECRET, remove the old secret after cutover.
• Revoke customer access (Connection admin/user): remove the enterprise application / revoke admin consent in the customer Entra tenant, or delete the Init connection.
• After permission changes on the platform Entra app, customers must reconnect so admins re-grant consent.

Troubleshooting