# Connect Microsoft Intune

Canonical URL: https://docs.fuse.init.inc/integrations/microsoft-intune/setup

Register a platform Entra app for Intune Graph access and complete tenant-admin consent through Init.



## Before you start [#before-you-start]

Microsoft Intune uses **admin-consent client credentials** (`oauth2_client_credentials` + `platform_oauth_app`). Customers do not paste a client secret into Connect.

**Engine operator** registers one multi-tenant Entra application for Init’s Intune pack (separate from Microsoft Teams). **Connection admin/user** supplies the customer Entra tenant UUID and a tenant admin completes consent.

You need:

* Permission to register apps in the operator Entra tenant that owns the platform Intune app.
* A Global Administrator (or Application Administrator with consent rights) in the customer Entra tenant.
* The customer Entra directory (tenant) UUID.
* The engine public base URL for the redirect URI.

## Configure the provider [#configure-the-provider]

### One-time platform Entra app (**Engine operator**) [#one-time-platform-entra-app-engine-operator]

1. In Microsoft Entra admin center, register a new **multi-tenant** application for Intune. Do not reuse the Microsoft Teams app.

2. Add a Web redirect URI:

   `{FUSE_PUBLIC_URL}/v1/oauth/microsoft_intune/callback`

3. Create a client secret for the confidential web client.

4. Under **API permissions**, add only the Microsoft Graph **application** permissions required for Init Intune actions (for example `DeviceManagementManagedDevices.Read.All` and `DeviceManagementConfiguration.Read.All`). Do not add delegated Teams scopes or unused application permissions.

5. Copy the Application (client) ID and client secret into the Fuse environment as `MICROSOFT_INTUNE_OAUTH_CLIENT_ID` and `MICROSOFT_INTUNE_OAUTH_CLIENT_SECRET`. Never commit these values.

These Intune variables are separate from Teams `MICROSOFT_OAUTH_CLIENT_ID` / `MICROSOFT_OAUTH_CLIENT_SECRET`.

### Per-tenant admin consent (**Connection admin/user**) [#per-tenant-admin-consent-connection-adminuser]

Customers authorize tenant-wide application access through Init Connect. They never submit a client secret.

## Connect to Init [#connect-to-init]

1. **Connection admin/user** starts a Microsoft Intune Connect OAuth session.
2. Supply `entra_tenant_id` on the OAuth start request (`ConnectOauthStartRequest`). This is the customer Entra tenant UUID. It is **not** a Connect credentials body field.
3. Init redirects a tenant admin to:

   `https://login.microsoftonline.com/{tenant}/v2.0/adminconsent`

   with the platform app’s client ID, the Intune callback redirect URI, and Graph scope `https://graph.microsoft.com/.default`.
4. The admin reviews and accepts the application permissions.
5. Init completes the admin-consent callback, mints an app-only token for that tenant, and stores the connection. No customer credential fields are submitted.

If Init later expands Graph application permissions on the platform app, customer tenants must re-consent (reconnect through admin consent).

## Permissions [#permissions]

Action-required Intune capability labels appear on the generated scope matrix. At the Entra layer, the platform app must already declare matching Graph **application** permissions; admin consent grants those permissions for the customer tenant via `.default`.

Only a tenant admin can complete consent. User consent is not sufficient for these application permissions.

## Verify the connection [#verify-the-connection]

1. Confirm Connect completes and Init shows an active Microsoft Intune connection for the consented tenant.
2. Run Init’s connection test or a safe read such as listing managed devices.
3. Success looks like Graph returning Intune device or policy data without `InvalidAuthenticationToken` or consent-required errors.

## Rotate or revoke access [#rotate-or-revoke-access]

* **Rotate platform client secret (Engine operator):** create a new Entra client secret, update `MICROSOFT_INTUNE_OAUTH_CLIENT_SECRET`, remove the old secret after cutover.
* **Revoke customer access (Connection admin/user):** remove the enterprise application / revoke admin consent in the customer Entra tenant, or delete the Init connection.
* After permission changes on the platform Entra app, customers must reconnect so admins re-grant consent.

## Troubleshooting [#troubleshooting]

| Symptom                         | What to check                                                                                                                 |
| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| OAuth start rejects payload     | `entra_tenant_id` is required for Intune and must be a UUID; omit it for every other provider.                                |
| `AADSTS50011` redirect mismatch | Redirect URI must exactly match `{FUSE_PUBLIC_URL}/v1/oauth/microsoft_intune/callback`.                                       |
| Admin consent denied            | Tenant admin clicked Cancel, or the signed-in account lacks consent rights.                                                   |
| Tenant mismatch on callback     | Consent must complete in the same Entra tenant UUID supplied at OAuth start.                                                  |
| `403` on Intune Graph APIs      | Application permissions missing on the platform app, or admin consent not granted for those permissions.                      |
| Engine misconfigured            | Confirm `MICROSOFT_INTUNE_OAUTH_CLIENT_ID` / `MICROSOFT_INTUNE_OAUTH_CLIENT_SECRET` (not the Teams `MICROSOFT_OAUTH_*` vars). |