Microsoft Intune
Endpoint Management- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Microsoft Intune connector integrates with the Microsoft Intune device management platform via the Microsoft Graph API. It synchronizes managed device inventory data, distinguishing between traditional hosts (desktops, laptops, servers) and mobile devices (phones, tablets) based on IMEI presence or operating system type (iOS, Android).
Both models share the same API endpoint (/v1.0/deviceManagement/managedDevices) and use a local KV store for caching device data. The connector fetches all managed devices with pagination, stores them in a local KV store keyed by device ID, classifies each device as Host or Mobile Device, and maps device attributes to the appropriate connector object.
Data retrieved from Microsoft Intune
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Host | Yes | Host |
| Mobile Device | Yes | Device |
Model relationships
For detailed steps on how to view the data retrieved from Microsoft Intune in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Microsoft Intune from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| API URL | Yes | https://graph.microsoft.com | Microsoft Graph API URL |
| Login URL | Yes | https://login.microsoftonline.com | Microsoft Azure authentication URL |
| Client ID | Yes | — | The service principal client ID. The client ID is generated during service principal registration. |
| Client secret | Yes | — | The service principal client secret or password. |
| Tenant ID | Yes | — | The tenant or domain the credential is authorized for. The tenant ID is generated during service principal registration. |
Authentication
Method
OAuth 2.0 Client Credentials Grant
Endpoint
| Method | URL |
|---|---|
POST | https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token |
Request Body (form-urlencoded)
| Parameter | Value |
|---|---|
grant_type | client_credentials |
client_id | {clientId} |
client_secret | {clientSecret} |
scope | https://graph.microsoft.com/.default |
Sample Response
{
"token_type": "Bearer",
"expires_in": 3599,
"ext_expires_in": 3599,
"access_token": "<access_token>"
}
Response Fields
| Field | Type | Description |
|---|---|---|
token_type | String | Used as the authorization scheme prefix (defaults to Bearer) |
expires_in | Integer | Used to calculate token expiration (in seconds) |
ext_expires_in | Integer | Deserialized from response but not used by the connector |
access_token | String | Used in the Authorization header value |
Usage
Once authenticated, all subsequent API requests include the bearer token:
Authorization: Bearer <access_token>
Sync Behavior
The connector supports both full and incremental (delta) syncs for both models:
- Incremental (delta) sync — When a sync-since timestamp (or the
lastSyncDateTimeoperation option) is present, the managed-devices query adds the$filterclauselastSyncDateTime gt {since}, so only devices that have synced since the last run are retrieved. Any customfilteroption is combined via logical AND. - Full sync — When no sync-since timestamp is set, all managed devices are retrieved.
Both the Host and Mobile Device models are derived from the same /v1.0/deviceManagement/managedDevices response (fetched once, cached, then classified), so this filter governs the sync behavior of both. Per-model incremental details are documented under each model's Sync Duration Parameter below.
How to obtain Microsoft Intune credentials
Register a Microsoft Azure application
You must create a new application for the Microsoft Intune connector to authenticate with Azure AD and access the Graph API. To register an application in your Azure AD tenant, follow these steps:
-
Log in to your Microsoft Azure Portal as an administrator.
-
Navigate to and click Microsoft Entra ID.
-
On the left-hand side of the page, click App registrations, and then click New registration.
-
Give your new application a name, select the supported account types, and provide an optional Redirect URI. If you do not have a redirect URI, you can leave the field as is.
-
Click Register.
Note: For additional details about registering an application in Azure AD and creating a service principal, see Microsoft Azure documentation.
Obtain Microsoft Azure credentials
After you have created your new Microsoft Azure application, your client and tenant ID display. Copy the Application (client) ID and Directory (tenant) ID as shown below:
To obtain your client secret, follow these steps:
-
Click Certificates & secrets and then click New client secret.
-
Provide a description, set an expiry date, and then click Add.
The new client secret displays. You cannot view the client secret again. There is both a Value and Secret ID. The Value field is needed for authentication. Copy the Value field and save it in a secure location.
Assign permissions
After you have created your new Microsoft Azure application and obtained the authentication credentials, you must assign the required permissions for the application to access your data. To do so, follow these steps:
-
Navigate to API permissions > Add a permission > Microsoft Graph.
-
Click Application permissions, grant the following permissions, and then click Add permissions.
-
Directory:
Directory.Read.All -
User:
User.Read.All
-
-
Click Add a permission and repeat the same steps for Delegated permissions. Grant the following permissions and click Add permissions.
-
Device:
Device.Read.All -
DeviceManagementApps:
DeviceManagementApps.Read.All -
DeviceManagementConfiguration:
DeviceManagementConfiguration.Read.All -
DeviceManagementManagedDevices:
DeviceManagementManagedDevices.Read.All -
DeviceManagementRBAC:
DeviceManagementRBAC.Read.All -
DeviceManagementServiceConfig:
DeviceManagementServiceConfig.Read.All -
Directory:
Directory.Read.All -
User:
User.Read.All
-
-
Click Grant admin consent for default directory, and then click Yes in the confirmation dialog. Your API permissions should resemble the following:
Note: For additional information about Azure AD permissions, see Microsoft Azure documentation.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Host
| Source Field Name | SDM Attribute |
|---|---|
activationLockBypassCode | ACTIVATION_LOCAL_BY_PASSCODE |
androidSecurityPatchLevel | ANDROID_SECURITY_PATCH_LEVEL |
azureADDeviceId | AAD_DEVICE_ID |
azureADRegistered | AZURE_AD_REGISTERED |
complianceGracePeriodExpirationDateTime | COMPLIANCE_GRACE_PERIOD_EXPIRATION_DATE |
complianceState | COMPLIANCE_STATE |
deviceCategoryDisplayName | DEVICE_CATEGORY_DISPLAY_NAME |
deviceEnrollmentType | DEVICE_ENROLLMENT_TYPE |
deviceName | NAME |
deviceName (lowercased) | HOSTNAMES |
deviceRegistrationState | DEVICE_REGISTRATION_STATE |
easActivated | EAS_ACTIVATED |
easActivationDateTime | EAS_ACTIVATION_DATE |
easDeviceId | EAS_DEVICE_ID |
emailAddress | |
enrolledDateTime | FIRST_SEEN |
| ethernetMacAddress, wiFiMacAddress | MAC_ADDRESSES |
exchangeAccessStateReason | EXCHANGE_ACCESS_STATE_REASON |
exchangeLastSuccessfulSyncDateTime | EXCHANGE_LAST_SUCCESSFUL_SYNC |
freeStorageSpaceInBytes | FREE_STORAGE_SPACE_IN_BYTES |
iccid | ICCID |
id | UID |
isEncrypted | IS_ENCRYPTED |
isSupervised | IS_SUPERVISED |
jailBroken | JAIL_BROKEN |
lastSyncDateTime | LAST_SEEN |
managedDeviceName | INTUNE_DISPLAY_NAME |
managedDeviceOwnerType | OWNER_TYPE |
managementAgent | MANAGEMENT_AGENT |
meid | MEID |
model | MODEL |
notes | NOTES |
| operatingSystem + osVersion | OPERATING_SYSTEM |
partnerReportedThreatState | PARTNER_REPORTED_THREAT_STATE |
phoneNumber | PHONE_NUMBER |
physicalMemoryInBytes | PHYSICAL_MEMORY_IN_BYTES |
serialNumber | SERIAL_NUMBER |
subscriberCarrier | SUBSCRIBER_CARRIER |
totalStorageSpaceInBytes | TOTAL_STORAGE_SPACE_IN_BYTES |
udid | UDID |
userDisplayName | USER_DISPLAY_NAME |
userId | USER_ID |
| — | CATEGORIES |
Mobile Device
| Source Field Name | SDM Attribute |
|---|---|
activationLockBypassCode | ACTIVATION_LOCAL_BY_PASSCODE |
androidSecurityPatchLevel | ANDROID_SECURITY_PATCH_LEVEL |
azureADDeviceId | AAD_DEVICE_ID |
azureADRegistered | AZURE_AD_REGISTERED |
complianceGracePeriodExpirationDateTime | COMPLIANCE_GRACE_PERIOD_EXPIRATION_DATE |
complianceState | COMPLIANCE_STATE |
deviceCategoryDisplayName | DEVICE_CATEGORY_DISPLAY_NAME |
deviceEnrollmentType | DEVICE_ENROLLMENT_TYPE |
deviceName | NAME |
deviceRegistrationState | DEVICE_REGISTRATION_STATE |
easActivated | EAS_ACTIVATED |
easActivationDateTime | EAS_ACTIVATION_DATE |
easDeviceId | EAS_DEVICE_ID |
emailAddress | |
enrolledDateTime | FIRST_SEEN |
| ethernetMacAddress, wiFiMacAddress | MAC_ADDRESSES |
exchangeAccessStateReason | EXCHANGE_ACCESS_STATE_REASON |
exchangeLastSuccessfulSyncDateTime | EXCHANGE_LAST_SUCCESSFUL_SYNC |
freeStorageSpaceInBytes | FREE_STORAGE_SPACE_IN_BYTES |
iccid | ICCID |
id | UID |
imei | IMEI |
isEncrypted | IS_ENCRYPTED |
isSupervised | IS_SUPERVISED |
jailBroken | JAIL_BROKEN |
lastSyncDateTime | LAST_SEEN |
managedDeviceName | INTUNE_DISPLAY_NAME |
managedDeviceOwnerType | OWNER_TYPE |
managementAgent | MANAGEMENT_AGENT |
manufacturer | MANUFACTURER |
meid | MEID |
model | MODEL |
notes | NOTES |
| operatingSystem + osVersion | OPERATING_SYSTEM |
partnerReportedThreatState | PARTNER_REPORTED_THREAT_STATE |
phoneNumber | PHONE_NUMBER |
physicalMemoryInBytes | PHYSICAL_MEMORY_IN_BYTES |
serialNumber | SERIAL_NUMBER |
subscriberCarrier | SUBSCRIBER_CARRIER |
totalStorageSpaceInBytes | TOTAL_STORAGE_SPACE_IN_BYTES |
udid | UDID |
userDisplayName | USER_DISPLAY_NAME |
userId | USER_ID |
| — | CATEGORIES |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Host
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
filter | String | Custom OData $filter expression appended to the query | |
lastSyncDateTime | String | Overrides the since parameter for delta sync filtering |
Delta sync
Not supported. The connector performs a full sync of Host on every run and applies no incremental date filter.
API
- Type: REST — Microsoft Graph API (
v1.0) · Endpoint:GET /v1.0/deviceManagement/managedDevices
Mobile Device
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
filter | String | Custom OData $filter expression appended to the query | |
lastSyncDateTime | String | Overrides the since parameter for delta sync filtering |
Delta sync
Not supported. The connector performs a full sync of Mobile Device on every run and applies no incremental date filter.
API
- Type: REST — Microsoft Graph API (
v1.0) · Endpoint:GET /v1.0/deviceManagement/managedDevices
Changelog
The Microsoft Intune connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.5.9 | No changes in this release. | N/A |
| 3.5.8 | No changes in this release. | N/A |
| 3.5.7 | No changes in this release. | N/A |
| 3.5.6 | No changes in this release. | N/A |
| 3.5.5 | No changes in this release. | N/A |
| 3.5.4 | No changes in this release. | N/A |
| 3.5.3 | No changes in this release. | N/A |
| 3.5.2 | No changes in this release. | N/A |
| 3.5.1 | Bug Fixes - Intune connector now works with Microsoft national cloud endpoints — The authentication scope is now derived from the configured Graph API URL instead of being hardcoded to graph.microsoft.com. This resolves "Access token validation failure. Invalid audience." errors when using the connector with non-commercial clouds (e.g., graph.microsoft.us). | N/A |
| 3.5.0 | No changes in this release. | N/A |
| 3.4.32 | No changes in this release. | N/A |
| 3.4.31 | No changes in this release. | N/A |
| 3.4.30 | No changes in this release. | N/A |
| 3.4.29 | No changes in this release. | N/A |
| 3.4.28 | No changes in this release. | N/A |
| 3.4.27 | No changes in this release. | N/A |
| 3.4.26 | No changes in this release. | N/A |
| 3.4.25 | No changes in this release. | N/A |
| 3.4.24 | No changes in this release. | N/A |
| 3.4.23 | No changes in this release. | N/A |
| 3.4.22 | No changes in this release. | N/A |
| 3.4.21 | No changes in this release. | N/A |
| 3.4.20 | No changes in this release. | N/A |
| 3.4.19 | No changes in this release. | N/A |
| 3.4.18 | No changes in this release. | N/A |
| 3.4.17 | No changes in this release. | N/A |
| 3.4.16 | No changes in this release. | N/A |
| 3.4.15 | No changes in this release. | N/A |
| 3.4.14 | No changes in this release. | N/A |
| 3.4.13 | No changes in this release. | N/A |
| 3.4.12 | No changes in this release. | N/A |
| 3.4.11 | No changes in this release. | N/A |
| 3.4.10 | No changes in this release. | N/A |
| 3.4.9 | No changes in this release. | N/A |
| 3.4.8 | Bug Fixes - Device pages are no longer dropped during large syncs — Pagination now follows the NextLink continuation token returned by the Microsoft Graph API, ensuring every page of managed devices is retrieved when a tenant returns results across many pages. | N/A |
| 3.4.7 | No changes in this release. | N/A |
| 3.4.6 | No changes in this release. | N/A |
| 3.4.5 | No changes in this release. | N/A |
| 3.4.4 | No changes in this release. | N/A |
| 3.4.3 | No changes in this release. | N/A |
| 3.4.2 | No changes in this release. | N/A |
| 3.4.1 | New Features - Inactive device lifecycle management — Host and Mobile Device assets are now automatically marked inactive when they have not been seen for 30 days, based on their last-seen timestamp. This keeps your inventory aligned with devices that are still actively checking in. | N/A |
| 3.4.0 | No changes in this release. | N/A |
| 3.3.10 | No changes in this release. | N/A |
| 3.3.9 | No changes in this release. | N/A |
| 3.3.8 | No changes in this release. | N/A |
| 3.3.7 | No changes in this release. | N/A |
| 3.3.6 | No changes in this release. | N/A |
| 3.3.5 | No changes in this release. | N/A |
| 3.3.4 | No changes in this release. | N/A |
| 3.3.3 | No changes in this release. | N/A |
| 3.3.2 | No changes in this release. | N/A |
| 3.3.1 | No changes in this release. | N/A |
| 3.3.0 | No changes in this release. | N/A |
| 3.2.2 | No changes in this release. | N/A |
| 3.2.1 | No changes in this release. | N/A |
| 3.2.0 | No changes in this release. | N/A |
| 3.1.18 | No changes in this release. | N/A |
| 3.1.17 | No changes in this release. | N/A |
| 3.1.16 | No changes in this release. | N/A |
| 3.1.15 | No changes in this release. | N/A |
| 3.1.14 | No changes in this release. | N/A |
| 3.1.13 | No changes in this release. | N/A |
| 3.1.12 | Dependency Upgrades - Upgraded the embedded local storage engine used to stage managed-device data during synchronization, improving sync stability for large tenants. | N/A |
| 3.1.11 | No changes in this release. | N/A |
| 3.1.9 | No changes in this release. | N/A |
| 3.1.8 | No changes in this release. | N/A |
| 3.1.7 | Improvements - More resilient synchronization — The connector now retries transient Microsoft Graph API errors more persistently before failing a sync, reducing intermittent sync failures caused by temporary throttling or service hiccups. | N/A |
| 3.1.6 | Bug Fixes - Placeholder Azure AD device IDs are no longer imported — Devices that report an empty Azure AD device ID ( 00000000-0000-0000-0000-000000000000) no longer have that placeholder value stored, preventing spurious correlation across unrelated devices. | N/A |
| 3.1.5 | Bug Fixes - Fixed a synchronization failure when no filter is supplied — Incremental synchronization no longer fails when the connector is run without an explicit filter option. | N/A |
| 3.1.4 | Improvements - Incremental synchronization — Device syncs can now retrieve only records changed since the last run, using the device last-sync timestamp, reducing sync time on subsequent runs. | N/A |
| 3.1.3 | No changes in this release. | N/A |
| 3.1.2 | No changes in this release. | N/A |
| 3.1.1 | No changes in this release. | N/A |
| 3.1.0 | No changes in this release. | N/A |
| 3.0.3 | Improvements - Clearer authentication error reporting — Sign-in failures now surface the underlying Microsoft error details (error code, description, and correlation ID), making it easier to diagnose credential or tenant configuration problems. | N/A |
| 3.0.2 | Improvements - Removed an unused internal identifier attribute — The redundant system-ID attribute previously emitted on Host and Mobile Device assets has been removed, leaving the standard UID as the identifier. | N/A |
| 3.0.1 | New Features - Consolidated MAC addresses — Wi-Fi and Ethernet MAC addresses are now normalized and combined into a single MAC Addresses attribute on Host and Mobile Device assets, and used as a correlation identifier. - Hostname correlation for Host assets — Host assets now populate a normalized hostname identifier derived from the device name. - Additional device details — Manufacturer and IMEI are now populated on Mobile Device assets. | • Host: MAC Addresses and Hostname are now correlation identifiers, and Wi-Fi/Ethernet MAC values are re-keyed under the consolidated MAC Addresses attribute — Action: re-sync. • Mobile Device: MAC Addresses is now a correlation identifier, and Wi-Fi/Ethernet MAC values are re-keyed under the consolidated MAC Addresses attribute — Action: re-sync. |
| 3.0.0 | Overview The Intune connector integrates with Microsoft Intune (via the Microsoft Graph API) to synchronize managed device inventory, including both traditional hosts and mobile devices. Category: Endpoint Management Models | N/A |