Microsoft Intune

View as Markdown

Community Platform

runZero integrates with Microsoft Intune to sync and enrich your asset inventory. With your Microsoft Intune data in runZero, unmanaged assets on your network are easier to find. The import includes the discovered apps from Intune. runZero does not currently report managed apps (those Intune pushes to devices).

Getting started

To set up the Microsoft Intune integration:

  1. Configure Microsoft Intune to allow API access from runZero.

  2. Add the Microsoft Intune credential in runZero.

  3. Choose whether to run the integration as a scan probe or connector task.

  4. Activate the Microsoft Intune integration to sync your data with runZero.

Requirements

Before you set up the Microsoft Intune integration:

  • Make sure you have access to the Microsoft Azure portal.

Step 1: Register an Azure application for Microsoft Intune API access

runZero can authenticate to the Microsoft Intune API with either a username and password or a client secret. Either way, start by registering an application for Microsoft Intune API access.

  1. Sign in to the Microsoft Azure portal.

  2. Go to App registrations and click + New registration.

    • Provide a name.
    • Select the supported account types.
    • Optionally add a redirect URI.

  3. Click Register.

  4. Once the application is created, go back to the main Azure portal page and select App registrations. You should find the application you just registered (selecting the Owned applications tab may help). Click the app’s name.

  5. On the app registration overview, note the following information:

    • Application (client) ID
    • Directory (tenant) ID

  6. From the application’s details page, go to Manage > API permissions and choose + Add a permission.

  7. Select Microsoft Graph from the list of Microsoft APIs.

  8. Select the permissions type for the credential you plan to use:

    • Username & password: select Delegated permissions
    • Client secret: select Application permissions

  9. Search for and select these required permissions:

    • DeviceManagementManagedDevices.Read.All
    • User.Read.All
    • DeviceLocalCredential.ReadBasic.All (only required if you enable the Include LAPS Information option within the integration)

  10. Click Add permissions to save the permissions to the application.

  11. Click Grant admin consent to grant the application consent for those permissions.

  12. If you’re using a client secret, also do the following from the app management pages:

    • Go to App registrations and select the application you created.
    • Go to Certificates & secrets and click + New client secret.
      • Enter a description.
      • Select the expiration.
    • Click Add to create the client secret, then save the client secret value.

Step 2: Add the Microsoft Intune credential to runZero

The Microsoft Intune credential is either an Azure username and password or an Azure Client Secret.

Step 2a: Add an Azure Username & Password credential to runZero

  1. Go to the Credentials page in runZero and click Add Credential.

  2. Provide a name for the credential, like Azure User/Pass.

  3. Choose Azure Username & Password from the list of credential types.

  4. Provide the following information:

    • Azure application (client) ID: The unique ID for the registered application. To find it in the Azure portal, go to App registrations and select the application.
    • Azure directory (tenant) ID: The unique ID for the tenant. To find it in the Azure portal, go to App registrations and select the application.
    • Azure username: The username for your Azure cloud account. It can’t be a federated user account.
    • Azure password: The password for your Azure cloud account.

  5. To let other organizations use this credential, select the Make this a global credential option. Otherwise, you can configure access per organization.

  6. Save the credential.

Step 2b: Add an Azure Client Secret credential to runZero

You can use this credential type to sync all resources in a single directory (across multiple subscriptions).

  1. Go to the Credentials page in runZero and click Add Credential.

  2. Provide a name for the credential, like Azure Client Secret.

  3. Choose Azure Client Secret from the list of credential types.

  4. Provide the following information:

    • Azure application (client) ID: The unique ID for the registered application. To find it in the Azure portal, go to App registrations and select the application.
    • Azure client secret: To generate a client secret, go to App registrations, select your application, go to Manage > Certificates & secrets, and click New client secret.
    • Azure directory (tenant) ID: The unique ID for the tenant. To find it in the Azure portal, go to App registrations and select the application.

  5. To let other organizations use this credential, select the Make this a global credential option. Otherwise, you can configure access per organization.

  6. Save the credential.

Step 3: Choose how to configure the Microsoft Intune integration

You can run the Microsoft Intune integration as either a scan probe or a connector task. A scan probe gathers integration data during a scan task. A connector task runs on its own, from the cloud or from one of your Explorers, and performs only the integration sync.

Step 4: Set up and activate the Microsoft Intune integration to sync data

With your Microsoft Intune credential saved, set up a connector task or a scan probe to sync your data.

Step 4a: Configure the Microsoft Intune integration as a connector task

A connection needs a schedule and a site. The schedule sets when the sync runs, and the site is where runZero creates any new Microsoft Intune-only assets.

  1. Activate a connection to Microsoft Intune. You can reach every third-party connection from the integrations page, your inventory, or the tasks page.

  2. Choose the credential you added earlier. If it isn’t listed, make sure it has access to the organization you’re currently in.

  3. Optionally provide a filter to import only the devices that match it. See Filtering Intune assets below for details.

  4. To retrieve LAPS information from Intune, enable the Include LAPS Information option. This option has additional permission requirements; see Intune API Access above. With this option enabled, runZero does not collect passwords from LAPS.

  5. Enter a name for the task, like Microsoft Intune sync.

  6. Schedule the sync to run once or on a recurring schedule. The schedule starts on the date and time you set.

  7. Under Task configuration, choose the site to add your assets to.

  8. To leave out assets that runZero has not scanned, switch the Exclude unknown assets toggle to Yes. By default, the integration includes them.

  9. Activate the connection. The sync runs on the schedule you defined, and the Scheduled tasks page shows when the next sync will occur.

Step 4b: Configure the Microsoft Intune integration as a scan probe

  1. Create a new scan task or select a future or recurring scan task from your Tasks page.

  2. Add or update the scan parameters to fit any additional requirements.

  3. On the Probes and SNMP tab, choose any additional probes to include, set the Intune toggle to Yes, and change any default options as needed.

  4. On the Credentials tab, set the Intune toggle to Yes for the credential you want to use.

  5. Click Initialize scan to save the scan task. It runs immediately or at the scheduled time.

Step 5: View Microsoft Intune assets

After a successful sync, go to your inventory to view your Microsoft Intune assets. They show an Active Directory icon in the Source column.

To filter for Microsoft Intune assets, try these queries:

Click into an asset to see the attributes Microsoft Intune returned. To write your own queries, start with the search query syntax.

Filtering Intune assets

You can apply an optional filter to Intune integration tasks. runZero retrieves assets from the DevicesWithInventory report through the Intune reports API, which accepts a filter field to narrow the results.

Properties

The DevicesWithInventory report supports filtering on these properties:

  • CreatedDate
  • LastContact
  • CategoryName
  • CompliantState
  • ManagementAgents
  • OwnerType
  • ManagementState
  • DeviceType
  • JailBroken
  • EnrollmentType
  • PartnerFeaturesBitmask

For the current list of properties, see Microsoft’s documentation on the DevicesWithInventory report. Not every property in that table is filterable; a separate list just below the table shows the properties you can use in filters.

Operators

The Intune reports API has no official documentation of its filter syntax or supported operators. Based on our testing, the following operators may be supported. In practice, some of them, such as not and in, can produce errors, so your results may vary.

  • Equal to (eq)
  • Not equal to (ne)
  • Logical negation (not)
  • In (in)
  • Has (has)
  • Less than (lt)
  • Greater than (gt)
  • Less than or equal to (le)
  • Greater than or equal to (ge)

The syntax appears similar to the $filter query parameter used elsewhere in Microsoft Graph, and Use the $filter query parameter has examples. Test filters carefully, and start with basic operators like eq and ne for best results.

Example filters

Search Filter Description
DeviceType eq 'android' Import all Android devices
LastContact ge '2023-02-23 23:50:01.0000000' Import devices that checked in after a specific date and time

Troubleshooting

If the integration isn’t working, start with these checks.

Why is the Microsoft Intune integration unable to connect?

  1. Check whether the Microsoft Intune integration is returning any data.
    • Query the inventory rather than the task details to review all the data available from this integration.
    • In some cases, an integration’s configuration limits how much data reaches the runZero console.
  2. Some integrations require specific actions that are easy to overlook. If you miss a step during setup, the integration may not work correctly. Review this page and follow the steps exactly.
  3. If the Microsoft Intune integration can’t connect, check the task log for errors. Common errors include:
    • 500: server error, unable to connect to the endpoint
    • 404: hitting an unknown endpoint on the server
    • 403: not authorized, likely a credential issue

How do I solve the following Microsoft Intune error?

  • (invalid_client) AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'

This error means you need to enable Public Client Flows in Azure:

  1. Go to the App Registration page in the Azure portal.
  2. Choose Authentication from the left navigation.
  3. Select Advanced Settings.
  4. Toggle the Allow Public Client Flows switch at the bottom of the page to Yes.
Updated