Skip to main content

Microsoft Intune Connector Configuration Guide for ASCERA

The Microsoft Intune connector allows ASCERA to retrieve managed device data from your Intune environment. Setup involves collecting your Tenant ID, registering an application in Microsoft Entra ID, and generating a client secret.

Prerequisites​

  • Application Administrator or Global Administrator role in the Microsoft Entra ID tenant
  • Access to the Azure Portal
  • Ability to grant Admin Consent for Microsoft Graph permissions

The following values are required when configuring the connector in ASCERA:

  • Tenant ID
  • Client ID
  • Client Secret

Microsoft Intune Setup​

Before you begin: As you work through the steps below, record the Tenant ID, Application (client) ID, and Client Secret values in a secure location. You will need all three to complete the connector configuration in ASCERA.

Collect this information from the directory where Intune is deployed. If you are currently in another directory, switch to the appropriate one before continuing.

Gather Your Tenant ID​

Navigate to Microsoft Entra ID > Overview and copy the Tenant ID.

Register an Application​

Go to Microsoft Entra ID > App registrations and click New registration. You can also reach this page by selecting Microsoft Entra ID from the portal menu or searching for Microsoft Entra ID, then choosing App registrations.

  • Name: ASCERA Intune Connector
  • Supported account types: Accounts in this organizational directory only (Single tenant). This is usually the correct setting, though it may differ if your organization has specific requirements.
  • Redirect URI: Leave blank

Click Register, then copy the Application (client) ID value. This is your Client ID in ASCERA.

Create a Client Secret​

In the app registration, within Manage click Certificates & secrets and then click New client secret.

  • Description: ASCERA Connector Secret
  • Expiration: Per your organization's security policy

Click Add and immediately copy the Value. This is your Client Secret in ASCERA.

The secret value is only shown once. If lost, a new secret must be created.

Configure API Permissions​

In the app registration, also within Manage, go to API permissions > Add a permission > Microsoft Graph > Application permissions and add:

  • DeviceManagementManagedDevices.Read.All
  • DeviceManagementConfiguration.Read.All
  • Device.Read.All or Directory.Read.All

These must be Application permissions, not Delegated permissions. Delegated permissions will not work for the connector.

Then click Grant admin consent for <Tenant Name> and confirm.

Admin consent is required for application permissions. Without it, ASCERA cannot retrieve Intune data. Permissions required may vary depending on which ASCERA features are enabled.

Configure the Connector in ASCERA​

Unfold ConMon: Maintain and choose Connectors, then click Create in the upper right corner. Select Microsoft Intune from the list of connector types.

Enter the values collected above into the connector configuration:

  • Name: Microsoft Intune ASCERA Connector (or any name you prefer)
  • Tenant ID: <Your Tenant ID>
  • Client ID: <Application (client) ID>
  • Client Secret: <Client Secret Value>

Save the configuration to proceed.

Test the Connection​

Once all required fields are populated, the Test Connection button in the connector form becomes active. Click it to verify that ASCERA can authenticate and reach Intune before saving.

You can also validate the connector by running its mapped automations. Unfold ConMon: Maintain and choose Automations, then filter for automations associated with the newly created connector and run one to confirm data is returned successfully.

Troubleshooting​

  • Invalid client secret. Ensure that the secret value was copied rather than the secret ID, and that it was copied before leaving the page.
  • Insufficient permissions. Verify that all required Microsoft Graph application permissions are added to the app registration and that admin consent has been granted.
  • Delegated instead of application permissions. Confirm that the permissions were added under Application permissions. Delegated permissions will not work for the connector.
  • Wrong tenant. Confirm that the Tenant ID matches the directory where Intune is deployed and where the app registration was created.

References​