> For the complete documentation index, see [llms.txt](https://docs.harmony.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.harmony.io/asset-management/retrieving-device-recovery-keys-from-intune-and-kandji.md).

# Retrieving Device Recovery Keys from Intune and Kandji

Harmony can now retrieve device recovery keys directly from Microsoft Intune and Kandji. Your IT and security teams can access unlock PINs and recovery keys from within Harmony without switching between MDM consoles, reducing friction during device recovery and support workflows.

### Supported MDM Platforms

Recovery key retrieval is supported for the following MDM platforms:

* **Microsoft Intune** - recovery key retrieval is available as part of the existing Intune integration.
* **Kandji** - recovery keys and unlock PINs are fetched via the Kandji Device Secrets API.

### Prerequisites

#### Microsoft Intune

No additional configuration is required beyond your existing Intune integration. Recovery key retrieval is supported automatically once your Intune connection is active in Harmony.

#### Kandji

To enable recovery key retrieval for Kandji-managed devices, your Kandji API token must have the **Device secrets** permission enabled. Without this permission, Harmony cannot fetch recovery keys or unlock PINs from the Kandji Device Secrets API.

To verify or update your API token permissions:

1. Log in to your Kandji admin console.
2. Navigate to **Settings** and select **Access** or **API Token** management.
3. Locate the API token used for your Harmony integration.
4. Ensure the **Device secrets** permission is enabled on that token.
5. Save your changes.

Once the permission is in place, Harmony will be able to retrieve recovery keys and unlock PINs for your Kandji-managed devices.

### Retrieving Recovery Keys in Harmony

After the prerequisites are met, you can access device recovery keys directly from the Harmony interface:

1. Open Harmony and navigate to the **Devices** section.
2. Select the device for which you need the recovery key.
3. Look for the **Recovery Key** or **Unlock PIN** option in the device details panel.
4. Harmony fetches the key in real time from the connected MDM platform and displays it to authorized users.

### Permissions and Access Control

Recovery key retrieval is a sensitive operation. Ensure that only authorized members of your IT and security teams have access to this functionality within Harmony. Review your Harmony role assignments to confirm that recovery key visibility is restricted to the appropriate users.

### Troubleshooting

| Issue                                           | Likely Cause                                           | Resolution                                                                           |
| ----------------------------------------------- | ------------------------------------------------------ | ------------------------------------------------------------------------------------ |
| Recovery key not available for a Kandji device  | **Device secrets** permission missing on the API token | Enable the **Device secrets** permission on your Kandji API token as described above |
| Recovery key not available for an Intune device | Intune integration not active or misconfigured         | Verify your Intune connection is healthy in the Harmony integrations settings        |
| Permission denied error when fetching key       | Insufficient API token scope                           | Review and update the API token permissions in the respective MDM console            |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.harmony.io/asset-management/retrieving-device-recovery-keys-from-intune-and-kandji.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.