> For the complete documentation index, see [llms.txt](https://docs.harmony.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.harmony.io/integrations/mdm/microsoft-intune.md).
# Microsoft Intune
Microsoft Intune is a cloud-based endpoint management solution that helps organizations manage mobile devices, desktops, and applications. Connecting Intune to Harmony enables automated device provisioning, intelligent compliance monitoring, and AI-powered troubleshooting for your entire endpoint fleet.
#### What the Microsoft Intune integration enables
| Capability | Description |
| ---------------------- | --------------------------------------------------------------------- |
| Device Inventory | Sync all managed devices with real-time status and compliance data |
| Automated Provisioning | Trigger device enrollment and configuration through Harmony workflows |
| Compliance Monitoring | Track compliance policies and automate remediation actions |
| Remote Actions | Execute remote wipe, lock, restart, and other management tasks |
| AutoPilot Visibility | Surface pre-enrollment AutoPilot devices as In Stock assets |
| App Discovery | Automatically populate installed application data from Intune |
| Recovery Keys | Retrieve BitLocker and FileVault recovery keys for managed devices |
#### Prerequisites
Before configuring the Microsoft Intune integration, ensure you have:
* **Microsoft 365 Administrator Access**: Global Administrator or Intune Administrator role
* **Harmony Account**: Active Harmony workspace with integration permissions
#### Connect Microsoft Intune to Harmony
**Step 1: Navigate to Integrations**
1. Log in to your Harmony dashboard
2. Go to **Settings** > **Integrations**
3. Find **Microsoft Intune** under **MDM** and click **Connect**
**Step 2: Configure Instance**
1. Enter an **Instance name** for your Microsoft Intune connection (e.g., "Microsoft Intune Instance")
2. Click **Connect** to start the authentication process
**Step 3: Authorize in Microsoft**
1. You'll be redirected to Microsoft's permissions page
2. Sign in with your Microsoft 365 administrator account
3. Review the requested permissions for managing Intune devices and policies
4. Click **Accept** to authorize Harmony to access your Intune instance
Harmony uses a secure OAuth authorization flow for this step, consistent with Microsoft's recommended security standards. You do not need to manage credentials or client secrets manually.
#### What Harmony Syncs
**From Intune to Harmony**
* **Device Inventory**: All enrolled devices with hardware details, discovered using Azure AD device targeting for accurate identification
* **Compliance Status**: Real-time compliance policy status
* **Device Health**: Battery health, storage, encryption status
* **Installed Apps**: List of installed applications on each device, automatically filtered with an ignore list to remove system-level noise
* **User Assignments**: Primary user for each device
* **Device Groups**: Group memberships and assignments
* **Last Sync**: Last check-in timestamp
* **Network Interfaces**: IP addresses for Wi-Fi, Ethernet, VPN, Docker, WSL, and other interfaces
* **Device Ownership**: Company-owned or Personal, sourced from Intune's `managedDeviceOwnerType` field
* **AutoPilot Devices**: Pre-enrollment devices registered in AutoPilot, surfaced as **In Stock** assets
* **Recovery Keys**: BitLocker recovery keys for Windows devices and FileVault recovery keys for encrypted macOS devices
#### AutoPilot Device Visibility
Harmony automatically discovers devices registered in Microsoft Intune AutoPilot before they are enrolled and actively managed. This gives you full visibility into your pre-deployment device fleet without any manual action.
* **AutoPilot devices appear as In Stock assets** as soon as they are registered in Intune, even before enrollment begins
* **Automatic status transition**: once a device enrolls in Intune, it automatically moves from In Stock to Active
* **Devices are marked as Company Owned** to reflect their organizational ownership
#### Recovery Key Collection
Harmony collects and securely stores recovery keys for encrypted devices managed through Intune.
**BitLocker (Windows)**
Harmony retrieves all BitLocker key metadata in a single paginated bulk request, reducing Microsoft Graph API calls by approximately 50% compared to per-device lookups. When multiple keys exist for a device, Harmony intelligently prefers the OS volume key and the most recently created key. If the `BitLockerKey.Read.All` permission has not been granted, BitLocker key collection is skipped gracefully without affecting other sync operations.
**FileVault (macOS)**
FileVault recovery keys are automatically collected from Intune-managed macOS devices where disk encryption is confirmed active. Keys are encrypted immediately upon collection and stored securely in the device's asset record. FileVault key collection is independent of BitLocker key collection and does not affect Windows device sync.
#### Application Discovery
Harmony automatically pulls software inventory data collected by Intune and populates it into your Applications catalogue. An ignore list is applied automatically to filter out noise and system-level entries that are not meaningful for software discovery. No additional configuration is required.
#### Network Interface Data
Harmony accurately populates IP address data for all network interfaces on Intune-managed devices:
* **Wi-Fi interfaces** show the correct IPv4 address, sourced from the device's primary IP field
* **Ethernet interfaces** display their wired IPv4 address
* **Additional interfaces** - including VPN, Docker, and WSL networks - are discovered and listed as separate entries
#### Device Ownership
Harmony reads Intune's `managedDeviceOwnerType` field and reflects it in your asset records, mapping both **Company** and **Personal** ownership types. Existing synced data is updated automatically without requiring a new data collection. The **Personal** ownership type is also available in the ownership dropdown across your asset inventory.
#### Troubleshooting
Devices Not Syncing
**Issue**: Device inventory not updating in Harmony
**Solutions**:
* Verify API permissions include DeviceManagementManagedDevices.Read.All
* Check that admin consent was granted
* Ensure client secret hasn't expired
* Trigger manual sync from Harmony dashboard
* Verify devices are actually enrolled in Intune
Remote Actions Failing
**Issue**: Unable to execute remote commands on devices
**Solutions**:
* Confirm ReadWrite permissions are granted (not just Read)
* Verify device is online and connected to Intune
* Check that device hasn't reached action limit
* Ensure device supports the requested action
* Review Intune service health in Microsoft 365 admin center
Compliance Status Delays
**Issue**: Compliance status not updating in real-time
**Solutions**:
* Intune devices check in periodically (every 8 hours by default)
* Force device to sync with Intune from device or portal
* Adjust sync frequency in Harmony settings
* Check device network connectivity
* Verify compliance policy is correctly configured
App Deployment Issues
**Issue**: Apps not deploying to devices
**Solutions**:
* Verify app is properly configured in Intune
* Check that deployment is targeted to correct groups
* Ensure device meets app requirements
* Review app deployment status in Intune portal
* Check device has sufficient storage for app
Recovery Keys Not Appearing
**Issue**: BitLocker or FileVault recovery keys are missing for devices
**Solutions**:
* For BitLocker keys, verify the `BitLockerKey.Read.All` permission has been granted in your Microsoft 365 admin center
* For FileVault keys, confirm the macOS device has disk encryption actively enabled in Intune
* Check that admin consent has been granted for all required permissions
* Trigger a manual sync from the Harmony dashboard and allow time for the key collection to complete
* Verify the device is enrolled and actively managed in Intune
AutoPilot Devices Not Appearing
**Issue**: Pre-enrollment AutoPilot devices are not visible in the asset inventory
**Solutions**:
* Confirm devices are registered in AutoPilot within your Intune tenant
* Verify the integration has the necessary permissions to read AutoPilot device data
* Trigger a manual sync from the Harmony dashboard
* Check that admin consent was granted during the OAuth authorization step
#### Best Practices
Device Management
* **Categorization**: Use device categories for organized management
* **Dynamic Groups**: Leverage Azure AD dynamic groups for automatic assignment
* **Naming Conventions**: Standardize device naming for easy identification
* **Regular Audits**: Review device inventory quarterly
* **Lifecycle Management**: Automate device retirement for termed employees
Compliance and Security
* **Layered Policies**: Create baseline and role-specific compliance policies
* **Grace Periods**: Allow reasonable time for compliance remediation
* **Conditional Access**: Combine Intune compliance with Azure AD Conditional Access
* **Regular Updates**: Keep policies current with security best practices
* **User Communication**: Notify users before enforcing new policies
Performance Optimization
* **Selective Sync**: Only sync devices that require active management
* **Batch Operations**: Schedule bulk changes during off-hours
* **Efficient Polling**: Use webhooks where possible instead of polling
* **Group-Based Management**: Manage devices via groups rather than individually
* **Caching**: Cache frequently accessed device data
Automation Strategy
* **Start Small**: Begin with simple automation rules and expand gradually
* **Test Thoroughly**: Test automation on pilot groups before full deployment
* **Monitor Closely**: Track automation success rates and adjust rules
* **Human Escalation**: Always provide path to human intervention
* **Documentation**: Document automation rules and their purposes
#### Data & Privacy
Data Handling
* Device data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
* Recovery keys are encrypted immediately upon collection and stored securely in the device's asset record
* Harmony caches device metadata; full data remains in Microsoft 365
* Personal device data on BYOD devices handled according to privacy policies
* Data retention follows your configured policies
* Device information is processed according to GDPR requirements
Compliance
* **GDPR**: Full compliance with EU data protection regulations
* **HIPAA**: Available for healthcare organizations (BAA required)
* **SOC 2 Type II**: Both Intune and Harmony maintain certification
* **Microsoft 365 Compliance**: Inherits Microsoft's compliance framework
* **Audit Trails**: All actions logged for compliance reporting
Access Control
* Respects Intune role-based access control (RBAC)
* Service principal permissions can be scoped to specific actions
* Integration can be disabled immediately if needed
* All remote actions require appropriate permissions
* Audit logs track all integration activities
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.harmony.io/integrations/mdm/microsoft-intune.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.