Connect Microsoft Intune

Imports managed devices, detected applications, Windows health attestation, Microsoft Defender Antivirus state and compliance and configuration results per setting from Microsoft Intune through Microsoft Graph.

For the general flow of adding a source, see Connect Data Sources.

Before you start

To configure the data source, you can use your M365 interface or use the full PowerShell script that we provide.

Prerequisites

• Active Microsoft Entra ID tenant

• Active Intune license

• Azure account with Global Administrator or Privileged Role Administrator role — an Application Administrator can create the App Registration but cannot grant admin consent to Microsoft Graph application permissions

Setup

Step 1 - Create an App Registration

1. Azure portal → App registrations → New registration

2. Name: HARVEN-Intune, type: Single tenant

3. Note the Application (client) ID and Directory (tenant) ID

Step 2 - Configure Microsoft Graph permissions

API permissions → Add a permission → Microsoft Graph → Application permissions

⚠️ Click Grant admin consent.

Step 3 - Create a Client Secret

Certificates & secrets → New client secret → copy the value immediately.

Fields to fill in HARVEN

Collected data

• managed_devices — Intune managed devices: Identification (device_id, device_name, serial_number, azure_ad_device_id), User (user_id, user_principal_name, user_display_name), System (operating_system, os_version, device_type), Security (compliance_state, is_encrypted, is_jail_broken, partner_reported_threat_state), Management (owner_type, enrollment_type, management_state, last_sync_datetime, enrolled_datetime), Hardware (manufacturer, model)

• detected_apps — Software inventory detected by Intune across managed devices, by application and version: Application (app_id, display_name, version, publisher, platform), Spread (device_count, size_in_bytes)

• device_health_attestation — Windows health attestation, read from an Intune report (about 10 s per query): Boot integrity (secure_boot_enabled, bitlocker_enabled, code_integrity_enabled), Last attestation (attestation_error, health_cert_issued_at)

• windows_protection_state — Microsoft Defender Antivirus state, read from an Intune report (about 7 s per query): Protection (real_time_protection_enabled, signature_update_overdue, quick_scan_overdue), Defender status flags (product_status)

• compliance_setting_summaries — Device counts per compliance setting: Setting (setting, platform), Counts (compliant_device_count, non_compliant_device_count, error_device_count)

• compliance_setting_states — Compliance state of each device for one setting (a setting filter is required): State (setting, device_id, state)

• configuration_setting_summaries — Device counts per configuration profile setting: Setting (profile_name, setting_name, instance_path), Counts (compliant_device_count, error_device_count, conflict_device_count)

How the tables are queried

device_health_attestation and windows_protection_state are read from an Intune report: each query takes several seconds, whatever its filter. On a tenant where no device has ever attested, Intune never finishes the attestation report and the query fails after two minutes.

compliance_setting_states needs a filter on setting, with a value taken from compliance_setting_summaries.setting. The three compliance and configuration tables cover classic compliance policies and configuration profiles: Settings Catalog policies and security baselines are not read.

Existing data sources

A data source connected before a table was added gets it when you click Refresh tables on that data source.

PowerShell script

Create the App Registration, assign the permissions and generate the secret in one command, with our PowerShell script.

Download the script

How to run it:

Windows — Right-click the file, Run with PowerShell — or in a terminal:

powershell -ExecutionPolicy Bypass -File .\setup-microsoft-connector.ps1

macOS / Linux — Install PowerShell 7 then run the script:

brew install powershell
pwsh ./setup-microsoft-connector.ps1

Arguments (optional) — Without any argument, the script is fully interactive.

• -Connector <entraid|intune|defender|mdca|azure> — Connector to configure. Omitted: the script asks in a menu.

• -AppName <name> — Name of the App Registration to create (default: HARVEN-<connector>).

• -SubscriptionId <id> — Required for azure: target subscription for the Reader role.

• -IncludeEntraIdWrite — entraid only: adds the remediation permission User.EnableDisableAccount.All.

• -Yes — Non-interactive: skips confirmations and installs missing modules automatically.

The script offers to install the missing modules automatically.

Official documentation

• Microsoft Graph Permissions

• Microsoft Intune Graph API overview

Need help? Contact [email protected].