Microsoft Intune
Configure the Microsoft Intune Endpoint Management integration with RAD Security to ingest device inventory and compliance findings, and trigger device remediation.
This guide walks you through integrating Microsoft Intune with RAD Security to ingest managed-device inventory and device compliance findings, and to trigger remediation on a device from RAD.
Microsoft Intune is the device-management service in Microsoft Entra / Microsoft 365. RAD Security connects to Microsoft Graph using an Azure AD app registration (OAuth client credentials) and pulls device inventory and compliance posture on a scheduled basis to correlate them with your runtime, cloud, and Kubernetes security data.
Read-only ingestion, with one write action: RAD only reads device inventory and compliance from Intune. The single exception is device remediation — RAD can trigger a remediation action on a device through Graph. That action is RBAC-gated (requires tenant write permission) and recorded as an OCSF Device Control Finding.
Prerequisites
Before you begin, ensure you have:
- A Microsoft Entra (Azure AD) tenant with Intune device management
- Permission to create an app registration in Microsoft Entra ID
- Your Directory (Tenant) ID
- Admin consent rights to grant Microsoft Graph application permissions
- Access to a RAD Security workspace with integration permissions
Understanding Integration Components
Step 1: Register an App in Microsoft Entra ID
Create an App Registration
In the Microsoft Entra admin center, go to Identity → Applications → App registrations → New registration. Give it a name (for example RAD Security Intune) and register it.
Record the Client and Tenant IDs
On the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID.
Create a Client Secret
Under Certificates & secrets → Client secrets, create a new secret and copy its Value.
Copy the Client Secret value immediately — it is shown only once at creation time. Store it securely in a password manager or secrets vault.
Grant Microsoft Graph Permissions
Under API permissions → Add a permission → Microsoft Graph → Application permissions, add the Intune device-management permissions for inventory and compliance (and a managed-device action permission if you will use remediation). Then click Grant admin consent.
Exact portal navigation, permission names, and admin-consent flow may vary across tenants and Graph versions. See the Microsoft Graph permissions reference and Intune device management docs for current details.
Configure in RAD Security
Navigate to your RAD Security workspace and configure the Microsoft Intune integration with the following parameters:
Required Parameters
| Parameter | Required | Description |
|---|---|---|
| Client ID | Yes | Application (client) ID of the Entra ID app registration |
| Client Secret | Yes | Client secret value generated for the app registration |
| Directory (Tenant) ID | Yes | Microsoft Entra directory/tenant identifier |
| Graph URL | No | Optional Microsoft Graph base URL override for national/sovereign clouds |
Verify Integration
Check Connection Status
- Navigate to Data Sources > Integrations > Endpoint Management in RAD Security
- Locate your Microsoft Intune integration
- Verify the connection status shows as Connected
Your Microsoft Intune integration is now configured! RAD Security will ingest device inventory and compliance findings from Intune on a scheduled basis.
What Data is Synced
Use Cases
Compliance Management Track device compliance gaps from discovery through remediation across your Intune-managed fleet.
Asset Visibility Use managed-device inventory to understand your endpoint estate and reduce attack surface.
Threat Response Trigger Intune remediation on a non-compliant or compromised device directly from RAD.
RADBot Prioritization Leverage RADBot to prioritize Intune device findings by real-world impact.
Troubleshooting
Security Best Practices
Dedicated App Registration Use a dedicated app registration for the RAD integration rather than sharing one with other tools.
Least Privilege Grant only the Graph permissions required for device inventory, compliance, and remediation.
Rotate Secrets Rotate the client secret before expiry and according to your security policy.
Secure Secret Storage Store the client secret in a secrets vault. Never commit it to version control.
Additional Resources
Microsoft Intune Documentation
Official Microsoft Intune documentation
Endpoint Management Overview
Learn about RAD's endpoint management integrations