> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rad.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Intune

> Configure the Microsoft Intune Endpoint Management integration with RAD Security to ingest device inventory and compliance findings, and trigger device remediation.

# Microsoft Intune Endpoint Management Integration Setup

This guide walks you through integrating Microsoft Intune with RAD Security to ingest managed-device inventory and device compliance findings, and to trigger remediation on a device from RAD.

Microsoft Intune is the device-management service in Microsoft Entra / Microsoft 365. RAD Security connects to Microsoft Graph using an Azure AD app registration (OAuth client credentials) and pulls device inventory and compliance posture on a scheduled basis to correlate them with your runtime, cloud, and Kubernetes security data.

<Info>
  **Read-only ingestion, with one write action:** RAD only reads device inventory and compliance from Intune. The single exception is **device remediation** — RAD can trigger a remediation action on a device through Graph. That action is RBAC-gated (requires tenant write permission) and recorded as an OCSF Device Control Finding.
</Info>

## Prerequisites

Before you begin, ensure you have:

<Check>
  * A Microsoft Entra (Azure AD) tenant with Intune device management
  * Permission to create an app registration in Microsoft Entra ID
  * Your **Directory (Tenant) ID**
  * Admin consent rights to grant Microsoft Graph application permissions
  * Access to a RAD Security workspace with integration permissions
</Check>

## Understanding Integration Components

<AccordionGroup>
  <Accordion title="App Registration (OAuth Client)" icon="key">
    RAD Security authenticates to Microsoft Graph using an Entra ID **app registration**. You provide the app's **Client ID** and a **Client Secret**, and RAD exchanges them for short-lived access tokens via the OAuth 2.0 client-credentials grant.
  </Accordion>

  <Accordion title="Directory (Tenant) ID" icon="building">
    The **Directory (Tenant) ID** identifies your Microsoft Entra tenant and scopes token issuance. You can find it on the app registration overview or in the Entra ID tenant overview.
  </Accordion>

  <Accordion title="Graph Permissions" icon="shield-halved">
    The app registration needs Microsoft Graph **application** permissions for Intune device management (for example `DeviceManagementManagedDevices.Read.All` for inventory and compliance, plus a managed-device action permission such as `DeviceManagementManagedDevices.PrivilegedOperations.All` for remediation). Permissions require **admin consent**.
  </Accordion>

  <Accordion title="Graph URL (optional)" icon="globe">
    The **Graph URL** override is optional. Leave it blank for the global Microsoft Graph endpoint; set it only for national / sovereign clouds (for example US Government or China) where the Graph base URL differs.
  </Accordion>
</AccordionGroup>

***

## Step 1: Register an App in Microsoft Entra ID

<Steps>
  <Step title="Create an App Registration">
    In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Identity → Applications → App registrations → New registration**. Give it a name (for example `RAD Security Intune`) and register it.
  </Step>

  <Step title="Record the Client and Tenant IDs">
    On the app's **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**.
  </Step>

  <Step title="Create a Client Secret">
    Under **Certificates & secrets → Client secrets**, create a new secret and copy its **Value**.

    <Warning>
      Copy the **Client Secret value** immediately — it is shown only once at creation time. Store it securely in a password manager or secrets vault.
    </Warning>
  </Step>

  <Step title="Grant Microsoft Graph Permissions">
    Under **API permissions → Add a permission → Microsoft Graph → Application permissions**, add the Intune device-management permissions for inventory and compliance (and a managed-device action permission if you will use remediation). Then click **Grant admin consent**.
  </Step>
</Steps>

<Note>
  Exact portal navigation, permission names, and admin-consent flow may vary across tenants and Graph versions. See the [Microsoft Graph permissions reference](https://learn.microsoft.com/graph/permissions-reference) and [Intune device management docs](https://learn.microsoft.com/mem/intune) for current details.
</Note>

***

## Configure in RAD Security

Navigate to your RAD Security workspace and configure the Microsoft Intune integration with the following parameters:

### Required Parameters

| Parameter                 | Required | Description                                                              |
| ------------------------- | -------- | ------------------------------------------------------------------------ |
| **Client ID**             | Yes      | Application (client) ID of the Entra ID app registration                 |
| **Client Secret**         | Yes      | Client secret value generated for the app registration                   |
| **Directory (Tenant) ID** | Yes      | Microsoft Entra directory/tenant identifier                              |
| **Graph URL**             | No       | Optional Microsoft Graph base URL override for national/sovereign clouds |

***

## Verify Integration

<Steps>
  <Step title="Check Connection Status">
    1. Navigate to **Data Sources > Integrations > Endpoint Management** in RAD Security
    2. Locate your Microsoft Intune integration
    3. Verify the connection status shows as **Connected**
  </Step>
</Steps>

<Check>
  Your Microsoft Intune integration is now configured! RAD Security will ingest device inventory and compliance findings from Intune on a scheduled basis.
</Check>

## What Data is Synced

<AccordionGroup>
  <Accordion title="Device Inventory" icon="laptop">
    Intune managed devices, mapped to **OCSF Device Inventory Info (5001)** — hostname, OS, hardware, serial, owner, managed/compliant flags, risk, and first/last-seen timestamps.
  </Accordion>

  <Accordion title="Compliance Findings" icon="shield-exclamation">
    Device compliance posture, mapped to **OCSF Compliance Finding (2003)** and stored as security findings. Feeds unified posture analysis and RADBot.
  </Accordion>

  <Accordion title="Device Remediation" icon="screwdriver-wrench">
    The one write action — RAD can trigger an Intune remediation on a device via Graph. RBAC-gated (tenant write) and recorded as an **OCSF Device Control Finding**.
  </Accordion>
</AccordionGroup>

## Use Cases

<CardGroup cols={2}>
  <Card title="Compliance Management" icon="shield-check">
    Track device compliance gaps from discovery through remediation across your Intune-managed fleet.
  </Card>

  <Card title="Asset Visibility" icon="laptop">
    Use managed-device inventory to understand your endpoint estate and reduce attack surface.
  </Card>

  <Card title="Threat Response" icon="screwdriver-wrench">
    Trigger Intune remediation on a non-compliant or compromised device directly from RAD.
  </Card>

  <Card title="RADBot Prioritization" icon="robot">
    Leverage RADBot to prioritize Intune device findings by real-world impact.
  </Card>
</CardGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Authentication Failed" icon="triangle-exclamation">
    **Possible causes:**

    * Incorrect Client ID, Client Secret, or Tenant ID
    * The client secret expired or was deleted

    **Solution:**

    * Verify the Client ID, Client Secret value, and Directory (Tenant) ID are correct
    * Confirm the client secret has not expired; create a new one and update RAD if needed
  </Accordion>

  <Accordion title="Insufficient Permissions" icon="lock">
    **Possible causes:**

    * Required Microsoft Graph application permissions were not added
    * Admin consent was not granted

    **Solution:**

    * Add the Intune device-management Graph permissions to the app registration
    * Click **Grant admin consent** and retry the connection
  </Accordion>

  <Accordion title="Wrong Cloud / Empty Results" icon="globe">
    **Possible causes:**

    * National/sovereign cloud tenant using the global Graph endpoint
    * No managed devices in the tenant

    **Solution:**

    * Set the **Graph URL** override for your national cloud
    * Confirm managed devices exist in Intune for the tenant
  </Accordion>
</AccordionGroup>

## Security Best Practices

<CardGroup cols={2}>
  <Card title="Dedicated App Registration" icon="user-gear">
    Use a dedicated app registration for the RAD integration rather than sharing one with other tools.
  </Card>

  <Card title="Least Privilege" icon="shield-halved">
    Grant only the Graph permissions required for device inventory, compliance, and remediation.
  </Card>

  <Card title="Rotate Secrets" icon="rotate">
    Rotate the client secret before expiry and according to your security policy.
  </Card>

  <Card title="Secure Secret Storage" icon="vault">
    Store the client secret in a secrets vault. Never commit it to version control.
  </Card>
</CardGroup>

## Additional Resources

<CardGroup cols={2}>
  <Card title="Microsoft Intune Documentation" icon="book" href="https://learn.microsoft.com/mem/intune">
    Official Microsoft Intune documentation
  </Card>

  <Card title="Endpoint Management Overview" icon="laptop-mobile" href="/rad-security/integrations/endpoint-management/overview">
    Learn about RAD's endpoint management integrations
  </Card>
</CardGroup>

## Next Steps

<CardGroup cols={2}>
  <Card title="Endpoint Management Integrations" icon="laptop-mobile" href="/rad-security/integrations/endpoint-management/overview">
    Explore other endpoint management integration options
  </Card>

  <Card title="Data Sources" icon="database" href="/rad-security/integrations/data-sources">
    Connect additional security data sources
  </Card>

  <Card title="RADBot" icon="robot" href="/rad-security/getting-started/radbot">
    Learn how RADBot helps prioritize findings
  </Card>
</CardGroup>