Microsoft Intune
Microsoft device management, reached through Microsoft Graph. Interchangeable with the other MDM connectors as far as the rest of the product is concerned.
| Category | MDM |
| Authentication | OAuth client credentials |
| Reaches | login.microsoftonline.com and graph.microsoft.com |
| Needs an agent | No |
| Demo mode | No |
Capabilities
Section titled “Capabilities”device.lookupBySerial, device.get
Which lights up device details on a repair, and the device page with live inventory.
Registering the application in Entra
Section titled “Registering the application in Entra”- Entra admin centre, Applications, App registrations, New registration.
- Name it
Plugboard. Single tenant is correct. No redirect URI is needed, because this is a daemon flow rather than a user sign-in. - Register, then note the Application (client) ID and the Directory (tenant) ID.
- API permissions, Add a permission, Microsoft Graph, Application
permissions.
- Add
DeviceManagementManagedDevices.Read.All. - Add
DeviceManagementManagedDevices.ReadWrite.Allonly if you later want write operations.
- Add
- Click Grant admin consent. This step is easy to miss, and without it the permission is requested but not effective.
- Certificates and secrets, New client secret.
- Set an expiry you will actually track. Two years is common; twelve months is more honest about the review you will do.
- Copy the Value, not the Secret ID. This is the single most common mistake. The value is only shown once.
Configuring it in Plugboard
Section titled “Configuring it in Plugboard”Admin, Connectors, Microsoft Intune, Configure.
Settings
Section titled “Settings”| Field | Value |
|---|---|
tenantId | Your Entra tenant id, or your domain such as yourschool.edu.au |
Credentials
Section titled “Credentials”| Field | Value |
|---|---|
clientId | The Application (client) ID |
clientSecret | The secret value from step 6 |
Save and test. Success reports “Authenticated with Microsoft Graph”.
Diary the secret expiry
Section titled “Diary the secret expiry”Client secrets expire, and when one does the connector stops working with a
401 and no other warning. Entra will email the application owner shortly before,
but that notification goes to whoever is listed as the owner, which is often
somebody who has left.
Put the expiry date in a shared calendar with a reminder a month out. Rotating is a two minute job; discovering the expiry at 8:40 on a Monday is not.
What Intune returns
Section titled “What Intune returns”| Field | Notes |
|---|---|
| Serial number | The lookup key |
| Model | Falls back to the device name when the model is absent |
| Managed device id | Used for subsequent calls |
| Assigned user | The user principal name |
| Warranty expiry | When Intune has it, which is not always |
Intune does not carry AppleCare status. For Apple warranty detail, add Apple GSX alongside.
Running Intune and Jamf together
Section titled “Running Intune and Jamf together”Common in schools with a mixed fleet: Macs in Jamf, Windows in Intune. Configure both. A device resolves through whichever knows its serial, and the repairs screen is unchanged either way.
Troubleshooting
Section titled “Troubleshooting”| Symptom | Cause |
|---|---|
401 on test | Wrong secret, or you copied the Secret ID instead of the Value |
403 or “insufficient privileges” | Admin consent was not granted, or the wrong permission type was added. It must be an Application permission, not Delegated |
| Test passes, no devices found | The serial is not in Intune, or the device is not enrolled. Lookups match on an uppercased serial |
| Worked, then stopped | The client secret expired |
AADSTS700016 | The application id is wrong for that tenant |