Repository navigation
Connecting to Microsoft Intune
Intune is read through the Microsoft Graph API using an Entra app registration with client-credentials (app-only) auth.
| Field | Where it comes from |
|---|---|
| Tenant ID | Entra admin centre → Overview |
| Client ID | Your app registration → Overview |
| Client Secret | Your app registration → Certificates & secrets |
Tick Save to Keychain to store them for next time. Leaving it unticked doesn't delete credentials you saved before. Clear Saved removes them after you confirm, and warns you if any automated reports rely on them.
Spaces and line breaks pasted around the tenant ID and client ID are trimmed.
Intune needs a licence once the free trial has ended. This is checked again when you click Test & Continue, in case the trial ran out while the screen was open.
If you report on more than one tenant, save each as a server profile (display name, tenant ID and client ID) and reconnect without retyping anything. Saved profiles appear as buttons under Saved Servers on the sign-in screen. Click one to fill in the form. The server button (Manage saved servers) opens the manager, where you can add, edit and delete profiles.
Profiles are saved in the app's preferences, and each client secret is kept in the Keychain. Deleting a profile asks you to confirm.
Grant these as application permissions on the app registration, with admin consent:
| Permission | Why |
|---|---|
DeviceManagementConfiguration.Read.All |
Configuration profiles, compliance policies, scripts, custom attributes, update policies |
DeviceManagementManagedDevices.Read.All |
Managed device inventory and enrolment data |
DeviceManagementApps.Read.All |
Apps, app categories, app protection policies, eBooks, VPP tokens |
Group.Read.All |
Resolving group names in assignment columns — without it, assignments show as bare GUIDs |
The tool requests the https://graph.microsoft.com/.default scope, so it gets exactly the application permissions consented on the registration and nothing more. All four are read-only.
The report only looks up the groups that its assignments actually reference, rather than downloading every group in the tenant. If the registration also has Directory.Read.All, those names are fetched in one lookup. Without it, the app falls back to reading the group list with Group.Read.All. Directory.Read.All is optional.
If neither works, the affected sections say that group names couldn't be loaded and show group IDs instead.
Test & Continue performs a real token request and a live call before moving on.
Long runs refresh the Graph token before it expires. Throttled requests (HTTP 429) and brief outages (503, 504) are retried up to three times, honouring Retry-After up to 30 seconds. Paged listings are followed up to 100 pages, and only to Microsoft Graph over HTTPS. If a listing is longer than that, the report says it's incomplete.
- Report Sections — the 23 Intune sections