Microsoft 365 Integrations PR Review

Microsoft 365 in System → Integrations - PR review

PR #352 by vsc55 · Closes #263 · Follows #291 and #264 · Verdict: merge, with fixes · 5.4.0

What FreeITSM reads from a Microsoft tenant was in three places: importing people from Entra ID under System → Authentication (with a signpost card in Integrations), and Intune under Assets → Settings → Intune - although both read the same tenant through Microsoft Graph, often with the same app registration. System → Integrations → Microsoft 365 is now one entry for both, in place of the Entra ID signpost. Entra ID and Intune stay two connections, as decided on #263, so no settings were migrated. Intune moved here, in two halves as Entra ID has them: Connection (tenant, app, secret) and Import, in tabs - Devices, Asset types, Software. Signing in with Entra stays under Authentication, and every old link still works. User page: System → Integrations → Microsoft 365. Internals: System page layout §7.

This closes #263: its first half, System → Maintenance, shipped in 5.0.0 (PR #291) and 5.3.0 (Imported people, PR #264).

What was checked

Question	Result
Does anybody's Intune set-up move or change?	No - the setting keys, the api/intune/* and api/settings/* endpoints and the permission are the same. Each page saves only its own keys: Connection the three credentials, Import everything else, and Import never sends the connection's
Does an asset manager lose Intune?	No. System is administrators-only, but the Intune tab was granted by a capability. An analyst with the Assets module and Configure the Intune connection (Cap::ASSETS_INTUNE) may open the Intune pages and the Microsoft 365 page (seeing only its Intune half), and nothing else in System
Is that one rule, or two that can drift?	One - systemPageAllowed() in system/includes/page_access.php, asked by both the page gate and the System header. A page opts in with $system_page_grant; it fails closed
Do the endpoints trust the page?	No - they check the capability themselves, as they always did
Old links	?tab=intune on Assets → Settings redirects to the new page, and so does opening Assets → Settings when Intune was someone's only tab. The tab bar shows Intune as a link out (settingsMovedTo())
Why is the tab still in the Assets manifest?	It is what grants the capability in System → Roles and owns the intune_* keys; it carries 'moved_to'
"Also from Microsoft"	Administrators only. Each row is counted on its own try, so a table an install has not verified yet costs only its own row. Nothing in it moved
Assets switched off	Not handled: the page still showed an Intune panel and the card counted Intune as set up, and the Intune forms would post to endpoints that refuse. Fixed (fix 1)

On the test install: vsc55's tests/intune-system-page.php - the manifest entry, the redirect, no Intune left on Assets → Settings, each page saving only its own keys, who may open what - extended on merge so that, over HTTP, an analyst with only the Intune permission opens the three Intune pages, sees no Entra ID or Also from Microsoft, and is turned away from every other System page (99 of them), and the Assets-off behaviour. tests/system-page-layout.php now finds the three new pages. vsc55 also ran module-access-coverage, get-must-not-write, escape-helpers-quotes, inline-handler-strings, system-card-groups, system-maintenance and system-settings-search, all unchanged and passing.

Two real bugs found on the way, by vsc55, fixed in the PR:

• Proxmox and vCloud hid behind the Intune capability. The Intune tab's settingsTabVisible() guard also wrapped the Proxmox, Hyper-V and vCloud panels, so they showed only to whoever could see Intune. Proxmox and vCloud have their own guards now.
• A redirect loop waiting to happen. In system/integrations/.htaccess, "a real file or folder always wins" guarded only the help rule - a RewriteCond covers just the one rule after it - so the provider rule took real folders too, and microsoft365/ looped. The provider rule has the guard as well.

What was changed on merge

1. With Assets switched off, the Microsoft 365 page has no Intune panel, the Integrations card no longer counts Intune as set up, and the two Intune pages show one line - Assets is switched off - instead of a form whose endpoints refuse.
2. The new place, said everywhere. Help and in-app wording said Assets → Settings → Intune; it now says System → Integrations → Microsoft 365 → Intune - the SSO and Intune-mismatch help, the Assets reconciliation help, a Background jobs message and code comments.
3. A Microsoft 365 guide (system/integrations/microsoft365/help, administrators): what it does, Entra ID, the Intune connection, what Intune imports, who can open it, and what to check if something is wrong.
4. One-word buttons: Import, Sign-in, Next.
5. Feature Bingo cards open the right Import tab.
6. Translatable counts: the Also from Microsoft lines say Mailboxes: {n} rather than mailbox(es).
7. Unused strings removed from every locale: ms365_open_intune, ms365_intune_subtitle, entra_blurb.
8. System search: Intune, Microsoft 365, M365, Entra and Graph find the Integrations card.
9. No 720px cap on the Intune forms (System page layout §3).
10. The import page escapes its jobs table.
11. Assets → Settings no longer loads Chart.js or reads companies it no longer uses.
12. Tests: tests/system-page-layout.php finds System pages two folders down; tests/intune-system-page.php gains the HTTP checks above.
13. Changelog ids #2941 (the feature) and #2942 (the merge fixes); this write-up, the user pages, the developer notes and vsc55's entry on the Contributors page.

Merged with git merge --no-ff under the contributor's name; the fixes are in the merge commit (a0998c9a1).

Decided

• Separate connections, shown together - one shared tenant connection would have meant migrating everyone's settings; it can come later if people ask (Ed, #263, 2026-11-08).
• The three extensions vsc55 asked about on #263 are accepted (Ed, on my recommendation, 2026-11-15):
  • Also from Microsoft - Microsoft 365 mailboxes, Outlook calendars, Teams channel alerts and Teams chat listed with how each stands and a button to where it is set up. Nothing moves;
  • Intune in two halves - Connection, and Import with Devices / Asset types / Software tabs;
  • Asset managers keep Intune - an analyst with Assets and the Intune capability may open only the Intune pages (systemPageAllowed()), nothing else in System.

Worth knowing

• System is still administrators-only, with exactly one exception. A future page that wants the same treatment sets $system_page_grant and its endpoints must check the capability themselves - the page gate is the screen, not the security.
• Entra sign-in did not move. Each Entra sign-in provider's import is still system/sso/entra.php; the Microsoft 365 page lists them and opens them.
• Nothing to run after upgrading. No schema change; old bookmarks redirect.
• The Intune jobs are unchanged - Intune device sync and Intune software sync in Background jobs, as in 5.3.0; the Import page says when each last ran.