Integration Directory

Entra ID / Intune and Active Directory

The two directory integrations. Both discover devices only — the one people-facing query in either is the optional address-book search, and it is a separate, opt-in decision.

---

Entra ID / Intune

Reads Microsoft Graph: /devices, plus /deviceManagement/managedDevices when Intune is enabled.

Configuration

Field	Default
Tenant ID	—
Client ID	—
Client secret	—	secret
Enable Intune	off	adds the managed-device read
Read installed software (Intune detected apps)	off	needs Intune; see Installed software
deviceInclude / deviceExclude	—	wildcards against the device name
Include disabled	on	a disabled device syncs as decommissioned; off skips it entirely
Decommission devices that leave Entra ID	off	see Decommissioning what leaves the directory
Verify presence	on	the post-sync presence pass
Enable directory search	off	live GAL typeahead, stores nothing
Enable directory sync	off	stores the roster as contacts
Directory sync filter	—	see below
Publish to Intune	off	see below
Workstation / Server monitor blocks	—	per-class polling + auto-monitor
Verbose logging	off

Azure side

The app registration needs Graph application permissions for device read, and admin consent. Directory search and sync need additional directory-read permissions that device discovery does not require — which is exactly why they are off by default: without the grant, every keystroke would 403.

Wi-Fi and Ethernet MACs

Intune reports two MACs per managed device, and both land in the asset's All MACs list as Intune — Wi-Fi and Intune — Ethernet. The Ethernet MAC becomes the asset's primary MAC, because Wi-Fi MACs can be randomized per network.

Microsoft Graph leaves the Ethernet MAC out of its device list, so Polaris reads it for each device separately, 20 devices per request. After the first run it re-reads only the devices that have synced with Intune since the last run. That makes the first sync after enabling Intune noticeably longer on a large fleet. The permission the device read already uses covers these reads too. A failed read keeps the MAC Polaris already has, and the device is retried on the next run.

A FortiGate duplicate is merged automatically. A computer that plugs into the wired network behind a FortiGate before Polaris knows its Ethernet MAC gets a second asset: FortiGate discovery records the unmatched MAC as a new endpoint. On the next Entra sync, once the Ethernet MAC is known, that endpoint asset is merged into the Intune asset. Its MACs, IPs and FortiGate sighting history move across, and an asset.duplicate_merged Event records the merge. Only a pure FortiGate endpoint record is ever merged this way. An asset with an authoritative source of its own (AD, Entra, an agent, a managed Fortinet device) is never touched. If the duplicate was monitored, the Intune asset is switched to monitored. The duplicate's chart history is not carried over.

Installed software

With Read installed software (Intune detected apps) ticked (under Intune sync on the General tab), each run reads every managed device's detected apps — the programs and versions Intune has inventoried on it — and shows them on the asset's Software tab (Assets).

• No extra permission. DeviceManagementManagedDevices.Read.All, which the device read already needs, covers it.
• Intune lists unmanaged apps only on corporate-owned devices. On a device enrolled as personal it reports only the apps Intune itself deployed. This is Microsoft's privacy rule; nothing in Polaris can widen it. Set the device's ownership to Corporate in Intune if you need the full list.
• A device is re-read only after it checks in with Intune again (and at least once a week regardless), because its detected apps cannot have changed in between. Like the Ethernet MAC read, the first run after turning this on takes longer on a large fleet.
• A device with a Polaris Agent is skipped while the agent's own list is less than two days old — the agent reads the host directly and more often.
• Discover Now on one device always re-reads its apps.
• A device whose read failed keeps the list it had, and is retried next run. The run's log shows the failure under discover.intune.software.
• Turning the option off removes the Intune lists from this integration's devices on the next run.

---

Active Directory

Reads LDAP or LDAPS, hard-filtered to objectClass=computer.

Configuration

Field	Default
Host	—	domain controller
Port	636
Use LDAPS	on
Verify TLS	on
Bind DN	—
Bind password	—	secret
Base DN	—
Search scope	sub	sub or one
ouInclude / ouExclude	—	OU filters
Include disabled	on	a disabled computer object is still a record
Decommission computers that leave the directory	off	see Decommissioning what leaves the directory
Verify presence	on
Enable directory search / sync	off
Workstation / Server monitor blocks	—

The bind credential doubles as the integration-tier fallback for AD-discovered hosts' agentless polling. That is convenient and worth being deliberate about: a stream that re-fires every tick against a bad credential is an AD-lockout risk, which is why the agentless collectors stamp their cadence anchor even on failure.

---

Decommissioning what leaves the directory

Off by default on both integrations. Switch it on and a device that is deleted from the directory, or that the directory reports as disabled, sets its asset's status to decommissioned on the next discovery run. Nothing is deleted — the asset, its history and its samples all stay, and setting the status back to active by hand undoes it.

Only assets this integration manages. The test is the Managed by row on the asset's System tab, not the list of sources on its Sources tab. If AD or Entra manages the asset, the directory's word is final: a DHCP lease seen by a FortiGate, a vCenter record or a reporting Polaris Agent will not keep a deleted computer object active. If some other integration manages it, this sweep only removes its own now-stale source row and says so in the run log.

A run that cannot be trusted is refused, and says why. The sweep will not act on:

• a Discover Now run scoped to a single device;
• a cancelled run, or one that hit the 10,000-object read cap;
• an empty read — zero objects where the integration holds a fleet is far more often a bind failure, a wrong base DN or a withdrawn Graph consent than a genuinely emptied directory;
• a run where the number of missing devices is implausibly large — more than 50, or more than a fifth of what the integration holds. That is the guard for the cases nothing else can detect: a base DN narrowed by one level, an OU delegated away, a service principal that lost its read over half the tenant.

Each refusal writes a warning on the Events page naming the reason, and leaves every source row untouched.

Filters and disabled accounts are not deletions. Editing ouInclude / ouExclude / deviceInclude / deviceExclude, or turning Include disabled off, narrows what the sync processes — it does not decommission what you excluded, and re-widening the filter picks the same assets back up. A disabled device is decommissioned but keeps its directory source row, because it has not left the directory.

Intune is swept separately. An Intune source row is judged against the Intune roster, never against /devices. If Intune sync is switched off, or its read fails on a given run, every Intune row is left alone.

Each decommission writes an Event on the Assets timeline naming which of the two reasons applied. Aging assets out after months of inactivity is a separate, always-on mechanism — see Server-Settings — and is unaffected by this toggle.

---

Hybrid join

A device in both directories is linked by its on-prem SID — AD's objectSid matched against Entra's onPremisesSecurityIdentifier. That is the second rung of the re-discovery ladder, above a MAC match and above a hostname collision.

Projection priority between them: AD FQDN > Intune > Entra for hostname; for OS and OS version, whichever of them is not lagging — see below.

---

The Windows version problem

ProductName still reads "Windows 10 Pro" on every Windows 11 client. AD, Intune and the agent are all equally wrong, so no projection priority can fix it (rule 28).

Polaris derives the family from the build number via a threshold — build ≥ 22000 is Windows 11, which never goes stale — and the release from a table. An unlisted build keeps its raw version rather than being guessed at.

Windows Server is excluded entirely: build 26100 is both Windows 11 24H2 and Server 2025.

It is applied at write time, because filters, sorts, exports and automation scope conditions all read the stored columns. It is idempotent, and it is not retroactive.

---

The per-class blocks

Both integrations carry Workstations and Servers blocks, each with:

Control	Default
Enabled	on
Add as monitored	off
Per-stream polling methods and credentials	source defaults
Agent auto-deploy	off
Interface auto-monitor	off
Storage auto-monitor	off

Agent auto-deploy

Pushes the Polaris Agent to newly discovered, agent-less devices over SSH or WinRM during discovery. Bounded, paced and idempotent.

Turn it on only once you have a working credential and have tested a deployment by hand — this installs software on your estate on a schedule. See Polaris Agent.

Auto-monitor

Pins interfaces and storage mounts for alerting. Additive only — it never un-pins. The subtractive counterpart is Mass Pinning.

Because these devices only report interfaces and mounts via the agent, auto-monitor pins land the cycle after the agent first reports. That is self-healing, not a bug.

---

Presence verification

A post-sync pass, on by default, that establishes Asset.lastSeen for directory-sourced assets — because a directory timestamp is not network presence and does not write that field.

Cheapest signal first:

already-fresh lastSeen → agent heartbeat → an answering monitor probe
  → a single ICMP against the DNS name

A failed ping writes nothing.

---

The address book: search vs sync

Two separate, independently opt-in forms of directory access, on the same Directory tab. Same grants, different decision — because one reads and one stores.

Search (enableDirectorySearch, off)

A live typeahead fanned out to Graph (/users, mail-enabled /groups, org /contacts) and an LDAP user/group/contact search, merged and deduplicated by address.

It persists nothing. Results live for one request, and only an address someone picks becomes a rule recipient or a saved contact. Failures degrade per-integration rather than erroring the typeahead, and query strings are never written to Events.

Sync (enableDirectorySync, off)

Materialises the roster as Contact rows, as the fourth post-sync pass of the owning integration's discovery run — last, so a directory outage cannot affect the asset passes, and never its own scheduler job.

Before you enable it: this puts employee names, addresses, titles, departments and phone numbers in your database and in every backup.

Read in bulk — Graph paged with $select / $filter / $top; LDAP via the paged-results control with an objectGUID identity.

Its five guarantees are on the Address Book page. A steady-state run issues zero writes, and the run Event carries counts only — no directory PII reaches Events or the logs, because Events are readable by anyone with events access and are shipped off-host by the archivers.

Switching the toggle off, or disabling or deleting the integration, purges what it created.

The directory sync filter

Shared verbatim between the two integrations — the directories differ in what they can answer, not in what you want to exclude.

Field
Exclude disabled
Exclude shared mailboxes
Include groups	mail-enabled groups as entries
Include org contacts
ouInclude / ouExclude	up to 100 each
groupExclude	up to 50
domainInclude / domainExclude	up to 50 each
nameExclude	up to 100
maxEntries	up to 50 000

---

Publishing scripts to Intune

publishToIntune, off by default, with its own Script Publishing tab.

It lets Polaris publish the generated SSH onboarding scripts to Intune as a Remediation, instead of you downloading and uploading them.

Two things to understand before enabling it:

• It needs the Graph DeviceManagementScripts.ReadWrite.All application permission — upgrading the credential from "reads device inventory" to "creates device-management policy tenant-wide". The tab renders the setup steps and the cost of the grant inline.
• Polaris never calls /assign. Assignment is the human review gate for a script that grants fleet-wide administrative SSH, and that is test-pinned. A human assigns the policy in Intune after reviewing the script.

The Graph API version is probed (v1.0 then beta), since this endpoint may be available on beta only: a 404 means the wrong version, a 403 means the endpoint exists and permission is missing.

Windows only. Intune does not manage traditional Windows Server, so the Servers class needs GPO, SCCM or Azure Arc regardless.

---

Decommissioning

Out of the box, the only decommissioned write comes from the directory object's own disabled flag. A machine deleted from AD does not disappear from Polaris on its own — deliberately, because a device is not gone just because a directory record is.

Switch on Decommission devices that leave the directory and it does. See Decommissioning what leaves the directory above for what it acts on, what refuses it, and why a filter edit is not a deletion.

---

Troubleshooting

Symptom	Look at
Every address-book keystroke 403s	directory search is on without the directory-read grant
Windows 11 clients show as Windows 10	the build-threshold normalisation applies at write time and is not retroactive — the asset is corrected at its next write
A device appears twice, once from AD and once from Entra	the SID match failed. Check objectSid / onPremisesSecurityIdentifier and look for a hostname-collision conflict
Auto-monitor pinned nothing	the agent had not reported yet at that cycle; check again after the next one
Agentless polling locks out the bind account	the anchors stamp on failure specifically to bound this — confirm the credential, and prefer a dedicated one over the bind DN
lastSeen never advances on directory assets	presence verification is off, or nothing answered — note a failed ping writes nothing