# Microsoft Intune (/integrations/intune)

Use [Microsoft Intune](https://www.microsoft.com/en-us/security/business/microsoft-intune) to inspect managed devices, detected applications, compliance policy statuses, and device configuration metadata. Request device sync, restart, remote lock, or retirement; restart, lock, and retirement require explicit confirmation.

Connect a Microsoft work or school account with an appropriate Intune role. The tenant needs an active Intune license and administrator consent for the delegated permissions below. Self-hosted deployments require `MICROSOFT_CLIENT_ID`, `MICROSOFT_CLIENT_SECRET`, and the matching `/api/auth/oauth2/callback/microsoft-intune` callback.

List operations return one page. Pass `nextLink` to the same operation and resource to continue. Policy and configuration outputs contain common metadata and exclude platform-specific settings. An accepted device action confirms that Intune received the request; it does not confirm completion on the device.

## OAuth scopes \[#oauth-scopes]

Sim requests these scopes when someone connects a Microsoft Intune account. For a self-hosted deployment, register your own app with the provider using the settings below. See [Integrations and OAuth](/platform/self-hosting/integrations-oauth) for setup.

| Setting | Value |
| - | - |
| Redirect URI | `<NEXT_PUBLIC_APP_URL>/api/auth/oauth2/callback/microsoft-intune` |
| Environment variables | `MICROSOFT_CLIENT_ID`, `MICROSOFT_CLIENT_SECRET` |

| Scope | Description |
| - | - |
| `openid` | Standard authentication |
| `profile` | Access profile information |
| `email` | Access email address |
| `DeviceManagementManagedDevices.Read.All` | View Intune managed devices and detected apps |
| `DeviceManagementConfiguration.Read.All` | View Intune compliance policies, device configurations, and their device statuses |
| `DeviceManagementManagedDevices.PrivilegedOperations.All` | Perform remote Intune device actions, including syncing, rebooting, locking, and retiring devices |
| `offline_access` | Access account when not using the application |

## Use the block \[#usage-instructions]

Read managed device and detected application inventories, inspect compliance policy status and device configuration metadata, and request device sync, restart, remote lock, or retirement. Uses Microsoft Graph v1.0 with a work or school account and an active Intune tenant license. Remote actions depend on device platform and the connected administrator’s Intune permissions.

## Actions \[#actions]

### Microsoft Intune List Devices \[#microsoft-intune-list-devices]

Read one page of devices from Microsoft Intune

#### Input \[#input]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `top` | number | No | Requested page size from 1 to 1000 (default: 100); ignored with nextLink |
| `nextLink` | string | No | The nextLink from the previous response for this same operation and resource |
| `filter` | string | No | OData filter, for example complianceState eq 'noncompliant'; ignored with nextLink |

#### Output \[#output]

| Parameter | Type | Description |
| - | - | - |
| `nextLink` | string | Continuation URL for the next page; null when this is the final page |
| `devices` | array | List Devices |
| ↳ `id` | string | Intune managed device ID |
| ↳ `deviceName` | string | Device name |
| ↳ `managedDeviceOwnerType` | string | Ownership: company, personal, or unknown |
| ↳ `managementState` | string | Current device management state |
| ↳ `enrolledDateTime` | string | Enrollment time |
| ↳ `lastSyncDateTime` | string | Last check-in time |
| ↳ `operatingSystem` | string | Operating system |
| ↳ `osVersion` | string | Operating system version |
| ↳ `complianceState` | string | Device compliance state |
| ↳ `isEncrypted` | boolean | Whether device storage is encrypted |
| ↳ `userId` | string | Primary user ID |
| ↳ `userPrincipalName` | string | Primary user principal name |
| ↳ `userDisplayName` | string | Primary user display name |
| ↳ `emailAddress` | string | User email address |
| ↳ `azureADDeviceId` | string | Microsoft Entra device ID |
| ↳ `serialNumber` | string | Device serial number |
| ↳ `manufacturer` | string | Device manufacturer |
| ↳ `model` | string | Device model |
| ↳ `totalStorageSpaceInBytes` | number | Total storage capacity in bytes |
| ↳ `freeStorageSpaceInBytes` | number | Available storage in bytes |

### Microsoft Intune Get Device \[#microsoft-intune-get-device]

Read device details from Microsoft Intune

#### Input \[#input-1]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `managedDeviceId` | string | Yes | Intune managed device ID (not the Microsoft Entra device ID) |

#### Output \[#output-1]

| Parameter | Type | Description |
| - | - | - |
| `device` | json | Get Device |
| ↳ `id` | string | Intune managed device ID |
| ↳ `deviceName` | string | Device name |
| ↳ `managedDeviceOwnerType` | string | Ownership: company, personal, or unknown |
| ↳ `managementState` | string | Current device management state |
| ↳ `enrolledDateTime` | string | Enrollment time |
| ↳ `lastSyncDateTime` | string | Last check-in time |
| ↳ `operatingSystem` | string | Operating system |
| ↳ `osVersion` | string | Operating system version |
| ↳ `complianceState` | string | Device compliance state |
| ↳ `isEncrypted` | boolean | Whether device storage is encrypted |
| ↳ `userId` | string | Primary user ID |
| ↳ `userPrincipalName` | string | Primary user principal name |
| ↳ `userDisplayName` | string | Primary user display name |
| ↳ `emailAddress` | string | User email address |
| ↳ `azureADDeviceId` | string | Microsoft Entra device ID |
| ↳ `serialNumber` | string | Device serial number |
| ↳ `manufacturer` | string | Device manufacturer |
| ↳ `model` | string | Device model |
| ↳ `totalStorageSpaceInBytes` | number | Total storage capacity in bytes |
| ↳ `freeStorageSpaceInBytes` | number | Available storage in bytes |

### Microsoft Intune List Detected Apps \[#microsoft-intune-list-detected-apps]

Read one page of detected apps from Microsoft Intune

#### Input \[#input-2]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `top` | number | No | Requested page size from 1 to 1000 (default: 100); ignored with nextLink |
| `nextLink` | string | No | The nextLink from the previous response for this same operation and resource |

#### Output \[#output-2]

| Parameter | Type | Description |
| - | - | - |
| `nextLink` | string | Continuation URL for the next page; null when this is the final page |
| `apps` | array | List Detected Apps |
| ↳ `id` | string | Detected application ID |
| ↳ `displayName` | string | Application display name |
| ↳ `version` | string | Application version |
| ↳ `sizeInByte` | number | Application size in bytes |
| ↳ `deviceCount` | number | Number of devices with this application |
| ↳ `publisher` | string | Application publisher |
| ↳ `platform` | string | Application platform |

### Microsoft Intune Get Detected App \[#microsoft-intune-get-detected-app]

Read detected app details from Microsoft Intune

#### Input \[#input-3]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `detectedAppId` | string | Yes | Detected application ID |

#### Output \[#output-3]

| Parameter | Type | Description |
| - | - | - |
| `app` | json | Get Detected App |
| ↳ `id` | string | Detected application ID |
| ↳ `displayName` | string | Application display name |
| ↳ `version` | string | Application version |
| ↳ `sizeInByte` | number | Application size in bytes |
| ↳ `deviceCount` | number | Number of devices with this application |
| ↳ `publisher` | string | Application publisher |
| ↳ `platform` | string | Application platform |

### Microsoft Intune List App Devices \[#microsoft-intune-list-app-devices]

Read one page of managed devices that have a detected application installed

#### Input \[#input-4]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `top` | number | No | Requested page size from 1 to 1000 (default: 100); ignored with nextLink |
| `nextLink` | string | No | The nextLink from the previous response for this same operation and resource |
| `detectedAppId` | string | Yes | Detected application ID |

#### Output \[#output-4]

| Parameter | Type | Description |
| - | - | - |
| `nextLink` | string | Continuation URL for the next page; null when this is the final page |
| `devices` | array | List App Devices |
| ↳ `id` | string | Intune managed device ID |
| ↳ `deviceName` | string | Device name |
| ↳ `managedDeviceOwnerType` | string | Ownership: company, personal, or unknown |
| ↳ `managementState` | string | Current device management state |
| ↳ `enrolledDateTime` | string | Enrollment time |
| ↳ `lastSyncDateTime` | string | Last check-in time |
| ↳ `operatingSystem` | string | Operating system |
| ↳ `osVersion` | string | Operating system version |
| ↳ `complianceState` | string | Device compliance state |
| ↳ `isEncrypted` | boolean | Whether device storage is encrypted |
| ↳ `userId` | string | Primary user ID |
| ↳ `userPrincipalName` | string | Primary user principal name |
| ↳ `userDisplayName` | string | Primary user display name |
| ↳ `emailAddress` | string | User email address |
| ↳ `azureADDeviceId` | string | Microsoft Entra device ID |
| ↳ `serialNumber` | string | Device serial number |
| ↳ `manufacturer` | string | Device manufacturer |
| ↳ `model` | string | Device model |
| ↳ `totalStorageSpaceInBytes` | number | Total storage capacity in bytes |
| ↳ `freeStorageSpaceInBytes` | number | Available storage in bytes |

### Microsoft Intune List Compliance Policies \[#microsoft-intune-list-compliance-policies]

Read one page of compliance policies from Microsoft Intune

#### Input \[#input-5]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `top` | number | No | Requested page size from 1 to 1000 (default: 100); ignored with nextLink |
| `nextLink` | string | No | The nextLink from the previous response for this same operation and resource |

#### Output \[#output-5]

| Parameter | Type | Description |
| - | - | - |
| `nextLink` | string | Continuation URL for the next page; null when this is the final page |
| `policies` | array | List Compliance Policies |
| ↳ `id` | string | Policy or configuration ID |
| ↳ `displayName` | string | Policy or configuration name |
| ↳ `description` | string | Administrator-provided description |
| ↳ `createdDateTime` | string | Creation time |
| ↳ `lastModifiedDateTime` | string | Last modification time |
| ↳ `version` | number | Policy or configuration version |

### Microsoft Intune Get Compliance Policy \[#microsoft-intune-get-compliance-policy]

Read common metadata for an Intune compliance policy

#### Input \[#input-6]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `compliancePolicyId` | string | Yes | Device compliance policy ID |

#### Output \[#output-6]

| Parameter | Type | Description |
| - | - | - |
| `policy` | json | Get Compliance Policy |
| ↳ `id` | string | Policy or configuration ID |
| ↳ `displayName` | string | Policy or configuration name |
| ↳ `description` | string | Administrator-provided description |
| ↳ `createdDateTime` | string | Creation time |
| ↳ `lastModifiedDateTime` | string | Last modification time |
| ↳ `version` | number | Policy or configuration version |

### Microsoft Intune List Compliance Policy Device Statuses \[#microsoft-intune-list-compliance-policy-device-statuses]

Read one page of compliance policy device statuses from Microsoft Intune

#### Input \[#input-7]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `top` | number | No | Requested page size from 1 to 1000 (default: 100); ignored with nextLink |
| `nextLink` | string | No | The nextLink from the previous response for this same operation and resource |
| `compliancePolicyId` | string | Yes | Device compliance policy ID |

#### Output \[#output-7]

| Parameter | Type | Description |
| - | - | - |
| `nextLink` | string | Continuation URL for the next page; null when this is the final page |
| `deviceStatuses` | array | List Compliance Policy Device Statuses |
| ↳ `id` | string | Device status record ID |
| ↳ `deviceDisplayName` | string | Device display name |
| ↳ `userName` | string | User name |
| ↳ `deviceModel` | string | Device model |
| ↳ `status` | string | Reported compliance status |
| ↳ `lastReportedDateTime` | string | Last status report time |
| ↳ `userPrincipalName` | string | User principal name |
| ↳ `complianceGracePeriodExpirationDateTime` | string | Compliance grace period expiration |

### Microsoft Intune List Device Configurations \[#microsoft-intune-list-device-configurations]

Read one page of device configurations from Microsoft Intune

#### Input \[#input-8]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `top` | number | No | Requested page size from 1 to 1000 (default: 100); ignored with nextLink |
| `nextLink` | string | No | The nextLink from the previous response for this same operation and resource |

#### Output \[#output-8]

| Parameter | Type | Description |
| - | - | - |
| `nextLink` | string | Continuation URL for the next page; null when this is the final page |
| `configurations` | array | List Device Configurations |
| ↳ `id` | string | Policy or configuration ID |
| ↳ `displayName` | string | Policy or configuration name |
| ↳ `description` | string | Administrator-provided description |
| ↳ `createdDateTime` | string | Creation time |
| ↳ `lastModifiedDateTime` | string | Last modification time |
| ↳ `version` | number | Policy or configuration version |

### Microsoft Intune Get Device Configuration \[#microsoft-intune-get-device-configuration]

Read common metadata for an Intune device configuration

#### Input \[#input-9]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `configurationId` | string | Yes | Device configuration ID |

#### Output \[#output-9]

| Parameter | Type | Description |
| - | - | - |
| `configuration` | json | Get Device Configuration |
| ↳ `id` | string | Policy or configuration ID |
| ↳ `displayName` | string | Policy or configuration name |
| ↳ `description` | string | Administrator-provided description |
| ↳ `createdDateTime` | string | Creation time |
| ↳ `lastModifiedDateTime` | string | Last modification time |
| ↳ `version` | number | Policy or configuration version |

### Microsoft Intune Sync Device \[#microsoft-intune-sync-device]

Request a device check-in to receive pending Intune policies and actions

#### Input \[#input-10]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `managedDeviceId` | string | Yes | Intune managed device ID (not the Microsoft Entra device ID) |

#### Output \[#output-10]

| Parameter | Type | Description |
| - | - | - |
| `accepted` | boolean | Microsoft Intune accepted the request; device completion is asynchronous |

### Microsoft Intune Reboot Device \[#microsoft-intune-reboot-device]

Request a device restart after explicit confirmation; may interrupt the signed-in user

#### Input \[#input-11]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `managedDeviceId` | string | Yes | Intune managed device ID (not the Microsoft Entra device ID) |
| `confirmAction` | boolean | Yes | Explicit user confirmation to perform this disruptive device action |

#### Output \[#output-11]

| Parameter | Type | Description |
| - | - | - |
| `accepted` | boolean | Microsoft Intune accepted the request; device completion is asynchronous |

### Microsoft Intune Remote Lock Device \[#microsoft-intune-remote-lock-device]

Request a remote device lock after explicit confirmation on supported platforms

#### Input \[#input-12]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `managedDeviceId` | string | Yes | Intune managed device ID (not the Microsoft Entra device ID) |
| `confirmAction` | boolean | Yes | Explicit user confirmation to perform this disruptive device action |

#### Output \[#output-12]

| Parameter | Type | Description |
| - | - | - |
| `accepted` | boolean | Microsoft Intune accepted the request; device completion is asynchronous |

### Microsoft Intune Retire Device \[#microsoft-intune-retire-device]

Retire a device after explicit confirmation, removing company data and management

#### Input \[#input-13]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `managedDeviceId` | string | Yes | Intune managed device ID (not the Microsoft Entra device ID) |
| `confirmAction` | boolean | Yes | Explicit user confirmation to perform this disruptive device action |

#### Output \[#output-13]

| Parameter | Type | Description |
| - | - | - |
| `accepted` | boolean | Microsoft Intune accepted the request; device completion is asynchronous |