Skip to main content

Microsoft Intune

Microsoft Intune is a cloud-based endpoint management service. The Willow connector uses the Microsoft Graph API to manage enrolled devices, compliance policies, configuration profiles, and managed apps — all under your governance policies.

Authentication Types​

Intune supports 1 authentication method:

  • OAuth 2.0 (Microsoft Entra ID app registration) — delegated Microsoft Graph permissions via an Entra ID (Azure AD) app
    • Pros: Standard Microsoft OAuth, scoped permissions, admin-consented, tokens auto-refresh
    • Cons: Requires an Entra ID app registration and (for most Intune scopes) tenant admin consent

Prerequisites​

  • A Microsoft Entra ID (Azure AD) tenant with Intune licensing.
  • Permission to create an app registration (or an admin who can grant consent).
  • The Willow redirect URI (shown in the setup wizard) added to the app registration.

Setting up OAuth (Entra ID app registration)​

  1. Go to the Azure Portal → Microsoft Entra ID → App registrations → New registration. Enter a name and select the supported account types.

  2. Add the Redirect URI shown in the Willow setup wizard (platform: Web).

  3. Under API permissions, click Add a permission → Microsoft Graph → Delegated permissions, and add the Intune scopes you need:

    • DeviceManagementManagedDevices.Read.All — read enrolled devices (required)
    • DeviceManagementConfiguration.Read.All — read compliance policies and configuration profiles
    • DeviceManagementApps.Read.All — read managed apps
    • DeviceManagementServiceConfig.Read.All — read service configuration / overview
    • DeviceManagementManagedDevices.ReadWrite.All — sync devices
    • DeviceManagementManagedDevices.PrivilegedOperations.All — reboot, remote lock, retire, wipe (only if you enable device actions)

  4. Click Grant admin consent for the tenant (most Intune scopes require it).

  5. Under Certificates & secrets, click New client secret, add a description, and copy the Value immediately — it's only shown once.

  6. From the app's Overview page, copy the Application (client) ID and paste it, together with the client secret, into Willow.

  7. Complete the OAuth consent flow to connect.

tip

Grant only the scopes you need. If you want a read-only integration, omit DeviceManagementManagedDevices.ReadWrite.All and DeviceManagementManagedDevices.PrivilegedOperations.All, and disable or guard the device-action tools.

Common Use Cases​

Device Inventory & Compliance​

  • List and search enrolled devices with OData filters (by OS, compliance state, ownership, last sync)
  • Look up a specific device or all devices for a given user
  • Get a fleet-level device/enrollment overview

Device Actions​

  • Sync a device to pull the latest policies and apps
  • Reboot or remotely lock a device
  • Retire (unenroll, remove company data) or wipe (factory reset) a device

Policy & Configuration Visibility​

  • List and inspect compliance policies and configuration profiles

App & Software Inventory​

  • List managed (published) apps and inspect a specific app
  • List apps detected across managed devices (useful for shadow-software discovery)

Available Tools​

  • Managed devices — list, get, list devices for user, device overview
  • Device actions — sync, reboot, remote lock, retire, wipe (privileged)
  • Compliance policies — list, get
  • Configuration profiles — list, get
  • Apps — list mobile apps, get mobile app, list detected apps
  • Reference data — device categories

Governance & Safety​

The destructive device actions (reboot, remote lock, retire, wipe) are tagged so Willow surfaces their risk. Use Willow guards, conditions, or approval requirements to gate these tools — for example, require admin approval before any wipe_device or retire_device call.

Troubleshooting​

403 Forbidden / insufficient privileges​

Cause: The app registration is missing a required scope, or admin consent wasn't granted.

Solution:

  1. In the Azure Portal, confirm the delegated Microsoft Graph permissions above are present.
  2. Click Grant admin consent for the tenant.
  3. Re-connect the integration in Willow so the new scopes are included in the token.

Device action returns success but nothing happens​

Cause: Device actions are asynchronous and depend on the device checking in.

Solution:

  1. Trigger Sync Device first, then allow time for the device to check in.
  2. Offline devices execute the action on their next check-in.

Token / consent errors​

Cause: Expired secret or revoked consent.

Solution:

  1. Generate a new client secret and update it in Willow.
  2. Re-run the OAuth consent flow.

Security Best Practices​

  1. Least privilege — request only the scopes the integration needs; keep it read-only unless device actions are required.
  2. Guard destructive actions — require approval for wipe/retire/reboot/lock.
  3. Rotate secrets — rotate the client secret periodically and remove unused app registrations.
  4. Audit — all tool calls are logged; review usage of privileged device operations regularly.
On this page