Connect Microsoft Intune

Elisity supports simple API connectivity to Microsoft Intune as a method to enrich IT device discovery and identity. This enables asset data from Microsoft Intune to be imported into IdentityGraph for all assets that appear on your Elisity-secured network. This enhances the precision and effectiveness of asset classification. The connector supports up to 10 endpoints, each connecting to a separate Microsoft Intune tenant.

Prerequisites

For each Microsoft tenant you connect:

• Microsoft Intune Tenant ID

• Microsoft Intune App ID

• Microsoft Intune App Secret

Steps to Connect Microsoft Intune

Step 1. Access the Enterprise Application Registration page in Microsoft Entra.

Step 2. Click on the New Registration button. 

Step 3. Enter a name for the Application: Elisity CCC Intune API Access

Step 4. Select Accounts in this organization only

Step 5. Enter https://portal.azure.com as the Redirect URI. This is only used as a redirect for the application authorization for your Entra tenant. Click Register.

Step 6.After the application is created, navigate to the API Permissions link in the left panel and click on the Add Permission button.

Step 7. Click on the Add Permission button
 

Step 8. Click on the APIs My Organization Uses tab and select Microsoft Graph

Step 9. In the new panel, select Application Permissions then search for “DeviceManagementManagedDevices”
 

Step 10. Click the dropdown arrow beside “DeviceManagementManagedDevices” then click the checkbox beside “DeviceManagementManagedDevices.Read.All” as shown in the below image.
 

You may remove the default “User.Read” permission for this App Registration if desired, it is not required for Intune API Access.

Step 11. After clicking the Add Permissions button, ensure you select the Grant Admin Consent for {Organization} to complete the permissions grant process
 

Step 12. Navigate to the Certificates & secrets panel in the left side menu.
 

Step 13. Make sure the Client Secrets pane is selected then click on the + New client secret button

Step 14. Enter “Elisity CCC Intune Connector” as the description for the client secret and choose a suitable expiration interval based on your organizations policies for API credential rotation
 

Step 15. After the Client Credential is created be sure to copy the “Value” field as it will not be displayed after navigating from this page. A sample of a successfully created credential screen is shown below.

Step 16.Navigate to the Overview page in the left side menu
 

Step 17. Note the “Application (client) ID” and “Directory (tenant) ID” as these will be used with the Client Secret from above to authenticate Elisity CCC for API access.

Step 18.Lastly the Application must be authorized in Entra. Navigate to the following URL while logged in as an Entra Administrator where 00000000-0000-0000-0000-000000000000 is the Client ID from the overview page above.

https://login.microsoftonline.com/common/oauth2/authorize?prompt=consent&client_id=00000000-0000-0000-0000-000000000000&response_type=code&sso_reload=true

To connect more than one Microsoft tenant, repeat Steps 1 through 18 in each tenant to create a separate app registration and client secret.

Step 19. Log into Elisity Cloud Control Center and navigate to IdentityGraph > Connectors and select + Add Connector button. 

Step 20. A list of tiles will slide out from the right side of the screen. Select Configure on the Microsoft Intune connector. 

Step 21. On the Required Configuration tab, enter an Endpoint Name to identify this Microsoft tenant (for example, Corporate), then the Tenant ID, App ID and App Secret. Each endpoint name must be unique within the connector.

Step 22 (optional). Configure the Advanced Settings tab for the endpoint, as described in Advanced Settings.

Advanced Settings

Advanced settings control how Cloud Control Center queries the connector, how learned data is retained, and how the connector's data is used by IdentityGraph and Insights. These settings are configured at two levels.

Endpoint Advanced Settings

The Advanced Settings tab of each endpoint holds Query Exclusion Rules and Hostname fallback matching, which apply only to that endpoint, and the Enrichment Lookback Window, which applies to the whole connector: changing it on one endpoint changes it for every endpoint.

Global Settings

To open Global Settings, select the Actions (three-dot) menu on the Microsoft Intune connector row on the Connectors page, then select Global Settings. The Advanced Settings tab holds Connector Data Purging and Trusted Connector, and the Interval Settings tab holds Initial Delay. Global Settings apply to all endpoints.

The following chart provides details about each advanced setting.

Step 23. Select Add. If all of the required connector values are correct, all checks pass and the connector is created. 

Step 24 (optional). To connect another Microsoft tenant, select + Add Connector, select Configure on the Microsoft Intune tile again, and repeat Steps 21 through 23. Each submission adds an endpoint to the existing Microsoft Intune connector. Each endpoint is validated independently.

After successfully configuring the Microsoft Intune connector, you should begin to see newly discovered assets enriched with data from Microsoft Intune in IdentityGraph. Any devices learned by Elisity prior to the connector being configured will be automatically scheduled for enrichment during the next update cycle. Alternatively, you can force a refresh by selecting the refresh button on the Microsoft Intune tile under the Trust Attributes section of IdentityGraph.

Hostname Fallback Matching

Microsoft Intune records one wired and one Wi-Fi MAC address per device. Hostname fallback matching enriches devices that connect through additional network adapters by matching on the device's computer name when Intune does not recognize its MAC address.

Hostname fallback matching is set per endpoint. When Enable Hostname fallback matching is on for an endpoint, Cloud Control Center matches a device to its Intune record as follows:

1. Cloud Control Center matches on the device's MAC address first. A MAC address match always takes precedence.
2. If no Intune record matches the MAC address, Cloud Control Center uses the device's hostname from Microsoft Entra ID or, if none exists, from Active Directory.
3. The short computer name is compared with Intune device names. The comparison is exact and not case-sensitive.
4. The match succeeds only when exactly one Intune device has that name. Otherwise, the device receives no Intune data.

Hostname fallback matching requires a Microsoft Entra ID or Active Directory connector that supplies the device's hostname. If the hostname is learned after the first Intune query, the device is matched on a later enrichment cycle.

When Allow Reverse DNS hostnames is on, Cloud Control Center uses the device's reverse DNS hostname only if the device has no hostname from Entra ID or Active Directory. Reverse DNS hostnames are lower-confidence, so enable this option only when your DNS records are accurate.

The Matched on attribute in the device's Microsoft Intune section shows MAC, Hostname (a hostname from Entra ID or Active Directory), or DNS Hostname (a reverse DNS hostname). These values are available as Policy Group match criteria, so a policy can exclude devices matched by DNS Hostname.

Managing Multiple Endpoints

Each endpoint of the Microsoft Intune connector connects a separate Microsoft Intune tenant with its own Endpoint Name, Tenant ID, App ID, App Secret and status.

• The connector supports a maximum of 10 endpoints.
• Each endpoint authenticates with its own credentials and enriches only devices from its own tenant.
• To change an endpoint, for example to rotate its App Secret, expand the Microsoft Intune row on the Connectors page, select the Actions (three-dot) menu on the endpoint row, and select Edit Endpoint. Changes apply only to that endpoint.
• A device known in more than one tenant is enriched from the endpoint listed first under the connector. If that endpoint is deleted, the device is enriched from the next endpoint that knows it.
• Delete Endpoint removes only that endpoint. Select Delete Endpoint Data in the confirmation dialog to also remove the data that endpoint added to IdentityGraph. Data from other endpoints is not affected. Deleting the only endpoint also deletes the connector.
• The Known in Microsoft Intune trust attribute is set for a device known in the tenant of any endpoint.

Connector Status

On the Connectors page, each endpoint appears as a row under the expanded Microsoft Intune connector, with its own status, Created On and Modified On timestamps.

The Connector status reflects its health and availability based on recent query performance. To ensure accuracy and reduce false positives, the status is determined using a rolling 15-minute evaluation window.

Connector Status Levels:

• Active: Normal operation with minimal query failures.
• Degraded: Increased query failures detected, but the connector is still operational.
• Inactive: The connector is unresponsive due to persistent failures.

Failures are defined as unsuccessful query responses, and the platform continuously monitors performance to update the status accordingly. These status changes are visible in the UI, event logs, and notifications pane for better troubleshooting. Email alerts can also be configured for connector status changes.

If the connector has not been queried within the evaluation window, the last known status is retained. This approach ensures reliable status reporting and helps identify potential issues before they impact operations.

Leveraging Microsoft Intune with Elisity

When Elisity discovers a new asset on the network and the Microsoft Intune connector is active, Cloud Control Center queries the Microsoft Intune platform via API for additional device attributes in order to enrich IdentityGraph. This enriched data is displayed in the IdentityGraph tab of the device and can be leveraged in Policy Group definition. 

The Microsoft Intune section of a device also shows the device's primary user as User Principal Name, User Name and User Email Address, available as Policy Group match criteria. These attributes are empty for shared, kiosk and meeting-room devices that have no primary user; those devices still receive the other Intune attributes. They are read with the DeviceManagementManagedDevices.Read.All permission granted in Step 10. For the full attribute list, see Microsoft Intune Classification Details.

The Matched on attribute shows how the device was matched to its Intune record and can be used in Policy Group definition. See Hostname Fallback Matching.

If a device discovered by Elisity is also known in any connected Microsoft Intune tenant, the Trust Attribute flag for "Known in Microsoft Intune" will be set to Yes. You can then leverage this trust attribute as match criteria in Policy Group definition. 

To learn more about how to leverage IdentityGraph Trust Attributes review the Leveraging Trust Attributes for Policy Group Definition article.