This article describes the device attributes Elisity enriches from the Microsoft Intune connector and how to use them in policy.
The Microsoft Intune connector enriches devices discovered by Elisity with management and classification data from your Intune tenant. Cloud Control Center matches each discovered device to its Intune record by MAC address, or by hostname when hostname fallback matching is enabled, and surfaces the resulting attributes in IdentityGraph, where the attributes indicated below can be used as Policy Group match criteria.
Device Matching and Enrichment
When a new device is discovered by any of Elisity's methods, Cloud Control Center queries Microsoft Intune for a matching record using the following parameters, in order, until a match is found:
- MAC address
- Hostname, used only when hostname fallback matching is enabled on the connector
Cloud Control Center re-queries Intune periodically to check for updated device attributes. You can refresh a device on demand using the refresh button next to Microsoft Intune in the Trust Attributes section of the device's IdentityGraph view. Devices learned by Elisity before the connector was configured are automatically scheduled for enrichment on the next enrichment cycle, based on their attachment timestamp.
Hostname Fallback Matching
Microsoft Intune records one wired and one Wi-Fi MAC address per device, so a device that connects through another network adapter has no MAC address match. Hostname fallback matching allows Cloud Control Center to match these devices by hostname:
- MAC address matching always runs first and takes precedence.
- The hostname comes from Microsoft Entra ID, then Active Directory. The hostname Intune reports is never used, so a Microsoft Entra ID or Active Directory connector must supply the device's hostname.
- The short computer name must match exactly (not case-sensitive) and belong to exactly one Intune device. Otherwise, the device is not matched.
- Allow Reverse DNS hostnames permits a reverse DNS hostname only when the device has no Entra ID or Active Directory hostname. Enable it only when your reverse DNS (PTR) records are accurate.
- A device whose hostname is learned later is matched on a later enrichment cycle without administrator action.
Hostname fallback matching is off by default. To use it, turn on Enable Hostname fallback matching on the Advanced Settings tab of the Microsoft Intune connector, as described in Connect Microsoft Intune.
Attribute Mapping
The Microsoft Intune connector retrieves the following device attributes from the Microsoft Graph API (GET /deviceManagement/managedDevices). These attributes are surfaced on the device's IdentityGraph tab, and the attributes indicated below can be used as Policy Group match criteria.
| Intune API Attribute | Elisity Attribute | Core Effective Attribute | Policy Group Match Criteria |
|---|---|---|---|
| id | Intune Device ID | — | — |
| azureADDeviceId | Azure AD Device ID | — | Yes |
| operatingSystem | Operating System | Yes | Yes |
| complianceState | Compliance State | — | Yes |
| osVersion | OS Version | — | Yes |
| azureADRegistered | Azure AD Registered | — | Yes |
| deviceRegistrationState | Device Registration State | — | Yes |
| model | Model | Yes | Yes |
| manufacturer | Vendor | Yes | Yes |
| serialNumber | Serial Number | — | Yes |
| managedDeviceOwnerType | Ownership | — | Yes |
| — | Matched on | — | Yes |
The Ownership attribute reflects the device's management ownership as reported by Intune (managedDeviceOwnerType) and resolves to one of three values:
- Corporate — the device is company-owned.
- Personal — the device is personally owned (BYOD).
- Unknown — Intune has not recorded an ownership type for the device.
Because Ownership is available as a Policy Group match criterion, administrators can build dynamic Policy Groups that distinguish corporate-owned devices from personally owned (BYOD) devices within a shared Intune tenant. For example, you can combine the Known in Microsoft Intune trust attribute with Ownership = Corporate for a full-access Policy Group, and scope a separate, more restricted Policy Group to Ownership = Personal.
The Matched on attribute shows how Cloud Control Center matched the device to its Intune record and resolves to one of three values:
- MAC — the device was matched by MAC address.
- Hostname — the device was matched by a hostname from Microsoft Entra ID or Active Directory.
- DNS Hostname — the device was matched by a reverse DNS hostname.
Because Matched on is available as a Policy Group match criterion, administrators can exclude or separately scope devices matched by DNS Hostname, for example in a Policy Group that relies on Compliance State.