Microsoft Intune connector

The Intune connector feeds the Portail ZAPP CMDB with the Windows devices managed by Microsoft Intune. Portail ZAPP queries the Microsoft service (Microsoft Graph) directly: there is no agent to install. The screens are reserved for administrators; the Microsoft Intune entry is in the Administration › Connectors and automation menu.

What is imported

At each collection, the connector reads the Windows devices enrolled in Intune (iOS, Android and macOS devices are not imported) and creates or updates, in the CMDB:

• one Computer per device: name, serial number, operating system and its version, Primary user;
• one Disk, named "Intune", with the device's capacity and free space (Intune does not give the per-volume detail);
• a "Wi-Fi" and an "Ethernet" Network adapter when the device reports their MAC address.

Installed software, manufacturer, model and compliance state are not imported.

A device already known is not duplicated: if another source (for example the Ivanti UEM connector) has already imported it, it is matched by its serial number, MAC addresses or name, and its fields are completed. When two sources give different values, Intune prevails for the primary user; for the serial number, a source that reads the hardware directly (Ivanti UEM) comes before Intune. The model never comes from Intune: it is filled in by another source.

Primary user: the email address provided by Intune is looked up among the Portail ZAPP accounts, ignoring case and accents. If no account matches, or if several accounts share the address, the field is not changed; the device is imported anyway.

Imported devices are found in the CMDB, type Computer.

Before creating a source

On the Microsoft side, an administrator of your directory prepares the access:

1. In the Microsoft Entra portal, they register an application (single tenant).
2. They grant it the Microsoft Graph application permission DeviceManagementManagedDevices.Read.All, with admin consent.
3. They create a client secret for this application and note the Directory (tenant) ID and the Application (client) ID, shown on the registration's Overview page.

In Portail ZAPP, store the client secret value in the Secrets vault: the source refers to this secret by its name, never by its value.

Creating a source

The Microsoft Intune sources page lists the sources with their name, slug, schedule and state. Click + New source and fill in:

• Name and Slug (short identifier; it can no longer be changed after creation);
• Directory (tenant) ID and Application (client) ID: two GUIDs, for example 00000000-0000-0000-0000-000000000000; any other value is refused when saving;
• Secret (application client secret): pick the secret from the list. If the list is empty, the create one link leads to the secrets vault;
• Schedule (cron, optional): how often to collect, chosen with the builder. Without a schedule, the source is never triggered automatically.

Click Save. An invalid schedule is refused and nothing is created.

Enabling, editing, deleting

• The button in the Enabled column (Yes / No) enables or suspends the source and its scheduled collection.
• Edit opens the same form; clearing the schedule removes the scheduled collection.
• The bin deletes the source and its scheduled collection, after confirmation. Devices already imported stay in the CMDB.

Following the collections

Each scheduled source creates a job in the Scheduler (Administration › Instance and operations › Scheduler), named Connector.Intune: followed by the source identifier. Its page lets you Trigger now a collection and shows the Execution history, where each collection gives the number of devices processed and of errors (N device(s), M error(s)):

• Success (green): all devices were imported;
• PartialSuccess (orange): some devices could not be processed; the others are imported normally;
• Error (red): the collection imported nothing — either no device could be processed, or the collection could not start; in the second case, the message is a code:

A collection that finds no Windows device succeeds, with 0 devices.