Skip to main content
The Microsoft Intune connector is available in every edition, and is currently in beta.
BOW reads Intune through Microsoft Graph v1.0, signed in as an Entra app. IT and security admins can ask questions like “which devices are non-compliant?”, “who hasn’t synced in 30 days?” or “where is Chrome 129 still installed?”. The connector is read-only. Secrets Intune stores on devices — such as iOS activation-lock bypass codes and Autopilot product keys — are never selected, so the agent never sees them.

​
What the catalog looks like

If the app is missing a permission, the tables that need it are left out of the catalog instead of failing every question, and the connection test names the exact permission to grant.

​
Before you start

1

Register an app in Microsoft Entra ID

In the Entra admin center, create an app registration and a client secret for it.
2

Grant read-only Graph application permissions

Add these Microsoft Graph application permissions and grant admin consent: DeviceManagementManagedDevices.Read.All, DeviceManagementConfiguration.Read.All, DeviceManagementApps.Read.All and DeviceManagementServiceConfig.Read.All.
3

Paste the IDs and test

Enter the tenant ID, client ID and client secret in the connect form and click Test connection.

​
Fields

​
Authentication

Entra ID App (Service Principal) — service_principal (system scope, the only mode) Intune data is tenant-wide inventory, so the connection uses one app identity for everyone — there is no per-user sign-in.

​
Troubleshooting

The app lacks the Graph permission for that table (see the table above), or admin consent wasn’t granted. Add the permission, grant consent, and re-index the connection.
Graph throttles large tenants. BOW waits and retries automatically when Graph asks it to.