Connecting Microsoft Intune
Step-by-step setup of the read-only Intune connector, and what data it brings in.
The Intune connector brings in every device Intune manages, with its hardware details and the apps Intune detected on it.
Coming at launch The Intune connector is planned for the first release.
What you get
- Devices: serial number, manufacturer, model, operating system and version, Entra device ID, primary user, last check-in and disk encryption status.
- Software: the apps Intune detected on each device.
It runs as a full sync every 6 hours by default.
What you need
- An active Microsoft Intune licence. Intune is included in Microsoft 365 Business Premium, E3 and E5, and is also sold on its own.
- Permission in Entra ID to register an app and grant admin consent.
Step 1: register a read-only app in Entra ID
- In the Entra admin center, go to App registrations → New registration. Choose single tenant and give it a clear name, for example AssetTrove inventory (read-only).
- Go to API permissions → Add a permission → Microsoft Graph → Application permissions and add
DeviceManagementManagedDevices.Read.All. This one read-only permission covers both devices and detected apps. - Select Grant admin consent.
- Go to Certificates & secrets → New client secret. Copy the value and note its expiry date.
Important It must be an application permission, not a delegated one. A delegated permission can't be used by a background sync and the connection will fail.
Step 2: add the source in AssetTrove
- Go to Discovery → New source → Intune.
- Enter the tenant ID, client ID and client secret.
- Select Test connection.
- Choose whether to create new assets automatically for devices AssetTrove doesn't know yet.
The client secret is encrypted for your organisation and never shown again or written to logs. AssetTrove only ever reads from Intune; it never changes anything there.
When the secret expires
Client secrets expire, typically after 6 to 24 months. When yours does, the source shows the error Source authentication failed. Create a new secret in Entra ID and paste it into the source in AssetTrove. Put a reminder in your calendar for the expiry date.
Limits to know
Intune's software inventory is only as good as Intune's own. Windows and macOS devices report well; personally owned phones report very little, by Microsoft's design.