Introduction

The SAFE integration with Microsoft Intune ingests managed device inventory (hostname, OS, serial, manufacturer, model, MAC address, management agent) and platform-detected software (name, version, publisher) mapped back to individual devices. SAFE admins can configure this integration from the "Microsoft Intune" card available on the Integrations page.

SAFE uses AI to aggregate, normalise and deduplicate the ingested data from Intune, along with information from your existing IT and cybersecurity tools. This creates a unified view of your entire asset inventory, including its operational and business context.To check sync status and errors for this integration, see Integration History.

What SAFE Imports from Intune

Notes

• Intune is used as an asset and software inventory source only. SAFE does not import vulnerability, compliance, or EDR findings from this connector.
• Device compliance state, encryption status, jailbreak or root status, and related security-control findings are not ingested into SAFE, even when these attributes are returned by Microsoft Graph.
• SAFE matches and deduplicates imported assets using macAddress and assetName.

Data Synchronization Behavior

Every synchronization is a full synchronization for this integration. Incremental or delta synchronization is not supported.

Prerequisites and Permissions

• Microsoft Entra ID (Azure AD) tenant with an active Intune licence.

• Admin access to the Azure Portal to create an App Registration, generate a client secret, and grant admin consent for API permissions.

• The following Microsoft Graph application permissions on the App Registration (admin-consented):

  • DeviceManagementManagedDevices.Read.All — required. This covers managed devices and detected apps(software inventory).

• SAFE access with an admin role.

• Outbound HTTPS connectivity from SAFE to login.microsoftonline.com and Microsoft Graph Dev Center | APIs and app development .

Network or IP allowlisting requirements
>
Ensure SAFE can reach Intune API endpoints. Allow SAFE IPs, if required by your network policy.

Generate connection details

To integrate SAFE with Microsoft Intune, you need the folowing details from Azure:

• Tenant ID (Directory ID)

• Client ID (Application ID)

• Client Secret

Register an application in Microsoft Entra ID

1. Log in to the Azure Portal.

2. Navigate to Microsoft Entra ID.

3. Go to App registrations and click New registration.

4. On the registration page:

   1. Name: enter an application name of your choice (for example, SAFE-Intune-Connector).
   2. Supported account types: select "Accounts in this organizational directory only (Single tenant)".
   3. Redirect URI: leave blank.

5. Click Register.

Get Tenant ID and Client ID

1. Navigate and open the newly registered application and go to the Overview page.

2. Here system displays the Application (Client) ID and Directory (Tenant) ID.

3. Copy and save the the Application (Client) ID and Directory (Tenant) ID.

Generate Client Secret

A newly registered application has no client secrets. To create one:

1. Navigate to Certificates & secrets from the left navigation.

2. Click New client secret.

3. Enter a Description and select an Expiry period.

4. Click Add.

5. Copy the Value field. This is the Client Secret. Store it securely; Azure will not display it again after you leave the page.

Configure API permissions on the application

1. Open the app and navigate to API permissions.

2. Select + Add a permission.

3. Under Microsoft APIs, click Microsoft Graph.

4. Select Application permissions (not Delegated permissions).

5. Search for and select the following permissions:

   1. DeviceManagementManagedDevices.Read.All

6. Click Add permissions.

7. After assigning the permissions, click Grant admin consent for <tenant> and confirm. The Status column must show a green check for the permission.

Configure Microsoft Intune integration in SAFE

1. Log in to SAFE as an admin and navigate to Integrations.

2. Click the + button on the top-right corner of the page

3. Search for Microsoft Intune and click the Intune Card.

4. Enter an unique name for the Integration.

5. Enter the Tenant ID, Client ID, and Client Secret. Refer to Generate Connection Details.

6. [Optional] Enter API Filter: Specify an OData filter to control which managed devices SAFE imports from Intune.

   1. Enter an OData filter value, for example operatingSystem eq 'Windows' or managementAgent eq 'configurationManagerClientMdm'. SAFE sends it as $filter=<value>.
   2. Leave this field blank to import all enrolled devices.
   3. Applying a narrower filter can reduce synchronization time.

7. Click Test Connection once you have entered the credentials.

8. Once verified, click Save to save the integration.

9. Once the integration is saved, click Sync Now to trigger an on-demand sync.

View Results

To view the assets and their software inventory:

1. From the SAFE Integrations page, click on the Microsoft Intune card.

2. A page with "Finding View" and "Asset View" tabs will open up.

3. Asset View will list all the managed devices pulled or updated from Intune, along with their OS, serial number, manufacturer, model, and MAC address.

4. Detected software for each device is available on the asset's software inventory.

5. Finding View will be empty for this integration.

API Details

The integration uses Microsoft Graph REST API v1.0 and the OAuth 2.0 client-credentials flow.

Note

Software inventory is retrieved in two phases: SAFE first lists detected applications and then retrieves the devices associated with each application.

FAQs

How often does SAFE synchronize with Intune?

The default interval is seven days. Administrators can change the Auto Sync (in Days) value or initiate an on-demand synchronization using Sync Now.

Does the integration support incremental synchronization?

No. Every run is a full synchronization of the in-scope devices and detected applications.

Why does Test Connection succeed, but no assets are imported?

Review the API Filter. An invalid or overly restrictive filter can return no devices. Clear the filter and synchronize again to validate the configuration.

Why are devices visible but their software inventory is missing?

Software retrieval runs separately from device retrieval. If it fails, devices are still imported and the sync completes. Confirm that DeviceManagementManagedDevices.Read.All is admin-consented; it also covers the detected-apps endpoints. If the device lookup for a single application fails, that application is skipped and the sync continues.

Why does synchronization fail with an HTTP 401 error?

Verify that:

• The client secret has not expired.

• The configured secret is the secret value, not its ID.

• The Tenant ID and Client ID are correct.

• Administrator consent has been granted for DeviceManagementManagedDevices.Read.All.

• A rotated secret has also been updated in SAFE.

How can I retrieve only co-managed devices?

Enter the following API filter: managementAgent eq 'configurationManagerClientMdm'

How can I reduce synchronization time?

Use an OData filter to reduce the number of devices retrieved. In large tenants, detected-application lookups can still take time because SAFE resolves the device associations for each application.

How does SAFE handle duplicate assets?

SAFE matches and deduplicates assets using macAddress and assetName.

Why are vulnerability or compliance findings not displayed?

This connector imports asset and software inventory only. It does not map Intune compliance status, encryption status, jailbreak status, or vulnerability findings into SAFE.

Why is the IP address missing?

The Microsoft Graph v1.0 managed-device endpoint used by the connector does not return device IP addresses. SAFE may obtain an IP address for the same asset from another integration.

Which MAC address does SAFE use?

SAFE maps wiFiMacAddress. It does not import ethernetMacAddress.

Can historical information be re-imported?

Yes. Because every run performs a full fetch, selecting Sync Now re-imports all currently available in-scope data.

What should I do before the client secret expires?

Create a replacement secret in Microsoft Entra ID, update the Client Secret in SAFE, run Test Connection, save the configuration, and then remove the expired secret according to your credential-management policy.

Did this article help?

Let us know by leaving a star rating at the top of this article.