This is a governance integration. Oleria discovers the people and applications that hold Intune administrative access. It doesn’t inventory managed devices, apps, or policies as resources.
What Oleria discovers
Prerequisites
- An active Microsoft Intune license in the tenant.
- A Microsoft Entra administrator who can register an application and grant admin consent. Granting admin consent for Microsoft Graph application permissions requires Privileged Role Administrator or Global Administrator.
Oleria checks each required permission when you connect. If a permission is missing, the connection is refused with an error that names it.
Set up the integration
1
Register an application
In the Microsoft Entra admin center, go to App registrations -> New registration. Create a single-tenant application for Oleria.On the application’s Overview page, copy the Directory (tenant) ID and the Application (client) ID.
2
Add Microsoft Graph application permissions
Go to API permissions -> Add a permission -> Microsoft Graph -> Application permissions. Add the permissions you need from the table below.
Use application permissions, not delegated permissions. Oleria connects as the application, without a signed-in user.
3
Grant admin consent
On the API permissions page, select Grant admin consent for your tenant, then confirm. Each permission’s status must show Granted.
4
Create a credential
Go to Certificates & secrets and create one of these:
- Client secret. Select New client secret and copy the secret’s Value. It’s shown only once.
- Certificate. Upload a certificate. Keep a base64-encoded PEM file that contains both the certificate and its private key. You paste it into Oleria.
Connect Microsoft Intune to Oleria
1
Open the integration
Sign in to your Oleria workspace and navigate to Integrations -> Microsoft Intune -> Connect.
2
Complete the connection form
3
Complete the connection
Select Authenticate. Oleria validates the credential and each required permission, then begins the first sync.
Verify the integration
Confirm Microsoft Intune appears on the Connected tab of your Oleria Integrations page. After the first sync completes, you can review Intune administrators, roles, admin groups, and activity in your Oleria workspace.Remediation actions
Oleria checks that the application holds the permission each action needs before it runs. Remove Account from Intune Role and Add Account to Intune Role always require approval in Oleria. Every action that succeeds is reversible.Microsoft Entra roles, such as Global Administrator or Intune Administrator, are read-only here. Both role actions refuse them. Change Microsoft Entra role assignments through the Microsoft Entra ID integration or Privileged Identity Management.
- Nested access. The account reaches the role through a nested group, even if it’s also a direct member of the admin group. Removing only the direct membership wouldn’t revoke the role, and Oleria never changes a nested or parent group. Remove the account from that group in Microsoft Entra ID instead.
- Deep nesting. The admin group nests groups more than 20 levels deep, so Oleria can’t confirm the account has no access through them.
- Groups Graph can’t change. The admin group has dynamic membership, is synchronized from on-premises Active Directory, or is a mail-enabled security group. Change the membership rule, the membership in Active Directory, or the membership in the Exchange admin center.
- Microsoft Entra roles. Oleria doesn’t add or remove Microsoft Entra role assignments.
- Granting Graph permissions. Oleria removes Microsoft Graph
DeviceManagement*application permissions but never grants them. Other Graph permissions are outside this integration. - Not an account. The target must be a user or a service principal. Oleria never adds or removes a whole group.
- Protected service principals. Oleria won’t change the roles of, or disable, its own application. It won’t remove access from, or disable, a Microsoft first-party service principal. It won’t disable a managed identity.
- No Intune access. Oleria disables only service principals that hold Intune access through an admin group, a Microsoft Entra role, or a Graph
DeviceManagement*permission. Disable other service principals through the Microsoft Entra ID integration.
If an action fails
When Microsoft Graph doesn’t confirm a change, for example because a request times out, Oleria reads the result back. It doesn’t report a change it can’t confirm. If an action fails partway, Oleria undoes the changes it already made, so a failed action leaves your tenant as it was. If Oleria can’t confirm or undo a change, the action fails with an error that says what to check. For example, it may ask you to check whether an account is still a member of an admin group, or whether a service principal is still enabled. Check that object in the Microsoft Entra admin center and correct it if needed. A failed action can’t be reverted from Oleria.Known limitations
- Microsoft Entra roles are read-only: Oleria shows Microsoft Entra roles that grant Intune access, but you change them through the Microsoft Entra ID integration.
- Deeply nested groups: Groups nested more than 20 levels below an admin group appear with a
closureTruncatedlabel, and their members aren’t imported. - PIM-eligible roles: Oleria shows only active role assignments. A user who is eligible for an Intune-related Microsoft Entra role through Privileged Identity Management, but hasn’t activated it, doesn’t appear as holding it.
- No resources: Managed devices, apps, configuration profiles, and compliance policies aren’t imported. Role scope groups and scope tags appear only as details of each role assignment.
- Human account lifecycle: Oleria doesn’t disable users. To disable or offboard people, connect Microsoft Entra ID.
- Group-level changes: Oleria changes one account’s access at a time. It doesn’t remove a whole group from a role assignment or delete a role assignment.
- Activity timing: Intune audit events appear in Oleria after the next activity sync, at least 10 minutes after they occur.