> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Intune

> Connect Microsoft Intune so Oleria can discover who can administer your Intune tenant, through Intune roles, Microsoft Entra roles, and Microsoft Graph permissions.

Connect Microsoft Intune to Oleria to see every user and application that can administer your Intune tenant, which Intune roles they hold, and what they did. You can also remove or grant Intune role access from Oleria, with approval. Microsoft Entra roles that grant Intune access are shown, but you change them through the [Microsoft Entra ID](/integrations/microsoft-entra-id) integration.

<Note>This is a governance integration. Oleria discovers the people and applications that hold Intune administrative access. It doesn't inventory managed devices, apps, or policies as resources.</Note>

## What Oleria discovers

| Area | Detail |
| :- | :- |
| **Accounts** | Users and service principals that hold Intune administrative access, through any of the paths in **Roles**. Users, guests, and applications with no Intune access aren't imported. Use the [Microsoft Entra ID](/integrations/microsoft-entra-id) integration for your full directory. |
| **Roles** | Every Intune role, built-in and custom, with its permissions. Oleria also shows Microsoft Entra roles that grant Intune access, such as **Global Administrator**, **Intune Administrator**, **Security Administrator**, and **Global Reader**, and each Microsoft Graph `DeviceManagement*` application permission an application holds. Microsoft Entra roles are read-only in this integration. |
| **Groups** | The Microsoft Entra groups that Intune role assignments name as admin groups, and the groups nested inside them. Intune assigns roles only to groups, so Oleria follows nested membership to find each account that holds a role. |
| **Role scope** | Each role assignment's scope groups and scope tags appear with the account's role membership. |
| **Non-human identities** | Service principals and managed identities that hold an Intune role through an admin group, an Entra role, or a Graph `DeviceManagement*` application permission. Graph application permissions bypass Intune role scoping, so Oleria treats every write permission as administrative. |
| **Account details** | Enabled state, user type, last sign-in, and MFA registration. Last sign-in and MFA require the optional `AuditLog.Read.All` permission. If Microsoft doesn't return a user's MFA registration, such as for a disabled user, Oleria shows MFA as unavailable for that user. |
| **Activity** | Intune audit events from every Intune workload: create, update, delete, assignment, and remote device actions, with the user or application that performed them. Changes Oleria makes are excluded. |

## Prerequisites

* An active Microsoft Intune license in the tenant.
* A Microsoft Entra administrator who can register an application and grant admin consent. Granting admin consent for Microsoft Graph application permissions requires **Privileged Role Administrator** or **Global Administrator**.

<Note>Oleria checks each required permission when you connect. If a permission is missing, the connection is refused with an error that names it.</Note>

## Set up the integration

<Steps>
  <Step title="Register an application">
    In the **Microsoft Entra admin center**, go to **App registrations** -> **New registration**. Create a single-tenant application for Oleria.

    On the application's **Overview** page, copy the **Directory (tenant) ID** and the **Application (client) ID**.
  </Step>

  <Step title="Add Microsoft Graph application permissions">
    Go to **API permissions** -> **Add a permission** -> **Microsoft Graph** -> **Application permissions**. Add the permissions you need from the table below.

    | Permission | Required? | Used for |
    | :- | :- | :- |
    | `DeviceManagementRBAC.Read.All` | Required | Intune roles and role assignments. |
    | `DeviceManagementApps.Read.All` | Required | Intune audit events. |
    | `GroupMember.Read.All` | Required | Admin groups and their members. |
    | `User.Read.All` | Required | User accounts. |
    | `Application.Read.All` | Required | Service principals and Graph application permissions. |
    | `RoleManagement.Read.Directory` | Required | Microsoft Entra roles with Intune access. |
    | `Organization.Read.All` | Required | Tenant name and default domain. |
    | `AuditLog.Read.All` | Optional | Last sign-in and MFA registration. Requires Microsoft Entra ID P1 or P2. Without it, Oleria shows MFA as unavailable. |
    | `Member.Read.Hidden` | Optional | Members of admin groups with hidden membership. Without it, Oleria shows the group but not its members. |
    | `GroupMember.ReadWrite.All` | Remediation only | Adding and removing admin-group members. |
    | `AppRoleAssignment.ReadWrite.All` | Remediation only | Removing Graph application permissions. |
    | `Application.ReadWrite.All` | Remediation only | Disabling service principals, and adding or removing a service principal in an admin group. Oleria requires it before removing a service principal, so it can restore the membership if you revert the removal. |
    | `RoleManagement.ReadWrite.Directory` | Only if an admin group is role-assignable | Changing the membership of an Intune admin group that can be assigned Microsoft Entra roles. This permission lets the application manage directory roles, so don't grant it unless you need it. Oleria never creates or deletes Microsoft Entra role assignments. |

    <Note>Use application permissions, not delegated permissions. Oleria connects as the application, without a signed-in user.</Note>
  </Step>

  <Step title="Grant admin consent">
    On the **API permissions** page, select **Grant admin consent for** your tenant, then confirm. Each permission's status must show **Granted**.
  </Step>

  <Step title="Create a credential">
    Go to **Certificates & secrets** and create one of these:

    * **Client secret.** Select **New client secret** and copy the secret's **Value**. It's shown only once.
    * **Certificate.** Upload a certificate. Keep a base64-encoded PEM file that contains both the certificate and its private key. You paste it into Oleria.
  </Step>
</Steps>

## Connect Microsoft Intune to Oleria

<Steps>
  <Step title="Open the integration">
    Sign in to your Oleria workspace and navigate to **Integrations** -> **Microsoft Intune** -> **Connect**.
  </Step>

  <Step title="Complete the connection form">
    | Field | Notes |
    | :- | :- |
    | **Tenant Id** | Required. The **Directory (tenant) ID**. You can't change it after the connection is created. |
    | **Client Id** | Required. The **Application (client) ID**. |
    | **Authentication Method** | **Client Secret Authentication** (default) or **Client Certificate Authentication**. |
    | **Client Secret** | Required for client secret authentication. The secret's **Value**, not its ID. |
    | **Client Certificate** | Required for client certificate authentication. The base64-encoded PEM with the certificate and its private key. |
  </Step>

  <Step title="Complete the connection">
    Select **Authenticate**. Oleria validates the credential and each required permission, then begins the first sync.
  </Step>
</Steps>

## Verify the integration

Confirm Microsoft Intune appears on the **Connected** tab of your Oleria **Integrations** page. After the first sync completes, you can review Intune administrators, roles, admin groups, and activity in your Oleria workspace.

## Remediation actions

Oleria checks that the application holds the permission each action needs before it runs. **Remove Account from Intune Role** and **Add Account to Intune Role** always require approval in Oleria. Every action that succeeds is reversible.

| Action | What it does |
| :- | :- |
| **Remove Account from Intune Role** | For an Intune role, removes the account from the admin group behind the role's assignment. For a Graph `DeviceManagement*` application permission, removes the application's grant. |
| **Add Account to Intune Role** | For an Intune role, adds the account to the role's admin group. The role must have exactly one assignment with one admin group, so the target group is unambiguous. |
| **Disable NHIs** | Disables a service principal that holds Intune access so it can't sign in. Reverting re-enables it only if Oleria disabled it. |

<Note>Microsoft Entra roles, such as **Global Administrator** or **Intune Administrator**, are read-only here. Both role actions refuse them. Change Microsoft Entra role assignments through the [Microsoft Entra ID](/integrations/microsoft-entra-id) integration or Privileged Identity Management.</Note>

<Warning>Intune assigns roles to groups, not to people. Removing an account from an Intune role removes it from that admin group, so the account also loses anything else the group grants, such as other Intune roles, Microsoft Entra roles, or application access. Review the group's other uses before you approve.</Warning>

Oleria refuses an action, and explains why, in these cases:

* **Nested access.** The account reaches the role through a nested group, even if it's also a direct member of the admin group. Removing only the direct membership wouldn't revoke the role, and Oleria never changes a nested or parent group. Remove the account from that group in Microsoft Entra ID instead.
* **Deep nesting.** The admin group nests groups more than 20 levels deep, so Oleria can't confirm the account has no access through them.
* **Groups Graph can't change.** The admin group has dynamic membership, is synchronized from on-premises Active Directory, or is a mail-enabled security group. Change the membership rule, the membership in Active Directory, or the membership in the Exchange admin center.
* **Microsoft Entra roles.** Oleria doesn't add or remove Microsoft Entra role assignments.
* **Granting Graph permissions.** Oleria removes Microsoft Graph `DeviceManagement*` application permissions but never grants them. Other Graph permissions are outside this integration.
* **Not an account.** The target must be a user or a service principal. Oleria never adds or removes a whole group.
* **Protected service principals.** Oleria won't change the roles of, or disable, its own application. It won't remove access from, or disable, a Microsoft first-party service principal. It won't disable a managed identity.
* **No Intune access.** Oleria disables only service principals that hold Intune access through an admin group, a Microsoft Entra role, or a Graph `DeviceManagement*` permission. Disable other service principals through the Microsoft Entra ID integration.

### If an action fails

When Microsoft Graph doesn't confirm a change, for example because a request times out, Oleria reads the result back. It doesn't report a change it can't confirm. If an action fails partway, Oleria undoes the changes it already made, so a failed action leaves your tenant as it was.

If Oleria can't confirm or undo a change, the action fails with an error that says what to check. For example, it may ask you to check whether an account is still a member of an admin group, or whether a service principal is still enabled. Check that object in the Microsoft Entra admin center and correct it if needed. A failed action can't be reverted from Oleria.

## Known limitations

* **Microsoft Entra roles are read-only:** Oleria shows Microsoft Entra roles that grant Intune access, but you change them through the [Microsoft Entra ID](/integrations/microsoft-entra-id) integration.
* **Deeply nested groups:** Groups nested more than 20 levels below an admin group appear with a `closureTruncated` label, and their members aren't imported.
* **PIM-eligible roles:** Oleria shows only active role assignments. A user who is eligible for an Intune-related Microsoft Entra role through Privileged Identity Management, but hasn't activated it, doesn't appear as holding it.
* **No resources:** Managed devices, apps, configuration profiles, and compliance policies aren't imported. Role scope groups and scope tags appear only as details of each role assignment.
* **Human account lifecycle:** Oleria doesn't disable users. To disable or offboard people, connect [Microsoft Entra ID](/integrations/microsoft-entra-id).
* **Group-level changes:** Oleria changes one account's access at a time. It doesn't remove a whole group from a role assignment or delete a role assignment.
* **Activity timing:** Intune audit events appear in Oleria after the next activity sync, at least 10 minutes after they occur.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.