Connect Microsoft Intune with OAuth 2.0 (Client Credentials) – StackOne Hub

Link a Microsoft Intune account in the StackOne Hub using OAuth 2.0 (Client Credentials). End-user guide to authorize the integration and start using Microsoft Intune actions.

You must have at least Application Developer permissions in your Azure account to register applications in Microsoft Entra ID. A Global Administrator must grant admin consent for the required application permissions. The tenant must have an active Microsoft Intune license (Plan 1 or Plan 2).

Register Your Application in Microsoft Entra ID

Register an application in Microsoft Entra ID to obtain OAuth 2.0 client credentials for the integration.

1. Sign in to Microsoft Entra Admin Center

   Sign in to the Microsoft Entra admin center. If you have access to multiple tenants, click the Settings (gear) icon in the top-right corner, then select the desired tenant from the list under Directory + subscription.

2. Navigate to App Registrations

   In the left navigation under Entra ID, click App registrations. You will see a list of your existing registered applications.

   
3. Create a New App Registration

   Click New registration in the toolbar at the top of the page.

   • Enter a meaningful Name for your app (e.g., StackOne Intune Integration).
   • Under Supported account types, select Accounts in this organizational directory only for single-tenant access.
   • You do not need to configure a Redirect URI for client credentials flow.
   • Click Register to create the app registration.

   
4. Copy the Application (Client) ID

   After registration, you will be directed to the application’s Overview page. In the Essentials section, locate Application (client) ID and copy its value. Paste it into the Client ID field when connecting your account.

   
5. Copy the Directory (Tenant) ID

   From the same Essentials section on the Overview page, locate Directory (tenant) ID and copy its value. Paste it into the Tenant ID field when connecting your account.

Configure Application Permissions

Grant your application the necessary Microsoft Graph API application permissions for Intune device management.

1. Open API Permissions

   From the left menu under Manage, select API permissions.

   
2. Add Microsoft Graph Application Permissions

   Enables actions: Assign Device Compliance Policy, Assign Device Configuration, Assign Device Enrollment Configuration, Assign Mobile App, Bypass Activation Lock, Clean Windows Device, Create Role Definition, Delete Device Compliance Policy, Delete Device Configuration, Delete Managed Device, Delete Role Definition, Disable Lost Mode, Get Detected App, Get Device Category, Get Device Compliance Policy, Get Device Configuration, Get Device Enrollment Configuration, Get Managed Device, Get Mobile App, Get Mobile App Category, Get Role Definition, List Detected App Managed Devices, List Detected Apps, List Device Compliance Policies, List Device Configurations, List Device Enrollment Configurations, List Managed Devices, List Mobile App Categories, List Mobile Apps, List Role Assignments, List Role Definitions, Locate Device, Reboot Device, Remote Lock, Reset Passcode, Retire Managed Device, Set Enrollment Priority, Shut Down Device, Sync Device, Update Role Definition, Windows Defender Scan, Windows Defender Update Signatures, Wipe Managed Device

   Click Add a permission, then select Microsoft Graph from the commonly used Microsoft APIs. Select Application permissions and search for the Intune-specific scopes required for your use case, then click Add permissions to save.
   
   Choose the minimum scopes needed for your use case. Read-only access requires only the .Read.All scopes. Write access and remote device actions require the .ReadWrite.All and .PrivilegedOperations.All scopes respectively.

   

   • DeviceManagementManagedDevices.Read.All⧉
   • DeviceManagementManagedDevices.ReadWrite.All⧉
   • DeviceManagementManagedDevices.PrivilegedOperations.All⧉
   • DeviceManagementConfiguration.Read.All⧉
   • DeviceManagementConfiguration.ReadWrite.All⧉
   • DeviceManagementApps.Read.All⧉
   • DeviceManagementApps.ReadWrite.All⧉
   • DeviceManagementRBAC.Read.All⧉
   • DeviceManagementRBAC.ReadWrite.All⧉
   • DeviceManagementServiceConfig.Read.All⧉
   • DeviceManagementServiceConfig.ReadWrite.All⧉
3. Grant Admin Consent

   Click Grant admin consent for [tenant name] and select Yes to consent on behalf of the organization. After granting, verify that the Status column shows a green checkmark for each permission. A Global Administrator is required to grant consent for these permissions.

Generate Client Secret

Create a client secret that will be used to authenticate your application.

1. Navigate to Certificates & Secrets

   From the left menu under Manage, select Certificates & secrets.

   
2. Create a New Client Secret

   Under the Client secrets tab, click New client secret.

   • Add a Description (e.g., StackOne Intune Integration Secret).
   • Select an appropriate expiration period from the Expires dropdown.
   • Click Add.

   
3. Copy the Client Secret Value

   Immediately copy the Value of the newly created client secret and store it securely. You will need this when connecting your account. This value is only shown once and cannot be retrieved again.

Linking the Account from the Hub

1. Navigate to the Hub

   Use one of the three Linking Account Methods to access the Hub.

2. Fill out the fields

   Fill out the following fields using details from your provider:

   • Tenant ID
   • Client ID
   • Client Secret
3. Connect

   • Click Connect
   • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
   • Once authorization is successful, you will see a confirmation popup

If the account linking is successful, you will see the newly linked account in your Accounts page.