Integrations : SaaS: Microsoft Intune

Microsoft Intune Integration

Block 64's Microsoft Intune integration uses the Microsoft Graph API to collect hardware specifications and installed software from every enrolled device — Windows, macOS, iOS and Android — into a new Site named "Intune Devices", closing the inventory gap for mobile and BYOD endpoints that agent and appliance scans cannot reach.

Requires: an active Intune licence, and a Microsoft Entra administrator who can grant tenant-wide consent — Global Administrator, Privileged Role Administrator, or a least-privilege custom role.

Note: on iOS and Android, Intune reports only company-managed applications, so installed-software data is partial.

Overview

Once connected, Block 64 reads your Intune managed-device inventory on each sync and normalises it into a dedicated Site named Intune Devices. Devices appear alongside agent- and appliance-scanned endpoints in the existing hardware, software and discovery reports — no report configuration is required.

Devices already inventoried by another method are not double-counted. Block 64 identifies endpoints by device name and serial number, so a laptop seen by both the Block 64 agent and Intune resolves to a single endpoint.

This is a consent-based integration. There is no API key or secret to generate — you authorise Block 64's application in your Microsoft Entra tenant and Microsoft returns the authorisation to us.

Before You Begin

Use this sequence to set up the integration: confirm requirements, choose the consent approach, connect Intune in Block 64, wait for the first sync, then review data and reports.

Security & Privacy

• Block 64 requests a single read-only Graph permission, DeviceManagementManagedDevices.Read.All. Nothing is written back to Intune or Entra.

• No credentials or secrets are stored on your behalf — authorisation is held as a consent grant in your own tenant, and you can revoke it at any time.

• Only device inventory and installed-application metadata are collected. Device contents, user files, email, location and browsing activity are never accessed.

• On iOS and Android, only company-managed applications are visible to Intune, so personal applications are never collected.

Requirements

Granting Admin Consent

Connecting Intune requires tenant-wide admin consent, because Block 64 reads device inventory as an application rather than on behalf of a signed-in user.

Important: the Entra roles that sound like they should be sufficient are not. Cloud Application Administrator, Application Administrator and AI Administrator can consent to any permission for any API except Microsoft Graph application permissions — and DeviceManagementManagedDevices.Read.All is exactly that. An app registration Owner cannot grant tenant-wide consent either.

You have three options:

Option 3 — Least-privilege custom role

If your organisation does not want to involve a Global Administrator every time an integration is connected, Microsoft supports delegating consent through a custom directory role bound to a scoped app consent policy. The role can consent to approved applications and nothing else — it cannot assign directory roles, so it creates no privilege-escalation path.

A Global Administrator performs this once:

• Create an app consent policy scoped to the permission Block 64 needs
• DeviceManagementManagedDevices.Read.All:
  
  • DeviceManagementConfiguration.Read.All
  • DeviceManagementApps.Read.All
  • DeviceManagementRBAC.Read.All
  • DeviceManagementServiceConfig.Read.All
  on Microsoft Graph) — New-MgPolicyPermissionGrantPolicy, then New-MgPolicyPermissionGrantPolicyInclude.

• Create a custom role definition whose only permission is microsoft.directory/servicePrincipals/managePermissionGrantsForAll.<policy-id> — New-MgRoleManagementDirectoryRoleDefinition.

• Assign the role to the people who connect integrations — New-MgRoleManagementDirectoryRoleAssignment.

Prerequisites: Microsoft Entra ID P1, and Microsoft Graph PowerShell — the Entra admin center cannot add these permissions to a custom role definition. Consider making the assignment PIM-eligible rather than permanent if you have P2.

Reference: Microsoft, App consent permissions for custom roles.

Connect Intune in Block 64

• In Block 64, navigate to Config › Integrations.

• Locate the Microsoft Intune card and click Connect.

• You are redirected to Microsoft. Sign in with an account holding one of the roles above.

• Review the requested permission and click Accept.

• Microsoft returns you to Block 64 and the integration is recorded. The first sync is queued automatically.

Tip: the first sync makes roughly two Graph calls per device, so a large fleet can take several minutes. Refresh the Integrations page to watch the status change.

Data Collected

Device hardware

Installed software

Collected per device from Intune's detected-applications inventory: application name, version and publisher.

Limitations

Troubleshooting

Disconnecting Intune

Available options on the card.

• Navigate to Config › Integrations.

• Locate the Microsoft Intune card and click Disconnect.

Revoking Block 64's consent from the Microsoft side (Entra admin center › Enterprise applications) also stops collection.