Intune import
Prerequisites
Access to the Azure Portal or Microsoft Entra admin center, with at least the Application Developer role (or equivalent) in your tenant.
Create a client secret
- In Azure Portal or Entra admin center, go to App registrations, and select your existing app (or + New registration).
- Open Certificates & secrets → + New client secret.
- Give it a description (e.g. "App authentication secret — expires 2027"), an expiry (6–12 months recommended, 24 months maximum), and Add.
- Copy the secret's Value immediately — it's shown only once; store it securely (e.g. in a secrets manager).
You'll also need the app's Application (client) ID and Directory (tenant) ID, both on its Overview page.
Grant Intune permissions
- On the app registration, open API permissions → + Add a permission → Microsoft Graph.
- Choose Application permissions (for a background/daemon import) or Delegated permissions (acting on behalf of a signed-in user).
- Search "DeviceManagement" for the permissions you need — common least-privilege choices:
| Permission | What it allows |
|---|---|
DeviceManagementManagedDevices.Read.All | Read devices, compliance status, categories — inventory/reporting |
DeviceManagementManagedDevices.ReadWrite.All | Read + manage devices (wipe, retire, sync) |
DeviceManagementApps.Read.All | Read apps and app configurations |
DeviceManagementApps.ReadWrite.All | Read + create/update/delete apps and configs |
DeviceManagementConfiguration.Read.All | Read configuration policies and settings |
DeviceManagementConfiguration.ReadWrite.All | Read + create/update policies |
DeviceManagementServiceConfig.Read.All | Read tenant-wide Intune settings |
DeviceManagementServiceConfig.ReadWrite.All | Read + modify tenant-wide Intune settings |
DeviceManagementRBAC.Read.All | Read role-based access control settings |
DeviceManagementScripts.Read.All / .ReadWrite.All | Read, or read + manage, PowerShell/Shell scripts |
- Grant admin consent for [your tenant], and confirm — this applies the permissions tenant-wide, and is required before the import can actually read data.
Creating the import source in Starhive
Use the client ID, tenant ID, and client secret from above to configure the import source.