> ## Documentation Index
> Fetch the complete documentation index at: https://docs.axiomancer.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Intune

> Connect Microsoft Intune to Layer to inventory managed devices, compliance policies, conditional access rules, and configuration baselines across your fleet.

The Microsoft Intune integration syncs your managed device fleet — laptops, phones, and tablets — along with compliance policies and conditional access rules. Use it to track device health, encryption status, and OS versions across your organization.

## What you'll need

* A Microsoft 365 tenant with Intune licenses assigned.
* **Global Administrator** (or Intune Administrator) role to grant admin consent.
* Two minutes.

## Set it up

### Option A — one-click OAuth (recommended)

<Steps>
  <Step title="Open the Intune integration in Layer">
    In Layer, go to **Integrations**, find Microsoft Intune, and click **Connect**.
  </Step>

  <Step title="Sign in and grant consent">
    You'll be redirected to Microsoft's sign-in screen. Use a Global Admin or Intune Admin account and tick **Consent on behalf of your organization**, then click **Accept**.
  </Step>

  <Step title="Wait for the first sync">
    The initial sync runs immediately and typically finishes in 10–20 minutes depending on fleet size.
  </Step>
</Steps>

### Option B — manual credentials

Use this method if your organization requires a dedicated app registration instead of delegated OAuth.

<Steps>
  <Step title="Register an app in Azure">
    In the Azure portal, go to **App registrations → New registration**.

    * Name: `Axiom Layer — Intune`
    * Supported account types: **Single tenant**

    After creation, copy the **Application (client) ID** and **Directory (tenant) ID** from the overview page.
  </Step>

  <Step title="Create a client secret">
    Go to **Certificates & secrets → New client secret**. Copy the secret value — you won't be able to see it again.
  </Step>

  <Step title="Grant API permissions">
    Go to **API permissions → Add a permission → Microsoft Graph → Application permissions** and add:

    * `DeviceManagementManagedDevices.Read.All` — read managed devices
    * `DeviceManagementConfiguration.Read.All` — read compliance and configuration policies
    * `Policy.Read.All` — read conditional access policies

    Click **Grant admin consent** for your tenant.
  </Step>

  <Step title="Paste credentials into Layer">
    In Layer, go to **Integrations → Microsoft Intune → Connect** and enter:

    * **Tenant ID**
    * **Client ID**
    * **Client Secret**
  </Step>

  <Step title="Wait for the first sync">
    The first sync pulls devices, compliance policies, and conditional access policies. Typically finishes in 10–20 minutes.
  </Step>
</Steps>

## What gets synced

| Object                      | Fields                                                                                                       | Refresh cadence |
| --------------------------- | ------------------------------------------------------------------------------------------------------------ | --------------- |
| Managed devices             | name, serial number, model, OS, OS version, compliance state, encryption state, assigned user, last check-in | Every 6 hours   |
| Compliance policies         | name, platforms, last modified date                                                                          | Every 6 hours   |
| Conditional access policies | name, state (enabled/disabled), created and modified dates                                                   | Every 6 hours   |

## Token refresh

When you connect via OAuth, Microsoft access tokens expire approximately one hour after they are issued. Layer automatically refreshes tokens in the background each time a sync runs, so your connection stays active without any manual re-authorization. If a refresh fails — for example, because an admin revoked consent in the Azure portal — the connection status changes to **needs re-auth** and you can reconnect with one click.

## Use cases

* **Device inventory** — see every managed laptop, phone, and tablet in one place, with model, OS, and assigned user.
* **Compliance monitoring** — check which devices are compliant, non-compliant, or not evaluated, and track encryption status.
* **Offboarding** — identify devices assigned to departing employees so you can wipe or reassign them.
* **Audit evidence** — Intune data feeds into [Axiom Codex](/codex/index) as evidence for SOC 2 and ISO 27001 device-management controls.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Connection shows needs re-auth">
    This means Layer could not refresh the access token automatically. The most common cause is revoked consent or an expired client secret. Go to **Integrations → Microsoft Intune** and click **Reconnect** to re-authorize.
  </Accordion>

  <Accordion title="Zero devices after first sync">
    Verify that Intune licenses are assigned to users in your tenant and that devices are enrolled. If you used manual credentials, confirm the app registration has the correct API permissions and that admin consent was granted.
  </Accordion>

  <Accordion title="Compliance state shows 'not evaluated'">
    Devices that haven't checked in recently or don't have a compliance policy assigned will show as "not evaluated." Assign a compliance policy in the Intune admin center and wait for the next device check-in.
  </Accordion>

  <Accordion title="I want to disconnect">
    Go to **Integrations → Microsoft Intune → Disconnect** in Layer. If you used OAuth, also remove the Axiom app from **Enterprise Applications** in the Azure portal. If you used manual credentials, delete or disable the app registration.
  </Accordion>
</AccordionGroup>