Microsoft Intune OAuth 2.0 connector profile – StackOne setup guide

Sign in to the Microsoft Entra admin center as at least an Application Developer. If you have access to multiple tenants, click the Settings (gear) icon in the top-right corner, then select the desired tenant from the list under Directory + subscription.

In the left navigation under Entra ID, click App registrations. You will see a list of your existing registered applications.

Click New registration in the toolbar at the top of the page.

• Enter a meaningful Name for your app (e.g., StackOne Intune Integration).
• Under Supported account types, select Accounts in this organizational directory only for single-tenant access.
• Leave the Redirect URI (optional) section blank for now — you will configure it in the next section.
• Click Register to create the app registration.

After registration, you will be directed to the application’s Overview page. In the Essentials section, locate Application (client) ID and copy its value. Paste it into the Client ID field when setting up the integration.

From your app’s left menu under Manage, select Authentication (Preview).

Under Redirect URI configuration, click + Add Redirect URI. On the Select a platform to add redirect URI panel that opens, select Web under Web applications.

In the Redirect URI field that appears, enter the StackOne OAuth callback URL and click Configure.

• Redirect URI — https://api.stackone.com/connect/oauth2/microsoftintune/callback

From the left menu under Manage, select API permissions.

Click Add a permission, then select Microsoft Graph from the commonly used Microsoft APIs.

Select Delegated permissions — the application accesses the API as the signed-in user.

Expand each DeviceManagement category (e.g., DeviceManagementManagedDevices, DeviceManagementConfiguration, DeviceManagementApps, DeviceManagementRBAC, DeviceManagementServiceConfig) to find and select the individual permissions. Click Add permissions to save.

For read-only access, select all .Read.All scopes. For full read-write access, select all listed scopes. Remote device actions (wipe, lock, reboot) additionally require DeviceManagementManagedDevices.PrivilegedOperations.All.

Click Grant admin consent for [tenant name] and select Yes to consent on behalf of the organization. After granting, verify that the Status column shows a green checkmark for each permission. Without admin consent, API calls return 403 Forbidden errors.

From the left menu under Manage, select Certificates & secrets.

Under the Client secrets tab, click New client secret.

• Add a Description (e.g., StackOne Intune Integration Secret).
• Select an appropriate expiration period from the Expires dropdown.
• Click Add.

Immediately copy the Value of the newly created client secret and paste it into the Client Secret field. This value is only shown once and cannot be retrieved again.

The Scopes field is optional. If left blank, it defaults to https://graph.microsoft.com/.default offline_access, which requests every permission granted to the app registration. When supplying custom scopes, separate them with spaces and always include offline_access (required for refresh tokens) — for example DeviceManagementManagedDevices.Read.All DeviceManagementConfiguration.Read.All offline_access for read-only access.