> ## Documentation Index > Fetch the complete documentation index at: https://docs.stackone.com/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft Intune OAuth 2.0 connector profile – StackOne setup guide > Set up the OAuth 2.0 connector profile for Microsoft Intune in StackOne. One-time admin setup required before your users can link Microsoft Intune accounts via Hub. You must have at least Application Developer permissions in your Azure account to register applications in Microsoft Entra ID. A Global Administrator must grant admin consent for the required delegated permissions. The tenant must have an active Microsoft Intune license (Plan 1 or Plan 2).
Select Actions to adjust the guide
Some actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.
Action
Scope(s)
Loading actions...
Dynamic Guide URL
Scopes Selected

          

            
Separator

Register Your Application in Microsoft Entra ID

Register an application in Microsoft Entra ID to obtain the OAuth 2.0 client credentials StackOne uses to run the authorization code flow.

Sign in to the Microsoft Entra admin center as at least an Application Developer. If you have access to multiple tenants, click the Settings (gear) icon in the top-right corner, then select the desired tenant from the list under Directory + subscription.

In the left navigation under Entra ID, click App registrations. You will see a list of your existing registered applications.

Microsoft Entra admin center App registrations page showing the New registration button in the toolbar and a list of existing registered applications.

Click New registration in the toolbar at the top of the page.

  • Enter a meaningful Name for your app (e.g., StackOne Intune Integration).
  • Under Supported account types, select Accounts in this organizational directory only for single-tenant access.
  • Leave the Redirect URI (optional) section blank for now — you will configure it in the next section.
  • Click Register to create the app registration.
Register an application form with Name field, Supported account types dropdown, optional Redirect URI section, and Register button.

After registration, you will be directed to the application's Overview page. In the Essentials section, locate Application (client) ID and copy its value. Paste it into the Client ID field when setting up the integration.

App registration Overview page showing Essentials section with Application (client) ID and Directory (tenant) ID values.

Configure Redirect URI

Set up the OAuth 2.0 callback URL to enable the authentication flow between StackOne and Microsoft Intune.

From your app's left menu under Manage, select Authentication (Preview).

Under Redirect URI configuration, click + Add Redirect URI. On the Select a platform to add redirect URI panel that opens, select Web under Web applications.

In the Redirect URI field that appears, enter the StackOne OAuth callback URL and click Configure.

  • Redirect URI — `https://api.stackone.com/connect/oauth2/microsoftintune/callback`

Configure API Permissions

Grant your application the Microsoft Graph delegated permissions required for Intune device management. API access is controlled by the permissions granted here and by the Intune role assigned to the signing-in user.

From the left menu under Manage, select API permissions.

API permissions page showing Configured permissions with Add a permission and Grant admin consent buttons.

Click Add a permission, then select Microsoft Graph from the commonly used Microsoft APIs.

Request API permissions panel showing the Select an API step with Microsoft Graph listed under Commonly used Microsoft APIs.

Select Delegated permissions — the application accesses the API as the signed-in user.

Request API permissions panel asking what type of permissions the application requires, with Delegated permissions and Application permissions options.
Enables actions: Assign Device Compliance Policy, Assign Device Configuration, Assign Device Enrollment Configuration, Assign Mobile App, Bypass Activation Lock, Clean Windows Device, Create Role Definition, Delete Device Compliance Policy, Delete Device Configuration, Delete Managed Device, Delete Role Definition, Disable Lost Mode, Get Detected App, Get Device Category, Get Device Compliance Policy, Get Device Configuration, Get Device Enrollment Configuration, Get Managed Device, Get Mobile App, Get Mobile App Category, Get Role Definition, List Detected App Managed Devices, List Detected Apps, List Device Compliance Policies, List Device Configurations, List Device Enrollment Configurations, List Managed Devices, List Mobile App Categories, List Mobile Apps, List Role Assignments, List Role Definitions, Locate Device, Reboot Device, Remote Lock, Reset Passcode, Retire Managed Device, Set Enrollment Priority, Shut Down Device, Sync Device, Update Role Definition, Windows Defender Scan, Windows Defender Update Signatures, Wipe Managed Device

Expand each DeviceManagement category (e.g., DeviceManagementManagedDevices, DeviceManagementConfiguration, DeviceManagementApps, DeviceManagementRBAC, DeviceManagementServiceConfig) to find and select the individual permissions. Click Add permissions to save.

For read-only access, select all `.Read.All` scopes. For full read-write access, select all listed scopes. Remote device actions (wipe, lock, reboot) additionally require `DeviceManagementManagedDevices.PrivilegedOperations.All`.

Click Grant admin consent for \[tenant name] and select Yes to consent on behalf of the organization. After granting, verify that the Status column shows a green checkmark for each permission. Without admin consent, API calls return 403 Forbidden errors.

Generate Client Secret

Create a client secret that StackOne uses to exchange the authorization code for tokens.

From the left menu under Manage, select Certificates & secrets.

Certificates & secrets page showing Client secrets tab with New client secret button and existing secrets listed with Description, Expires, Value, and Secret ID columns.

Under the Client secrets tab, click New client secret.

  • Add a Description (e.g., StackOne Intune Integration Secret).
  • Select an appropriate expiration period from the Expires dropdown.
  • Click Add.
Add a client secret dialog with Description text field and Expires dropdown defaulting to Recommended 180 days (6 months), plus Add and Cancel buttons.

Immediately copy the Value of the newly created client secret and paste it into the Client Secret field. This value is only shown once and cannot be retrieved again.

The Scopes field is optional. If left blank, it defaults to `https://graph.microsoft.com/.default offline_access`, which requests every permission granted to the app registration. When supplying custom scopes, separate them with spaces and always include `offline_access` (required for refresh tokens) — for example `DeviceManagementManagedDevices.Read.All DeviceManagementConfiguration.Read.All offline_access` for read-only access.
## Creating the StackOne Connector Profile To create the Connector Profile in StackOne for Microsoft Intune: Login to StackOne and navigate to [Connector Profiles](https://app.stackone.com/connector_profiles)
  • Click + Connector Profile
  • Search for and select Microsoft Intune
  • Select Type as OAuth 2.0
  • Fill out the fields using details retrieved from your provider:
    • Client ID
    • Client Secret
    • Scopes (Optional)
  • (Optional) Select Actions to be enabled for this Connector Profile
  • Click Create profile
 Congratulations! The new Connector Profile will now show up in your project ready to be used. You can now continue to Link Accounts for Microsoft Intune.