Skip to main content
You must have at least Application Developer permissions in your Azure account to register applications in Microsoft Entra ID. A Global Administrator must grant admin consent for the required application permissions. The tenant must have an active Microsoft Intune license (Plan 1 or Plan 2).

​
Register Your Application in Microsoft Entra ID

Register an application in Microsoft Entra ID to obtain OAuth 2.0 client credentials for the integration.

1

Sign in to Microsoft Entra Admin Center

Sign in to the Microsoft Entra admin center. If you have access to multiple tenants, click the Settings (gear) icon in the top-right corner, then select the desired tenant from the list under Directory + subscription.

2

Navigate to App Registrations

In the left navigation under Entra ID, click App registrations. You will see a list of your existing registered applications.

Microsoft Entra admin center App registrations page showing the New registration button in the toolbar and a list of existing registered applications.
3

Create a New App Registration

Click New registration in the toolbar at the top of the page.

  • Enter a meaningful Name for your app (e.g., StackOne Intune Integration).
  • Under Supported account types, select Accounts in this organizational directory only for single-tenant access.
  • You do not need to configure a Redirect URI for client credentials flow.
  • Click Register to create the app registration.
Register an application form with Name field, Supported account types dropdown, optional Redirect URI section, and Register button.
4

Copy the Application (Client) ID

After registration, you will be directed to the application’s Overview page. In the Essentials section, locate Application (client) ID and copy its value. Paste it into the Client ID field when connecting your account.

App registration Overview page showing Essentials section with Application (client) ID and Directory (tenant) ID values.
5

Copy the Directory (Tenant) ID

From the same Essentials section on the Overview page, locate Directory (tenant) ID and copy its value. Paste it into the Tenant ID field when connecting your account.

​
Configure Application Permissions

Grant your application the necessary Microsoft Graph API application permissions for Intune device management.

1

Open API Permissions

From the left menu under Manage, select API permissions.

API permissions page showing Configured permissions with Add a permission and Grant admin consent buttons.
2

Add Microsoft Graph Application Permissions

Enables actions: Assign Device Compliance Policy, Assign Device Configuration, Assign Device Enrollment Configuration, Assign Mobile App, Bypass Activation Lock, Clean Windows Device, Create Role Definition, Delete Device Compliance Policy, Delete Device Configuration, Delete Managed Device, Delete Role Definition, Disable Lost Mode, Get Detected App, Get Device Category, Get Device Compliance Policy, Get Device Configuration, Get Device Enrollment Configuration, Get Managed Device, Get Mobile App, Get Mobile App Category, Get Role Definition, List Detected App Managed Devices, List Detected Apps, List Device Compliance Policies, List Device Configurations, List Device Enrollment Configurations, List Managed Devices, List Mobile App Categories, List Mobile Apps, List Role Assignments, List Role Definitions, Locate Device, Reboot Device, Remote Lock, Reset Passcode, Retire Managed Device, Set Enrollment Priority, Shut Down Device, Sync Device, Update Role Definition, Windows Defender Scan, Windows Defender Update Signatures, Wipe Managed Device

Click Add a permission, then select Microsoft Graph from the commonly used Microsoft APIs. Select Application permissions and search for the Intune-specific scopes required for your use case, then click Add permissions to save.

Choose the minimum scopes needed for your use case. Read-only access requires only the .Read.All scopes. Write access and remote device actions require the .ReadWrite.All and .PrivilegedOperations.All scopes respectively.

Application permissions selection panel showing Select permissions search box with expandable DeviceManagement permission categories.
3

Grant Admin Consent

Click Grant admin consent for [tenant name] and select Yes to consent on behalf of the organization. After granting, verify that the Status column shows a green checkmark for each permission. A Global Administrator is required to grant consent for these permissions.

​
Generate Client Secret

Create a client secret that will be used to authenticate your application.

1

Navigate to Certificates & Secrets

From the left menu under Manage, select Certificates & secrets.

Certificates & secrets page showing Client secrets tab with New client secret button and existing secrets listed with Description, Expires, Value, and Secret ID columns.
2

Create a New Client Secret

Under the Client secrets tab, click New client secret.

  • Add a Description (e.g., StackOne Intune Integration Secret).
  • Select an appropriate expiration period from the Expires dropdown.
  • Click Add.
Add a client secret dialog with Description text field and Expires dropdown defaulting to Recommended 180 days (6 months), plus Add and Cancel buttons.
3

Copy the Client Secret Value

Immediately copy the Value of the newly created client secret and store it securely. You will need this when connecting your account. This value is only shown once and cannot be retrieved again.

​
Linking the Account from the Hub

1

Navigate to the Hub

Use one of the three Linking Account Methods to access the Hub.
2

Fill out the fields

Fill out the following fields using details from your provider:
  • Tenant ID
  • Client ID
  • Client Secret
3

Connect

  • Click Connect
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup

If the account linking is successful, you will see the newly linked account in your Accounts page.