> ## Documentation Index > Fetch the complete documentation index at: https://docs.stackone.com/llms.txt > Use this file to discover all available pages before exploring further. # Connect Microsoft Intune with OAuth 2.0 (Client Credentials) – StackOne Hub > Link a Microsoft Intune account in the StackOne Hub using OAuth 2.0 (Client Credentials). End-user guide to authorize the integration and start using Microsoft Intune actions. You must have at least Application Developer permissions in your Azure account to register applications in Microsoft Entra ID. A Global Administrator must grant admin consent for the required application permissions. The tenant must have an active Microsoft Intune license (Plan 1 or Plan 2).
Select Actions to adjust the guide
Some actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.
Action
Scope(s)
Loading actions...
Dynamic Guide URL
Scopes Selected

          

            
Separator

Register Your Application in Microsoft Entra ID

Register an application in Microsoft Entra ID to obtain OAuth 2.0 client credentials for the integration.

Sign in to the Microsoft Entra admin center. If you have access to multiple tenants, click the Settings (gear) icon in the top-right corner, then select the desired tenant from the list under Directory + subscription.

In the left navigation under Entra ID, click App registrations. You will see a list of your existing registered applications.

Microsoft Entra admin center App registrations page showing the New registration button in the toolbar and a list of existing registered applications.

Click New registration in the toolbar at the top of the page.

  • Enter a meaningful Name for your app (e.g., StackOne Intune Integration).
  • Under Supported account types, select Accounts in this organizational directory only for single-tenant access.
  • You do not need to configure a Redirect URI for client credentials flow.
  • Click Register to create the app registration.
Register an application form with Name field, Supported account types dropdown, optional Redirect URI section, and Register button.

After registration, you will be directed to the application's Overview page. In the Essentials section, locate Application (client) ID and copy its value. Paste it into the Client ID field when connecting your account.

App registration Overview page showing Essentials section with Application (client) ID and Directory (tenant) ID values.

From the same Essentials section on the Overview page, locate Directory (tenant) ID and copy its value. Paste it into the Tenant ID field when connecting your account.

Configure Application Permissions

Grant your application the necessary Microsoft Graph API application permissions for Intune device management.

From the left menu under Manage, select API permissions.

API permissions page showing Configured permissions with Add a permission and Grant admin consent buttons.
Enables actions: Assign Device Compliance Policy, Assign Device Configuration, Assign Device Enrollment Configuration, Assign Mobile App, Bypass Activation Lock, Clean Windows Device, Create Role Definition, Delete Device Compliance Policy, Delete Device Configuration, Delete Managed Device, Delete Role Definition, Disable Lost Mode, Get Detected App, Get Device Category, Get Device Compliance Policy, Get Device Configuration, Get Device Enrollment Configuration, Get Managed Device, Get Mobile App, Get Mobile App Category, Get Role Definition, List Detected App Managed Devices, List Detected Apps, List Device Compliance Policies, List Device Configurations, List Device Enrollment Configurations, List Managed Devices, List Mobile App Categories, List Mobile Apps, List Role Assignments, List Role Definitions, Locate Device, Reboot Device, Remote Lock, Reset Passcode, Retire Managed Device, Set Enrollment Priority, Shut Down Device, Sync Device, Update Role Definition, Windows Defender Scan, Windows Defender Update Signatures, Wipe Managed Device

Click Add a permission, then select Microsoft Graph from the commonly used Microsoft APIs. Select Application permissions and search for the Intune-specific scopes required for your use case, then click Add permissions to save.

Choose the minimum scopes needed for your use case. Read-only access requires only the `.Read.All` scopes. Write access and remote device actions require the `.ReadWrite.All` and `.PrivilegedOperations.All` scopes respectively.

Application permissions selection panel showing Select permissions search box with expandable DeviceManagement permission categories.

Click Grant admin consent for \[tenant name] and select Yes to consent on behalf of the organization. After granting, verify that the Status column shows a green checkmark for each permission. A Global Administrator is required to grant consent for these permissions.

Generate Client Secret

Create a client secret that will be used to authenticate your application.

From the left menu under Manage, select Certificates & secrets.

Certificates & secrets page showing Client secrets tab with New client secret button and existing secrets listed with Description, Expires, Value, and Secret ID columns.

Under the Client secrets tab, click New client secret.

  • Add a Description (e.g., StackOne Intune Integration Secret).
  • Select an appropriate expiration period from the Expires dropdown.
  • Click Add.
Add a client secret dialog with Description text field and Expires dropdown defaulting to Recommended 180 days (6 months), plus Add and Cancel buttons.

Immediately copy the Value of the newly created client secret and store it securely. You will need this when connecting your account. This value is only shown once and cannot be retrieved again.

Linking the Account from the Hub

Use one of the three Linking Account Methods to access the Hub. Fill out the following fields using details from your provider:
  • Tenant ID
  • Client ID
  • Client Secret
  • Click Connect
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.
  • Once authorization is successful, you will see a confirmation popup

If the account linking is successful, you will see the newly linked account in your Accounts page.