Identity
Microsoft Intune / SCCM
Pull managed-device inventory, detected applications, and update compliance from Microsoft Intune (via Graph) or on-prem SCCM (via the AdminService), and reconcile them into the CMDB.
BidirectionalData residency: HYBRID
Request a demoWhat it does
- Managed device → CMDB Workstation CI, with device class, OS family/version, last check-in, and enrollment ID
- Detected apps on each device feed license-allocation signals
- Device update compliance feeds per-CI patch status (installed / missing / failed)
- Outbound: declared for a non-destructive 'propose a compliance scan / config profile' affordance tied to Change records
- Two management planes, one adapter: Microsoft Graph (Intune) or the SCCM AdminService REST endpoint
Data residency
Intune is reached through Microsoft Graph, and Graph data spans regions per the tenant's own Entra config — declared hybrid rather than assumed EU or US.
Event mappings
| External event | Maps to | What happens |
|---|---|---|
| managedDevice | cmdb_ci | Intune/SCCM managed device → CMDB Workstation CI |
| detectedApp | software_license_allocation | Detected app on a device → license allocation signal |
| deviceUpdateState | patch_status_per_ci | Device update compliance → per-CI patch status |
What you configure
- Management plane: Intune (Graph) or SCCM (AdminService)
- Entra tenant ID + app client ID (Intune/Graph mode)
- SCCM AdminService base URL (SCCM mode)
- Page size (default 200, max 1000)
OAuth scopes requested
- DeviceManagementManagedDevices.Read.All
- DeviceManagementConfiguration.Read.All
- DeviceManagementApps.Read.All
Setup overview
Connect via the Microsoft Graph app registration (Intune) or point at your SCCM AdminService URL (on-prem). Default sync cadence is hourly.
Related features
See TENSOR running on your own estate.
30 minutes, screen-shared, no slides. Bring the process you are least sure we handle and we will start there.