Microsoft Intune

Scopes requested

Trelica needs theDeviceManagementManagedDevices.Read.All scope to read Intune asset data.

Application consent in Entra ID

Microsoft Entra ID (formerly Azure AD) now offers a very comprehensive approach to OAuth application security. Recommended settings are to limit users' abilities to consent to OAuth applications - if you're an Entra  Administrator you can see the configuration your organization is using under Enterprise applications > Consent and permissions > User consent settings.

Trelica requires a number of permissions to access resources in Entra ID and it's likely you will have Do not allow user consent or Allow user consent for apps from verified publishers, for selected permissions selected. In this case connecting Trelica to Entra ID with a non-Entra administrator account will show the Need admin approval message:

As the message suggests, you could switch to using an Entra administrator account to make the connection by clicking Have an admin account? Sign in with that account.

Approving the Trelica application connection using a separate Entra admin account

If you want to use a different user account (perhaps a specific Trelica 'service' account with just the Global Reader role) to connect from Trelica to Entra ID, then you will still need an Entra Administrator to approve the Trelica application.

The easiest way to do this is to ask an Entra Admin (who does not need to have a Trelica account) to click the following link:

https://login.microsoftonline.com/common/adminconsent?client_id=e1ecc680-201e-4a67-9671-6a159d448669

This will initiate the process for approving the Trelica connection in Entra ID. They will be shown the following screen:

Assigning and removing devices from Azure AD groups

The Microsoft Intune integration uses a normal OAuth consent process.

However, assigning and removing devices from Azure AD groups requires 'Application' rather than 'Delegated' Azure API permissions for the Device.ReadWrite.All scope (which is required for setting group membership). This means that an application must be created and configured directly in your Entra ID tenant.

There are two parts to configuring the connection - you may need help from an IT admin to complete the first step.

1. Create credentials in Entra ID (an 'app')
2. Connect Trelica to Microsoft 365 using these credentials.

Register the app

1. Login to Entra ID and find App registrations:
2. Click New registration.
3. Enter a name (e.g. Trelica (Intune))
4. Choose Accounts in this organizational directory only (Single tenant)
5. You do not need to enter a Redirect URI - just click Register to continue.

Configuring API permissions

1. On the API permissions tab, click Add a permission
2. Under the Microsoft APIs tab choose Microsoft Graph:
3. Choose Application permissions search for Group.Read.All and then tick this:
4. In a similar way, add GroupMember.ReadWrite.All Device.ReadWrite.All DeviceManagementManagedDevices.Read.All
5. Click Add permissions
6. Finally, click Grant admin consent:

Create a new secret

1. Go to Certificates & secrets
2. Click New client secret
3. Give the secret a name (e.g. Trelica) and chose the Expiry duration that you are comfortable with (we recommend 12 or 24 months).
4. Click Add

Collecting the IDs you need

You need three IDs which you can copy from Entra ID:

1. From the Certificates & secrets tab copy the Client Secret Value (not the Secret ID)

   The Client secret value will only be available for you to copy for a short period of time. If you are unable to view or copy it, then just create new one.

2. From the Overview tab copy the Application (client ID) and the Directory (tenant) ID

Connect from Trelica

1. In Trelica, go to Admin > Integrations > Microsoft Intune
2. Click Connect and enter the IDs that you gathered earlier:
3. Click Connect again.
4. You may need to login and consent to other scopes (required for other Intune actions).
5. The integration will run in the background.