Microsoft Intune Plugin for Risk Exchange

This document explains how to configure the Microsoft Intune v1.0.0 plugin with the Risk Exchange module of the Netskope Cloud Exchange platform. This plugin fetches Devices data from the Devices > All Devices page in Microsoft Intune. This plugin supports the Reboot Device, Sync Device, Run Windows Defender Scan, and Update Windows Defender Signatures actions on the Microsoft Intune platform.

Prerequisites

To complete this integration, you need:

• A Netskope tenant (or multiple, for example, production and development/test instances).
• A Netskope Cloud Exchange tenant with the Tenant plugin and Risk Exchange plugin already configured.
• Already configured Entra ID application with required permissions
• Connectivity to the following hosts:
  • https://login.microsoftonline.com
  • https://graph.microsoft.com

Microsoft Intune Plugin Support

This plugin fetches Devices data from the Devices > All Devices page in Microsoft Intune. This plugin supports the Reboot Device, Sync Device, Run Windows Defender Scan, and Update Windows Defender Signatures actions on the Microsoft Intune platform.

Mappings

Mapping will be used to view the pulled Devices and their respective details. Fields mapped during plugin configuration will be visible on the Records page after the data is pulled. Below is the suggested mapping that can be used while configuring the plugin.

Pull Mapping for Devices

Permissions 

Microsoft Entra ID application (formerly Azure Active Directory) must have these permissions:

• DeviceManagementManagedDevices.Read.All
• DeviceManagementManagedDevices.ReadWrite.All
• DeviceManagementManagedDevices.PrivilegedOperations.All

{
    "token_type": "Bearer",
    "expires_in": 3599,
    "ext_expires_in": 3599,
    "access_token": "eyJ0eXAiOiJKV1QiLCJub25jZ.ASKajYnNghrgyqzO-H2Pns"
}

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#deviceManagement/managedDevices",
    "@odata.count": 1,
    "value": [
        {
            "id": "97a16538-13de-4fb0-b522-4f42da4958b3",
            "userId": "e4ae0b3b-7d23-41fb-b3e7-ca2ab72ed952",
            "deviceName": "WIN11-50-10-99",
            "managedDeviceOwnerType": "company",
            "managementState": "managed",
            "enrolledDateTime": "2025-09-24T09:36:14Z",
            "lastSyncDateTime": "2025-10-28T11:54:19Z",
            "operatingSystem": "Windows",
            "complianceState": "compliant",
            "jailBroken": "Unknown",
            "managementAgent": "mdm",
            "osVersion": "10.0.22621.4317",
            "easActivated": true,
            "easDeviceId": "B2AA3AEF93D9972DF31470B343BFB661",
            "easActivationDateTime": "0001-01-01T00:00:00Z",
            "azureADRegistered": true,
            "deviceEnrollmentType": "windowsAutoEnrollment",
            "activationLockBypassCode": null,
            "emailAddress": "netskope@netskope.onmicrosoft.com",
            "azureADDeviceId": "65c126aa-b1da-44a3-ae14-dfe367da5987",
            "deviceRegistrationState": "registered",
            "deviceCategoryDisplayName": "NetskopeCE",
            "isSupervised": false,
            "exchangeLastSuccessfulSyncDateTime": "0001-01-01T00:00:00Z",
            "exchangeAccessState": "none",
            "exchangeAccessStateReason": "none",
            "remoteAssistanceSessionUrl": null,
            "remoteAssistanceSessionErrorDetails": null,
            "isEncrypted": false,
            "userPrincipalName": "netskope@netskope.onmicrosoft.com",
            "model": "VMware7,1",
            "manufacturer": "VMware, Inc.",
            "imei": "",
            "complianceGracePeriodExpirationDateTime": "9999-12-31T23:59:59Z",
            "serialNumber": "VMware-42030d0e92ed5c36-c1a09bc4b6be3254",
            "phoneNumber": "",
            "androidSecurityPatchLevel": "",
            "userDisplayName": "netskope",
            "configurationManagerClientEnabledFeatures": null,
            "wiFiMacAddress": "aa:bb:cc:dd:ee:ff",
            "deviceHealthAttestationState": null,
            "subscriberCarrier": "",
            "meid": "",
            "totalStorageSpaceInBytes": 52855570432,
            "freeStorageSpaceInBytes": 314572800,
            "managedDeviceName": "WindowsVM",
            "partnerReportedThreatState": "unknown",
            "requireUserEnrollmentApproval": null,
            "managementCertificateExpirationDate": "2026-05-04T15:01:05Z",
            "iccid": null,
            "udid": null,
            "notes": null,
            "ethernetMacAddress": “aa:bb:cc:dd:ee:ff”,
            "physicalMemoryInBytes": 0,
            "enrollmentProfileName": null,
            "deviceActionResults": []
        }
    ]
}

{
  "value": [
    {
      "@odata.type": "#microsoft.graph.userExperienceAnalyticsDeviceScores",
      "id": "0dd9f6cf-f6cf-0dd9-cff6-d90dcff6d90d",
      "deviceName": "Device Name value",
      "model": "Model value",
      "manufacturer": "Manufacturer value",
      "endpointAnalyticsScore": 7.333333333333333,
      "startupPerformanceScore": 7.666666666666667,
      "appReliabilityScore": 6.333333333333333,
      "workFromAnywhereScore": 7.0,
      "batteryHealthScore": 6.0,
      "healthStatus": "insufficientData"
    }
  ]
}

204 No Content

204 No Content

{
    "quickScan": True or False
}

204 No Content

204 No Content

{
    "requests": [
        {
            "id": "690b1aad-190e-40d2-9bc2-39132a2d3680",
            "url": "/deviceManagement/managedDevices/690b1aad-190e-40d2-9bc2-39132a2d3680/rebootNow",
            "method": "POST",
            "headers": {
                "Content-Type": "application/json"
            },
            "body": {}
        },
        {
            "id": "690b1aad-23db-4fb0-b922-4f42da2958b3",
            "url": "/deviceManagement/managedDevices/690b1aad-23db-4fb0-b922-4f42da2958b3/syncDevice",
            "method": "POST",
            "headers": {
                "Content-Type": "application/json"
            },
            "body": {}
        },
        {
            "id": "690b1aad-1935-4eae-b8d8-d13f2803f671",
            "url": "/deviceManagement/managedDevices/690b1aad-1935-4eae-b8d8-d13f2803f671/windowsDefenderScan",
            "method": "POST",
            "headers": {
                "Content-Type": "application/json"
            },
            "body": {
                "quickScan": true
            }
        },
        {
            "id": "690b1aad-09b7-4c38-8e93-23aef667af01",
            "url": "/deviceManagement/managedDevices/690b1aad-09b7-4c38-8e93-23aef667af01/windowsDefenderUpdateSignatures",
            "method": "POST",
            "headers": {
                "Content-Type": "application/json"
            },
            "body": {}
        }
    ]
}

{
    "responses": [
        {
            "id": "690b1aad-190e-40d2-9bc2-39132a2d3680",
            "status": 204,
            "body": null
        },
        {
            "id": "690b1aad-23db-4fb0-b922-4f42da2958b3",
            "status": 204,
            "body": null
        },
        {
            "id": "690b1aad-1935-4eae-b8d8-d13f2803f671",
            "status": 204,
            "body": null
        },
        {
            "id": "690b1aad-09b7-4c38-8e93-23aef667af01",
            "status": 204,
            "body": null
        }
    ]
}

Performance Matrix

Here is the performance matrix conducted on a Large CE Stack with these specifications by pulling 500k Devices.

User Agent

netskope-ce-6.0.0-cre-microsoft-intune-v1.0.0

Workflow

1. Get your Client ID, Client Secret and Tenant ID from Microsoft Intune.
2. Configure the Microsoft Intune plugin.
3. Add a Business Rule for Microsoft Intune.
4. Add an Action for Microsoft Intune.
5. Validate the Microsoft Intune plugin.

Watch a Video

Click play to watch a video.

Get the Client ID, Client Secret and Tenant ID from Microsoft Intune

1. Log in into the Azure platform and go to App Registrations > All applications.

   

2. Search for your App and click on it.

   

3. Copy the Client ID and Tenant ID listed under Essentials.

   

4. Now for the Client Secret, go to Manage > Certificates & secrets.

   

5. Click New client secret, and then enter the Description and Expiry per your requirements.

   

6. Copy the Value of the Client secret.

   Note:

   Make sure to copy the Client Secret value and not the Secret ID.

Configure the Microsoft Intune Plugin

1. In Cloud Exchange, go to Settings > Plugin Store. Search for and select the Microsoft Intune v1.0.0 (CRE) plugin box.

   

2. Add a plugin configuration name, and change the sync interval if needed.

   

3. Click Next and enter the Configuration Parameters: 
   • Client ID: Client ID for the Microsoft Azure Application.
   • Client Secret: Client Secret for Microsoft Azure Application.
   • Tenant ID: Tenant ID for the Microsoft Azure Application.

   

4. Click Next and select the Entity from the Entity dropdown. Enter the field mappings per your requirements.

   To create a new field under any entity, click +Add field.

   

   Enter the Field Label, Data type, set Unique (or not), and select the aggregate strategy. When finished, click Save.

   

   Add these suggested mappings:

   

   

   

   

5. Click Save.

   

Add a Risk Exchange Business Rule for the Microsoft Intune Plugin

1. In Risk Exchange, go to Business Rules and click Create New Rule.
2. Enter a Rule Name. Select the Entity for which Fields have been configured for the Microsoft Intune plugin,  and configure the query based on your requirements. This example filter gets the noncompliant devices from the Intune plugin.

   

3. Click Save.

   

Add Risk Exchange Actions for the Microsoft Intune Plugin

The Microsoft Intune plugin supports the following action types:

• Reboot Device: Users can Reboot/Restart the devices on Microsoft Intune using this action.
• Update Windows Defender Signatures: Users can Update Windows Defender Signatures or Update Windows Defender Security Intelligence for the devices on Microsoft Intune using this action. Note: This action is only supported for windows devices.
• Run Windows Defender Scan: Users can Run Windows Defender Scan on the devices on Microsoft Intune using this action. Note: This action is only supported for windows devices.
• Sync Device: Users can Sync the devices on Microsoft Intune using this action.
• No Action: No action will be performed for this action. Users can generate UBA alerts in Ticket Orchestrator by using this action and enabling the Generate Alerts toggle.

Reboot Device

1. In Risk Exchange, go to Actions and click Add Action Configuration.
2. Select the required Business Rule, Plugin Configuration, and the Reboot Device Action from their respective dropdowns. Device ID is the ID of the device to be rebooted.

   

3. Enable the Require Approval toggle if Approval is needed before performing an action on the Devices.
4. Click Save.

   

Update Windows Defender Signatures

1. In Risk Exchange, go to Actions and click Add Action Configuration.
2. Select the required Business Rule, Plugin Configuration, and the Update Windows Defender Signatures Action from their respective dropdowns. Device ID is the ID of the device to be rebooted.

   

3. Enable the Require Approval toggle if Approval is needed before performing an action on the Devices.
4. Click Save.

   

Run Windows Defender Scan

1. In Risk Exchange, go to Actions and click Add Action Configuration.
2. Select the required Business Rule, Plugin Configuration, and the Run Windows Defender Scan Action from their respective dropdowns.
   • Device ID: ID of device to be rebooted.
   • Scan Type: Indicates whether to run a quick scan or a full scan. You need to select Full Scan or Quick Scan from the static values.

   

3. Enable the Require Approval toggle if Approval is needed before performing an action on the Devices.
4. Click Save.

   

Sync Device

1. In Risk Exchange, go to Actions and click Add Action Configuration.
2. Select the required Business Rule, Plugin Configuration, and the Sync Device Action from their respective dropdowns.

   

3. Enable the Require Approval toggle if Approval is needed before performing an action on the Devices.
4. Click Save.

   

No Action

1. In Risk Exchange, go to Actions and click Add Action Configuration.
2. Select Business rule, Plugin Configuration, and and the No Action Action from their respective dropdowns.
3. Enable the Generate Alert toggle to generate alerts in the Ticket Orchestrator module.

   

4. Enable the Require Approval toggle if Approval is needed before performing an action on the Devices.
5. Click Save.

Validate the Microsoft Intune Plugin

Validate in Cloud Exchange

1. In Risk Exchange go to Records. Select the Entity that was used while configuring the field mappings for Devices to view the pulled records.

   

2. Go to Logging page and search for the logs of the plugin using the plugin name.

   

3. Go to Logging to verify the action performed for a host. You can apply the filter with the plugin name or plugin configuration name.

   Logs for the Reboot Device action:

   

   Logs for the Run Windows Defender Scan action:

   

   Logs the for Update Windows Defender Signatures/Update Windows Defender Security Intelligence action:

   

   Logs for the Sync Device action:

   

   Logs for the No Action action:

   

4. When a user matches one of the configured business rules, the configured action will be performed on the user. This can be seen in the Risk Exchange > Action Logs.

   

Validate in Microsoft Intune

To view the available devices on Microsoft Intune, Log in to your Azure instance and go to Intune > Devices > All Devices.

To view scores related to the particular device, click on the Device Name and go to User experience.

For the Reboot Device action:

For the Run Windows Defender Scan action:

For the Update Windows Defender Signatures action:

For the Sync Device action:

Go to Tenant Administration > Audit Logs.

Troubleshooting the Microsoft Intune Plugin

Unable to configure the Microsoft Intune plugin

If you are unable to configure the Microsoft Intune plugin, it could be due to one of these reasons:

• Provided Incorrect Client ID, Client Secret, or Tenant ID.
• Provided Credentials that don’t have sufficient permissions.

What to do:

1. To get the Client ID, Client Secret, and Tenant ID, follow the steps mentioned in Get the Client ID, Client Secret and Tenant ID from Microsoft Intune .
2. To provide proper permissions to the configuration parameter, refer to the Permissions section.

Unable to pull Devices

If you are unable to pull Devices from the Microsoft Intune plugin, it could be due to one of these reasons:

• No Devices are present on the Microsoft Intune platform.
• An error is received while pulling Devices from the platform.
• Mapping was not added while configuring the plugin in the Entity source page.

What to do:

1. Check on the Microsoft Intune platform to see if the Devices exist or not.
2. Receiving 500 error: The server might be down, wait for a while and check later.
3. Receiving 403 error: The plugin configuration parameter does not have sufficient permissions, or the credentials no longer exist. Verify the permissions for the Client ID, Client Secret, and Tenant ID.
4. Make sure that the mappings were added while configuring the plugin.

Unable to View Devices details on the Records page

If you are unable to view Devices details on the Records page, it could be due to the mappings for all the Microsoft Intune fields were not provided while configuring the Microsoft Intune plugin.

What to do: Make sure to provide the needed mappings while configuring the plugin.

Unable to perform action on the Device

If you are unable to perform action on the Device, it could be due to one of these reasons:

• Insufficient permission was provided for the action.
• Receiving error while performing an action.
• Device is not present on the Microsoft Intune Platform.
• The Require Approval toggle was enabled while configuring the Action, and request is not approved.

What to do:

1. Insufficient permission was provided for the action. Verify if the required permissions are provided to Intune.
2. If the machine is down or does not exist, the plugin won’t be able to successfully perform the action. Verify that the device is accessible.
3. Go to the Microsoft Intune Platform, and verify if the device for which an action needs to be performed is present or not.
4. Go to the Action Logs page, select the logs that you want to approve the requests for, and click on the approve icon. Or disable the Require Approval toggle in the configured action, and perform the action again.

Limitation

Operating systems such as Windows, macOS, iOS, and Android are designed to allow only one active Mobile Device Management (MDM) authority at a time. Microsoft Intune is a MDM solution, and so is Omnissa Workspace One UEM. So if you want to enroll your devices on multiple platforms, make sure it is not a MDM solution. Otherwise you will receive the below error. The below behavior is noticed when we tried enrolling the device available on Omnissa to Intune.