--- title: "Microsoft Intune Integration" description: "Manage your device fleet in Microsoft Intune with AI agents. List and inspect managed devices, trigger sync, retire, or wipe actions, and review device configurations, compliance policies, and app inventories through Microsoft Graph." url: https://flowrunner.ai/integrations/intunes date_modified: 2026-08-01T02:40:32-07:00 --- # Microsoft Intune [Identity & Security](https://flowrunner.ai/integrations/category/identity-security) Manage your device fleet in Microsoft Intune with AI agents. List and inspect managed devices, trigger sync, retire, or wipe actions, and review device configurations, compliance policies, and app inventories through Microsoft Graph. [Verified](https://flowrunner.ai/integrations/verified "What does verified mean?") · 9 actions · OAuth · available [Microsoft Intune website](https://learn.microsoft.com/) · [Platform Documentation](https://learn.microsoft.com/en-us/graph/api/resources/intune-graph-overview) · Capability data verified 2026-08-12 1. A device is reported lost through the IT helpdesk 2. Get Managed Device pulls the device's full record: owner, hardware, compliance state, last sync time 3. The agent determines ownership category, corporate asset or personal BYOD, and what data the device carries 4. The security channel receives the device detail with the recommended action: Retire for BYOD, Wipe for corporate 5. The IT lead confirms the identity of the device and authorizes the destructive action, or orders another sync first 6. The approved action fires, Retire Device or Wipe Device, and the device leaves management 7. A closing sweep with List Managed Devices confirms the device no longer reports in ## What This Integration Enables Device management has a peculiar shape: ninety-five percent of the work is reading, filtering, and reporting, and the last five percent includes some of the most destructive buttons in the whole IT stack. This connector respects that shape. FlowRunner agents handle the reading at machine speed, inventories, compliance sweeps, configuration audits through Microsoft Graph, and treat Sync Device as the safe remediation default, while Retire Device and Wipe Device sit behind explicit human authorization. - Build device inventory reports filtered by OS, owner, or compliance state - Detect noncompliant or lost devices and stage the right remediation - Audit installed software across the fleet with detected and managed app lists - Surface configuration profiles and compliance policies for posture reviews - Trigger on-demand sync so devices pull current policy without waiting for the schedule The wipe is the point of this connector's [human-in-the-loop](https://flowrunner.ai/concepts/human-in-the-loop) design: the agent can do everything up to the irreversible moment, and a person owns the moment. ### Without FlowRunner **Fleet state lives in a console**: Answering how many noncompliant devices exist means someone logs in and filters **Lost devices wait on a queue**: The gap between a device reported lost and action taken is measured in helpdesk backlog **Software inventory is a quarterly project**: Nobody knows what is actually installed across the fleet until audit season forces the question ### With FlowRunner **Fleet state flows to where you work**: Compliance filters run on a schedule and the exceptions arrive in the team channel **Response starts immediately, action waits for approval**: The agent assembles the device record and recommendation in minutes; a person authorizes the irreversible part **Inventory is a standing report**: Detected apps and device counts land in a sheet continuously, so audits read instead of investigate ## Use Case Scenarios ### The noncompliance sweep that names names Every morning, the agent calls List Managed Devices with a complianceState filter for noncompliant devices, resolves each owner, and posts the list to the security channel in [Microsoft Teams](https://flowrunner.ai/integrations/microsoft-teams): device, owner, OS, what failed, last sync. Devices that merely drifted get Sync Device fired on the spot to pull current policy. What used to be a weekly console session becomes a five-minute morning read with the safe remediation already done. ### Lost device, fast containment, deliberate destruction A lost laptop report opens the flow. Get Managed Device pulls the record, and the agent routes on ownership: corporate device carrying customer data gets a Wipe Device recommendation, an employee's personal phone gets Retire Device, which removes company data and management while leaving personal data intact. Either way, the recommendation, the device detail, and the blast radius go to the IT lead, and nothing fires until they approve. Containment is fast because the analysis was instant; the destruction is correct because a person confirmed the target. ### The software audit that runs continuously Weekly, List Detected Apps pulls what is actually installed across the fleet with device counts per app, and List Managed Apps pulls what IT intends to be installed. The agent diffs the two into [Google Sheets](https://flowrunner.ai/integrations/google-sheets): unsanctioned software with real install counts, licensed software nobody uses, and version drift. License reconciliation and shadow IT review become a standing report instead of an annual archaeology dig. ## Human-in-Loop Highlight Wipe Device is a factory reset delivered remotely: it erases all data on the device, including the owner's personal photos, messages, and files, unenrolls it, and cannot be undone. Retire Device is gentler but still irreversible, stripping company data and management with no remote path back. The nightmare scenario is not malice, it is a mistaken device ID: wipe the wrong laptop and someone's life data is gone along with your incident response credibility. So in FlowRunner these two actions never run unattended. The agent assembles the device record from Get Managed Device, states the ownership category and the recommended action, and pauses. The IT lead verifies the serial number matches the report, chooses Retire or Wipe, and explicitly authorizes. The agent then executes and confirms the device left the fleet. Machine speed up to the trigger; human fingers on the trigger. Agent processes routinely Detects exception requiring judgment Clear match Continues automatically Ambiguous Routes to human via preferred channel Human decides Agent resumes with decision ## Agent Capabilities 9 actions ### Device Inventory 2 - **List Managed Devices** Lists managed and pre-enrolled devices with compliance state, OS, owner, model, and last sync, supporting OData filters, field selection, and pagination. The read behind every fleet sweep. - **Get Managed Device** Retrieves one device in full, including hardware inventory, registration state, storage, and select-only fields like udid and admin notes. The evidence step before any destructive action. ### Remediation Actions 3 - **Sync Device** Triggers an immediate check-in so the device pulls current policies, apps, and configuration. Non-destructive, and the default first move for drift. - **Retire Device** Removes company data, apps, and policies and unenrolls the device, leaving personal data intact. Irreversible remotely; the device must re-enroll to return. The BYOD offboarding action, always human-authorized. - **Wipe Device** Factory resets the device, erasing all data including personal, and unenrolls it. Intended for lost, stolen, or repurposed corporate devices. The operation this page's human gate exists for. ### Policy and Configuration 2 - **List Device Configurations** Lists configuration profiles that push Wi-Fi, VPN, email, restriction, and protection settings to devices, with OData filtering. The posture read for configuration audits. - **List Compliance Policies** Lists compliance policies defining what devices must meet: OS minimums, encryption, password rules, jailbreak detection. The rulebook read behind compliance reporting. ### Application Inventory 2 - **List Managed Apps** Lists apps managed through Intune across platforms, store, line-of-business, and web links, with publishing state filters. The intended-state half of the software audit. - **List Detected Apps** Lists applications actually detected on managed devices with per-app device counts. The observed-state half: license reconciliation and shadow IT discovery start here. ## Frequently Asked Questions ### What can FlowRunner do with Microsoft Intune? FlowRunner agents can run List Managed Devices, Get Managed Device, and Sync Device in Microsoft Intune, plus 6 more actions. ### Does connecting Microsoft Intune to FlowRunner require OAuth? Yes. Microsoft Intune connects to FlowRunner with OAuth 2.0, so agents authenticate without handling raw credentials. ### Can Microsoft Intune trigger a FlowRunner workflow automatically? Microsoft Intune doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger. **Work at Microsoft Intune?** This integration exposes Microsoft Intune to AI agents on every FlowRunner plan, including through MCP, at no cost to you. [See what FlowRunner offers integration partners](https://flowrunner.ai/integrations/partners), including how to keep this page current. --- Markdown version of https://flowrunner.ai/integrations/intunes. Site index: https://flowrunner.ai/llms.txt