Microsoft Intune

Median's Microsoft Intune plugin integrates the Intune App SDK into your iOS and Android apps, so you can manage devices and protect corporate data with Mobile Device Management (MDM) and Mobile Application Management (MAM) through Microsoft Intune.

For details on the SDK itself, see the official Microsoft Intune App SDK documentation.

📘

Microsoft product names

Microsoft has renamed several products referenced in older guides. Azure Active Directory is now Microsoft Entra ID, and Microsoft Endpoint Manager is now the Microsoft Intune admin center. Menu labels in the Microsoft portals may differ slightly from the steps below as Microsoft updates its interface.

Use cases

The Microsoft Intune plugin is a good fit for apps that need to:

Prerequisites

To integrate and configure the Intune Mobile SDK into your app, ensure you have the following:

• Microsoft Intune account
• Client ID
• Tenant ID
• Client secret

The implementation steps below showcase where to find each of the required configuration parameters.

Integration guide

Step 1: Create a Client ID and Tenant ID

Register your app in Microsoft Entra ID to generate your Client ID and Tenant ID.

1. Log in to https://portal.azure.com.
2. Under Azure Services, click Azure Active Directory.
3. In the left-hand menu, select App registrations.
4. On the main page, click New registration.
5. In the Register an Application screen, enter your app’s name. Ensure that the Accounts in this organizational directory only option is selected.
6. Click Register to create your application.
7. After registration, you will see the Application (Client) ID and Tenant ID. Copy these values for later use.

Step 2: Create a Client Secret

Create a Client Secret that your app uses to authenticate with Microsoft.

1. In the left menu, click Certificates & secrets.
2. Under the Client secrets section, click New client secret.
3. In the Add a client secret popup, do the following:
   1. Enter a description for your client secret, such as Client Secret for[your app name].
   2. Under Expires, select Never to ensure the secret remains valid indefinitely. You may need to configure a different value based on your security policies.
   3. Click Add.
4. The newly created client secret will appear under Client secrets. Copy its value for future use.

Step 3: Grant Microsoft Graph API permissions

To grant your app the necessary permissions, follow these steps:

1. In the left-hand menu, click API permissions.
2. Click Add a permission.
3. In the Request API permissions panel:
   1. Select Microsoft Graph.
   2. Select Application permissions.
   3. Search for and select the permissions listed in the table below.
   4. Click Add permissions.
4. Back on the API permissions page, click Grant admin consent for [your organization].
5. Click Yes to confirm.
   Add the following Application permissions:

When consent is granted, the Status column shows Granted for [your organization] for each permission.

Technical Best Practises

Follow the principle of least privilege

Grant only the three permissions listed above. Avoid adding additional Microsoft Graph permissions to this app registration unless Median or Microsoft documentation requires them.

Use a dedicated app registration

Create a separate app registration for each Median app and each environment (for example, testing and production). This makes it easier to rotate credentials, audit access, and revoke access without affecting other apps.

Rotate secrets before they expire

Choose the shortest expiration period your team can manage, and rotate the Client Secret before it expires. After rotating, update the value in Median and rebuild your app if required.

Protect your credentials

Store the Client Secret in a secrets manager or password vault. If you suspect it has been exposed, delete it in Certificates & secrets and create a new one immediately.

Verify consent before testing

Confirm that all three permissions show Granted in the Status column before testing on a device. Missing consent is the most common cause of Intune configuration errors.

Troubleshooting