Connect Microsoft Intune to ChatGPT: Manage Devices and Compliance

If your IT operations team needs to connect Microsoft Intune to ChatGPT to automate fleet management, audit device compliance, or execute remote security actions, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between ChatGPT's JSON-RPC tool calls and Microsoft Intune's underlying Graph APIs.

If your team uses Claude, check out our guide on connecting Microsoft Intune to Claude or explore our broader architectural overview on connecting Microsoft Intune to AI Agents.

Giving a Large Language Model (LLM) read and write access to a Mobile Device Management (MDM) platform like Intune is a massive engineering challenge. You have to handle complex OData queries, asynchronous device actions, and strictly enforce which administrative actions the model is allowed to take. You can either build and maintain this infrastructure yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Microsoft Intune, connect it natively to ChatGPT, and execute complex IT support workflows using natural language.

Stop writing boilerplate API integration code. Let Truto generate secure, managed MCP servers for your AI agents in seconds. :::

The Engineering Reality of the Microsoft Intune API

A custom MCP server is a self-hosted integration layer that maps an LLM's intent to specific REST API requests. While the open MCP standard provides a predictable way for models to discover tools, implementing it against Microsoft Intune is notoriously painful.

Intune's API surface sits behind Microsoft Graph. If you decide to build a custom MCP server for Intune, you own the entire API lifecycle. Here are the specific integration challenges that break standard CRUD assumptions when working with Microsoft Intune:

OData Complexities and Polymorphic Responses

Microsoft Graph relies heavily on OData query parameters ($select, $filter, $expand). When an LLM wants to find a specific device, it shouldn't just dump the entire device table into context. The MCP server must expose tools that translate natural language filters into valid OData $filter strings. Furthermore, many Intune endpoints return polymorphic arrays (e.g., lists of apps where the objects could be win32LobApp, iosVppApp, or macOSDmgApp). Your MCP tool schemas must strictly define these variations so the LLM understands the specific properties available for each type, otherwise the model will hallucinate update payloads.

Asynchronous Device Action State Machines

In Intune, executing a remote action is not synchronous. When you send a command like remoteLock, syncDevice, or windowsDefenderScan, the API immediately returns an HTTP 204 No Content. This simply means the command was accepted and queued by the Intune service. The device itself might be offline and not execute the command for hours. If an LLM assumes a 204 means the device is currently locked, it will misinform the user. Your MCP server must guide the LLM to verify execution status by polling the deviceActionResults array on the individual device object, requiring specific conversational prompting.

Graph API Throttling and Rate Limit Passthrough

Microsoft Graph is aggressively throttled, especially for bulk operations or repeated queries across large tenants. When you hit a limit, Graph returns a 429 Too Many Requests response with a Retry-After header.

It is critical to understand how this is handled: Truto does not retry, throttle, or apply backoff on rate limit errors. When the upstream Microsoft Intune API returns an HTTP 429, Truto passes that error directly to the caller. Truto normalizes the upstream rate limit information into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF specification. The caller (your client logic or the agent framework) is entirely responsible for observing these headers, initiating a backoff, and retrying the request. If your MCP server attempts to absorb these errors silently, the LLM will hang and eventually time out the tool call.

How to Generate an MCP Server for Microsoft Intune

Truto abstracts away the complexity of Microsoft Graph, OData parsing, and OAuth token refreshes. Instead of writing custom JSON-RPC schemas, you can instantly generate an MCP server that derives its tools directly from the Intune API documentation.

You can generate the MCP server using either the Truto UI or the API.

Method 1: Via the Truto UI

For teams who want a zero-code setup, you can provision an MCP server directly from the dashboard.

1. Navigate to the Integrated Accounts page for your connected Microsoft Intune instance.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Select the desired configuration. For example, you can limit the server to only read methods if you want to build a read-only IT auditing agent.
5. Copy the generated MCP server URL (e.g., https://api.truto.one/mcp/a1b2c3d4e5f6...). This URL contains the cryptographic token needed to authenticate the JSON-RPC requests.

Method 2: Via the API

For engineering teams building programmatic agent deployments, you can create the MCP server dynamically using the Truto API. This is ideal for generating short-lived MCP servers mapped to specific IT support tickets.

Make a POST request to /integrated-account/:id/mcp with your desired configuration:

// Example: Generating a read-only Intune MCP Server via API
const response = await fetch('https://api.truto.one/integrated-account/<INTUNE_ACCOUNT_ID>/mcp', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer <TRUTO_API_TOKEN>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: "Intune IT Auditor Agent",
    config: { 
      methods: ["read"] // Restrict to GET/LIST operations only
    },
    expires_at: "2026-12-31T23:59:59Z" // Optional auto-cleanup
  })
});
 
const mcpServer = await response.json();
console.log(mcpServer.url); // Pass this URL to your LLM client

Connecting the MCP Server to ChatGPT

Once you have your Truto MCP server URL, connecting it to ChatGPT or other MCP-compatible clients is a simple process.

Option A: Via the ChatGPT UI (Custom Connectors)

If you are using ChatGPT Pro, Plus, Enterprise, or Team accounts with Developer mode enabled, you can add the server natively:

1. In ChatGPT, navigate to Settings -> Apps -> Advanced settings.
2. Enable the Developer mode toggle to reveal MCP settings.
3. Under MCP servers / Custom connectors, click Add new.
4. Enter a descriptive name (e.g., "Microsoft Intune Fleet Management").
5. Paste the Truto MCP Server URL into the Server URL field.
6. Click Save. ChatGPT will immediately perform a handshake, run the tools/list protocol command, and register all the Intune operations as callable tools.

Option B: Via Manual Config (for Claude Desktop, Cursor, or Custom Agents)

If you are running alternative clients like Claude Desktop, Cursor, or building a custom LangGraph agent, you configure the connection manually. You instruct the client to use the Server-Sent Events (SSE) transport by providing a remote URL command.

Add the following to your MCP client configuration file (e.g., claude_desktop_config.json):

{
  "mcpServers": {
    "microsoft-intune-truto": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/<YOUR_GENERATED_TOKEN>"
      ]
    }
  }
}

Hero Tools for Device and Compliance Management

When ChatGPT connects to the Intune MCP server, it gains access to dozens of dynamically generated tools. Here are the highest-leverage operations for IT administrators building AI-driven device management workflows.

1. List Managed Devices

Tool Name: list_all_microsoft_intune_managed_devices

This is the core discovery tool. It allows the LLM to query the entire enrolled device fleet, returning comprehensive metadata including operating systems, compliance states, and last sync times.

"Get me a list of all managed devices currently enrolled in Intune. Specifically, I need to see their deviceName, complianceState, and operatingSystem."

2. Get Device Details

Tool Name: get_single_microsoft_intune_managed_device_by_id

Retrieves the full object state for a single device. This is crucial for verifying the status of asynchronous device actions by checking the deviceActionResults array.

"Look up the full details for the device with ID 'xyz123'. Check the deviceActionResults to see if the recent remote lock command has succeeded."

3. Remote Lock a Device

Tool Name: microsoft_intune_managed_devices_remote_lock

Instantly issues a lock command to a managed device. The LLM must pass the managed_device_id. The API will return an empty 204 response on success, queuing the command on the Microsoft Graph.

"The laptop assigned to John Doe was reported stolen. Find his device in Intune and immediately issue a remote lock command."

4. Trigger Device Sync

Tool Name: microsoft_intune_managed_devices_sync_device

Forces a device to immediately check in with the Intune service to receive the latest policies, configurations, or app deployments. Highly useful when an IT admin needs to push a critical compliance update out-of-band.

"We just deployed a new security profile. Trigger a manual sync on the device with ID 'abc456' so it picks up the changes immediately."

5. Run Defender Scan

Tool Name: microsoft_intune_managed_devices_windows_defender_scan

Triggers a Windows Defender scan on the specified managed device. The agent can pass quickScan: true for a fast check or false for a deep system scan.

"Trigger a full Windows Defender scan on the device named 'DESKTOP-FINANCE-01'. Make sure quickScan is set to false."

6. List Device Compliance Policies

Tool Name: list_all_microsoft_intune_device_compliance_policies

Retrieves the compliance rules currently defined in the tenant. This allows the LLM to audit what standards are currently enforced across iOS, Android, macOS, and Windows fleets.

"List all active device compliance policies in our tenant. I need to review the descriptions and the platforms they apply to."

Note: This is only a curated selection of the highest-leverage tools. For the complete list of available Intune endpoints, schemas, and required parameters, visit the Microsoft Intune integration page.

Workflows in Action

Once connected, ChatGPT can orchestrate complex, multi-step IT workflows autonomously. Here are two real-world scenarios showing exactly how the LLM sequences tool calls.

Scenario 1: Securing a Compromised Device

When a user reports a lost device, IT needs to act immediately. Instead of navigating the Intune portal, an admin simply asks the AI to lock it down.

"An employee reported they left their iPad in an airport terminal. Find the device named 'Marketing-iPad-04' and lock it immediately. Then force a device sync so it receives the lock command as soon as it connects to Wi-Fi."

How the agent executes this:

1. Calls list_all_microsoft_intune_managed_devices filtering for the device name to retrieve the id.
2. Calls microsoft_intune_managed_devices_remote_lock using the retrieved id to queue the security action.
3. Calls microsoft_intune_managed_devices_sync_device using the same id to force a check-in.

sequenceDiagram
    participant Admin as IT Admin
    participant ChatGPT as ChatGPT
    participant MCP as Truto MCP
    participant Intune as Microsoft Intune
    
    Admin->>ChatGPT: "Lock Marketing-iPad-04 and force sync"
    ChatGPT->>MCP: call list_all_microsoft_intune_managed_devices
    MCP->>Intune: GET /deviceManagement/managedDevices
    Intune-->>MCP: Returns device list (finds ID 8f7c-99aa)
    MCP-->>ChatGPT: Returns device object
    ChatGPT->>MCP: call microsoft_intune_managed_devices_remote_lock(8f7c-99aa)
    MCP->>Intune: POST /managedDevices/8f7c-99aa/remoteLock
    Intune-->>MCP: 204 No Content
    MCP-->>ChatGPT: Success 204
    ChatGPT->>MCP: call microsoft_intune_managed_devices_sync_device(8f7c-99aa)
    MCP->>Intune: POST /managedDevices/8f7c-99aa/syncDevice
    Intune-->>MCP: 204 No Content
    MCP-->>ChatGPT: Success 204
    ChatGPT-->>Admin: "Device Marketing-iPad-04 has been remotely locked and a sync was initiated."

Scenario 2: Auditing Compliance and Triggering Remediation

IT teams frequently need to ensure devices meet organizational security baselines. If a device falls out of compliance, the agent can investigate and take proactive action.

"Find any managed devices that currently have a complianceState of 'noncompliant'. If any of them are Windows devices, trigger a quick Windows Defender scan on them to attempt remediation."

How the agent executes this:

1. Calls list_all_microsoft_intune_managed_devices and inspects the JSON payload for devices where complianceState === 'noncompliant'.
2. For any matching devices where operatingSystem contains 'Windows', it captures the device id.
3. Iteratively calls microsoft_intune_managed_devices_windows_defender_scan with quickScan: true for those specific devices.
4. Returns a summary of the non-compliant devices and confirms that scans were triggered.

Security and Access Control

Exposing MDM infrastructure to an AI model requires strict governance. If an LLM hallucinates, you do not want it triggering a retire or wipe command across your fleet. Truto's MCP servers provide multiple layers of security at the token level:

• Method Filtering: When creating the MCP server, you can pass a config.methods array (e.g., ["read"]). Truto will strip out all create, update, and delete tools at the generation stage, physically preventing the LLM from making state changes.
• Tag Filtering: Limit the available tools to specific integration resources. If you only want the LLM to access application data, you can filter by tags to completely hide device action endpoints.
• Expiration (expires_at): You can set a strict TTL (Time-To-Live) on the MCP server. This is excellent for giving temporary audit access. Once the timestamp passes, the server and its underlying KV storage records self-destruct.
• Secondary Authentication (require_api_token_auth): By default, possessing the MCP URL grants access. By enabling this flag, the client must also pass a valid Truto API token in the Authorization header, adding a required secondary layer of identity verification.

Moving Fast Without Breaking the Fleet

Building an AI agent that can securely manage a Microsoft Intune environment shouldn't require your engineering team to spend weeks deciphering Microsoft Graph pagination limits, OData query strings, or maintaining custom JSON-RPC transport layers.

By leveraging Truto's managed infrastructure, you map the LLM directly to the Intune REST surface via an auto-generated MCP server. The model discovers the schemas dynamically, rate limits are passed through transparently, and IT administrators can execute complex fleet management workflows natively inside ChatGPT.

Stop writing boilerplate API integration code. Let Truto generate secure, managed MCP servers for your AI agents in seconds. :::