---
title: "Connect Microsoft Intune to Claude: Control Security and App Policies"
slug: connect-microsoft-intune-to-claude-control-security-and-app-policies
date: 2026-08-24
author: Yuvraj Muley
categories: ["AI & Agents"]
excerpt: "Learn how to connect Microsoft Intune to Claude using a managed MCP server. Automate device wipes, compliance policies, and IT helpdesk workflows safely."
tldr: "A comprehensive engineering guide on connecting Microsoft Intune to Claude via the Model Context Protocol (MCP). Covers generating managed MCP servers, handling Microsoft Graph API complexities, and automating IT administrative tasks."
canonical: https://truto.one/blog/connect-microsoft-intune-to-claude-control-security-and-app-policies/
---

# Connect Microsoft Intune to Claude: Control Security and App Policies


If your team needs to connect Microsoft Intune to Claude to automate device enrollment, endpoint security, or mobile app management, you need a [Model Context Protocol (MCP) server](https://truto.one/what-is-mcp-and-mcp-servers-and-how-do-they-work/). This server acts as the translation layer between Claude's tool calls and the Microsoft Graph APIs that power Intune. You can either build and maintain this infrastructure yourself, or use a [managed integration platform like Truto](https://truto.one/managed-mcp-for-claude-full-saas-api-access-without-security-headaches/) to dynamically generate a secure, authenticated MCP server URL.

If your team uses ChatGPT, check out our guide on [connecting Microsoft Intune to ChatGPT](https://truto.one/connect-microsoft-intune-to-chatgpt-manage-devices-and-compliance/) or explore our broader architectural overview on [connecting Microsoft Intune to AI Agents](https://truto.one/connect-microsoft-intune-to-ai-agents-automate-remote-fleet-actions/).

Giving a Large Language Model (LLM) read and write access to your organization's entire fleet of mobile and desktop devices is a significant engineering challenge. You must handle complex [OAuth 2.0 token lifecycles](https://truto.one/handling-auth-tool-sharing-in-multi-agent-frameworks-via-mcp/), map Microsoft Graph's massive JSON schemas to MCP tool definitions, and deal with Intune's domain-specific OData query structures. Every time Microsoft updates an endpoint or changes a compliance policy structure, you have to update your server code, redeploy, and test the integration.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Microsoft Intune, connect it natively to Claude, and execute complex IT administration workflows using natural language.

## The Engineering Reality of the Microsoft Intune API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools, the reality of implementing it against Microsoft Intune is painful. Intune is entirely powered by the Microsoft Graph API, which comes with specific enterprise-grade design patterns.

If you decide to build a custom Microsoft Intune MCP server, here are the specific integration challenges you will face:

**OData Query Syntax and Complex Nesting**
Microsoft Graph relies heavily on OData query parameters (`$filter`, `$expand`, `$select`) to retrieve specific nested resources. If you expose raw Microsoft Graph endpoints directly to an LLM, the model will struggle to correctly format URL-encoded OData strings or will hallucinate complex nested relationships. A managed MCP server exposes tools with strict query and body schemas, allowing the model to pass standard JSON arguments that the platform safely translates into OData queries on the backend.

**Asynchronous Remote Actions**
Many critical Intune actions - like device wipes, passcode resets, and remote locks - are asynchronous. When you send a request to `microsoft_intune_managed_devices_wipe`, the API immediately returns an empty `204 No Content` response on success. This simply means the action was queued, not that the device was actually wiped. The device must check in with Intune to process the action, which can take minutes or hours. You must instruct your AI agents not to assume the action is instantly complete based on the 204 response.

**Strict Rate Limiting and Backoff Requirements**
Microsoft Graph aggressively enforces rate limits across the tenant and application levels. When building your AI integration, it is a factual certainty that aggressive polling or bulk actions will trigger an HTTP 429 Too Many Requests response. Truto does not retry, throttle, or apply backoff on rate limit errors automatically. When the Microsoft Intune API returns an HTTP 429, Truto passes that error directly to the caller. However, Truto normalizes the upstream rate limit information into standardized headers (`ratelimit-limit`, `ratelimit-remaining`, `ratelimit-reset`) per the IETF specification. The caller - your agent or [orchestration framework](https://truto.one/handling-auth-tool-sharing-in-multi-agent-frameworks-via-mcp/) - is entirely responsible for implementing the retry and backoff logic.

## How to Create the Microsoft Intune MCP Server

To connect Claude to Microsoft Intune, you first need an active MCP server URL. Truto generates these URLs dynamically based on the specific Microsoft Intune account you have connected to your tenant.

You can generate the MCP server in two ways: via the Truto UI or programmatically via the API.

### Method 1: Creating the Server via the Truto UI

This is the fastest method for internal IT teams building quick administrative agents.

1. Log into your Truto dashboard.
2. Navigate to the **Integrated Accounts** page and select your connected Microsoft Intune instance.
3. Click the **MCP Servers** tab.
4. Click **Create MCP Server**.
5. Select your desired configuration (e.g., name, method filters like "read-only", and expiration time).
6. Copy the generated MCP server URL (it will look like `https://api.truto.one/mcp/abc123def456...`).

### Method 2: Creating the Server via the REST API

For engineering teams building multi-tenant AI applications, you can generate MCP servers programmatically. This ensures you can dynamically spin up LLM access for specific administrative sessions and tear them down when complete.

Make a `POST` request to `/integrated-account/:id/mcp`.

```typescript
const response = await fetch('https://api.truto.one/integrated-account/<INTUNE_ACCOUNT_ID>/mcp', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer <YOUR_TRUTO_API_KEY>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: "Intune Security Agent MCP",
    config: {
      methods: ["read", "write"],
      tags: ["devices", "compliance"]
    },
    expires_at: "2026-12-31T23:59:59Z"
  })
});

const mcpServer = await response.json();
console.log(mcpServer.url); 
// Output: https://api.truto.one/mcp/abc123def456...
```

The returned URL is a fully compliant JSON-RPC 2.0 endpoint ready for any MCP client.

## Connecting the MCP Server to Claude

Once you have your Truto MCP server URL, you must provide it to Claude so the model can discover and execute the Intune tools.

### Method A: Connecting via the Claude UI

If you are using the Claude desktop or enterprise web interface, you can add the server directly through the application settings.

1. Open Claude and navigate to **Settings**.
2. Go to **Integrations** (or **Connectors** depending on your tier).
3. Click **Add MCP Server** or **Add custom connector**.
4. Paste your Truto MCP URL into the endpoint field.
5. Click **Add**.

Claude will perform a handshake with the URL, pull down the Microsoft Intune tool definitions, and immediately make them available in your chat context.

### Method B: Connecting via Manual Configuration File

For developers using the Claude Desktop app locally or integrating MCP into custom orchestration frameworks, you must configure the `claude_desktop_config.json` file. Because Truto provides a remote HTTP endpoint, you use the official SSE transport wrapper to bind it.

Open your configuration file (typically located at `~/Library/Application Support/Claude/claude_desktop_config.json` on macOS) and add the following:

```json
{
  "mcpServers": {
    "microsoft_intune": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "--url",
        "https://api.truto.one/mcp/abc123def456..."
      ]
    }
  }
}
```

Restart Claude Desktop. The application will initialize the SSE connection to the Truto URL and load the tools.

## Security and Access Control

Giving an LLM access to a system that can wipe devices or change security policies requires strict guardrails. Truto MCP servers provide four critical security layers applied at the server level, ensuring the model cannot bypass them regardless of the prompt.

*   **Method Filtering:** Restrict the server to specific operation types. Setting `config.methods: ["read"]` ensures the LLM can only query device lists and compliance states, completely blocking potentially destructive `create`, `update`, or `delete` actions.
*   **Tag Filtering:** Limit access to specific functional areas. By passing `config.tags: ["devices"]`, you prevent the LLM from accessing user directory or app deployment tools, narrowing its blast radius.
*   **API Token Authentication:** By default, the cryptographically signed URL is the only authentication needed. Setting `require_api_token_auth: true` forces the client to also pass a valid Truto API token in the `Authorization` header, adding a required secondary layer of authentication.
*   **Automatic Expiration:** Set an `expires_at` timestamp to create ephemeral servers. This is critical for temporary support escalation workflows - the MCP server will self-destruct at the specified time, cleaning up underlying infrastructure state automatically.

## Hero Tools for Microsoft Intune

When your MCP server connects to Claude, it dynamically generates tool definitions based on the Microsoft Intune endpoints. Here are the highest-leverage tools available for IT and security automation.

### 1. List All Managed Devices

The `list_all_microsoft_intune_managed_devices` tool retrieves the fleet of enrolled endpoints. It returns extensive telemetry including operating system versions, jailbreak status, compliance states, and last sync times.

> "Fetch a list of all managed devices in Intune. Filter the list to find devices assigned to the user john.doe@example.com and tell me if any of his devices are marked as non-compliant."

### 2. Wipe a Managed Device

The `microsoft_intune_managed_devices_wipe` tool triggers a factory reset on a compromised or retired endpoint. It accepts optional parameters to preserve enrollment data or retain cellular eSIM data plans.

> "Initiate a wipe for the device with ID '550e8400-e29b-41d4-a716-446655440000'. Make sure to set the flag to preserve the eSIM data plan so the device retains cellular connectivity after the reset."

### 3. Locate a Device

The `microsoft_intune_managed_devices_locate_device` tool triggers a request for a lost iOS or Windows endpoint to report its physical location back to Intune.

> "The user reported their corporate iPad lost. Trigger a locate device action on device ID '1234abcd' so we can map its last known coordinates in the console."

### 4. Reset Device Passcode

The `microsoft_intune_managed_devices_reset_passcode` tool initiates a remote passcode reset, clearing forgotten lock screens and forcing the user to create a new credential on their next physical login.

> "A user is locked out of their corporate Android device. Execute a passcode reset on device ID '88776655' so they can regain access."

### 5. Fetch Device Compliance Policies

The `list_all_microsoft_intune_device_compliance_policies` tool returns the active security policies in the tenant, such as required password lengths, encryption enforcements, or minimum OS versions.

> "List all device compliance policies currently active in the tenant. Summarize the rules related to BitLocker encryption and minimum Windows 11 version requirements."

### 6. Approve Privilege Elevation Requests

The `microsoft_intune_privilege_management_elevation_requests_approve` tool is part of Endpoint Privilege Management (EPM). It allows an admin agent to approve pending requests for standard users to run specific applications with administrative rights.

> "Find the pending privilege elevation request for the Visual Studio installer. Approve it with the justification 'Approved for developer workstation setup' and set the review completed timestamp."

To view the complete inventory of available endpoints, schemas, and required parameters, visit the [Microsoft Intune integration page](https://truto.one/integrations/detail/msintune).

## Workflows in Action

Connecting tools is only the first step. The true power of an MCP server is orchestrating complex multi-step IT workflows autonomously.

### Scenario 1: Compromised Device Containment

When a security alert fires indicating a user's laptop is compromised, a SecOps engineer needs to immediately locate the asset and isolate it.

> "User sarah.connor@example.com reported her laptop stolen from a coffee shop. Find her assigned devices, identify her primary Windows laptop, trigger a location request, and immediately wipe the device to protect company data."

1. Claude calls `list_all_microsoft_intune_managed_devices` passing Sarah's user principal name to locate her hardware.
2. Claude parses the returned array, identifying the specific `id` of the Windows laptop.
3. Claude calls `microsoft_intune_managed_devices_locate_device` to ping its current coordinates.
4. Claude calls `microsoft_intune_managed_devices_wipe` with the laptop's `id` to initiate a remote factory reset.

```mermaid
sequenceDiagram
    participant SecOps as SecOps Engineer
    participant Claude as Claude
    participant TrutoMCP as Truto MCP Server
    participant GraphAPI as Microsoft Graph API

    SecOps->>Claude: "Find Sarah's laptop and wipe it."
    Claude->>TrutoMCP: Call list_all_microsoft_intune_managed_devices(user="sarah")
    TrutoMCP->>GraphAPI: GET /deviceManagement/managedDevices
    GraphAPI-->>TrutoMCP: Returns device array
    TrutoMCP-->>Claude: Returns device ID 'A1B2'
    Claude->>TrutoMCP: Call locate_device(id='A1B2')
    TrutoMCP->>GraphAPI: POST /deviceManagement/managedDevices/A1B2/locateDevice
    GraphAPI-->>TrutoMCP: 204 No Content
    TrutoMCP-->>Claude: Success
    Claude->>TrutoMCP: Call wipe(id='A1B2')
    TrutoMCP->>GraphAPI: POST /deviceManagement/managedDevices/A1B2/wipe
    GraphAPI-->>TrutoMCP: 204 No Content
    TrutoMCP-->>Claude: Success
    Claude-->>SecOps: "Device located and wipe command initiated."
```

### Scenario 2: Helpdesk Endpoint Privilege Approval

An IT helpdesk agent can use Claude to evaluate and process Endpoint Privilege Management (EPM) requests without opening the Intune portal.

> "Check for any pending privilege elevation requests for the engineering team. If the application is Docker Desktop, approve it with the justification 'Standard developer tooling' and let me know it's done."

1. Claude calls `list_all_privilege_management_elevation_requests` to retrieve the queue of standard users asking for admin rights.
2. Claude evaluates the array, isolating requests where the `applicationDetail.name` matches Docker Desktop.
3. Claude extracts the `id` for each matching request.
4. Claude calls `microsoft_intune_privilege_management_elevation_requests_approve` passing the `id` and the provided justification string.

## The Strategic Value of Managed MCP Servers

Building an AI agent that can securely manage a global IT fleet via Microsoft Intune is a high-stakes architectural decision. If you build the tool-calling infrastructure yourself, you are responsible for maintaining Microsoft Graph OAuth lifecycles, mapping massive endpoint schemas to JSON-RPC specs, and ensuring destructive actions are properly scoped.

By leveraging Truto's [managed MCP architecture](https://truto.one/managed-mcp-for-claude-full-saas-api-access-without-security-headaches/), you offload the integration maintenance burden entirely. Your engineering team can focus on designing better prompts, evaluating agent logic, and building secure IT orchestration logic, while relying on a dynamic, standard-compliant integration layer to handle the rest.

:::cta{buttonText="Talk to us" buttonUrl="https://cal.com/truto/partner-with-truto"} 
Ready to connect your AI agents to Microsoft Intune? Talk to our engineering team about setting up production-ready MCP servers.
:::