--- title: Microsoft Intune API Integration on Truto slug: msintune category: Device Management canonical: "https://truto.one/integrations/detail/msintune/" --- # Microsoft Intune API Integration on Truto **Category:** Device Management **Status:** Generally available ## Unified APIs ### Unified MDM API - **Apps** — Core resource which represents a software application installed on a managed device. Installed software is typically mapped to installed applications, installed programs, packages, or inventory items depending on the underlying product. - **Devices** — Core resource which represents a managed device in an MDM or RMM system. Devices are typically mapped to endpoints, nodes, or assets depending on the underlying product. ## MCP-ready AI tools Truto exposes 179 tools for Microsoft Intune that AI agents can call directly. - **list_all_microsoft_intune_managed_devices** — List managed devices enrolled in Microsoft Intune. Returns: @odata.type, id, userId, deviceName, managedDeviceOwnerType, deviceActionResults, managementState, enrolledDateTime, lastSyncDateTime, operatingSystem, complianceState, jailBroken, managementAgent, osVersion, easActivated, easDeviceId, easActivationDateTime, azureADRegistered, deviceEnrollmentType, activationLockBypassCode, emailAddress,… - **get_single_microsoft_intune_managed_device_by_id** — Get a single managed device by id in Microsoft Intune. Returns: @odata.type, id, userId, deviceName, managedDeviceOwnerType, deviceActionResults, managementState, enrolledDateTime, lastSyncDateTime, operatingSystem, complianceState, jailBroken, managementAgent, osVersion, easActivated, easDeviceId, easActivationDateTime, azureADRegistered, deviceEnrollmentType, activationLockBypassCode,… - **create_a_microsoft_intune_managed_device** — Create a new managed device in Microsoft Intune. Returns: @odata.type, id, userId, deviceName, managedDeviceOwnerType, deviceActionResults, managementState, enrolledDateTime, lastSyncDateTime, operatingSystem, complianceState, jailBroken, managementAgent, osVersion, easActivated, easDeviceId, easActivationDateTime, azureADRegistered, deviceEnrollmentType, activationLockBypassCode, emailAddress,… - **delete_a_microsoft_intune_managed_device_by_id** — Delete a managed device in Microsoft Intune by id. Returns an empty 204 response on success. Required: id. The API requires an active Intune license for the tenant. - **update_a_microsoft_intune_managed_device_by_id** — Update a managed device's properties in Microsoft Intune. Returns the updated managedDevice object including id, deviceName, managedDeviceOwnerType, complianceState, operatingSystem, osVersion, enrolledDateTime, and lastSyncDateTime. Required: id. Requires an active Intune license for the tenant. - **microsoft_intune_managed_devices_retire** — Retire a managed device in Microsoft Intune by initiating a retire action on the specified device. Returns an empty 204 response on success. Required: managed_device_id. - **microsoft_intune_managed_devices_wipe** — Wipe a managed device in Microsoft Intune, optionally preserving enrollment data, user data, and eSIM data plan. Returns an empty 204 response on success. Required: managed_device_id. Optional body parameters control retention of enrollment data, user data, eSIM plans, Mac unlock code, and obliteration behavior. - **microsoft_intune_managed_devices_reset_passcode** — Reset the passcode on a managed device in Microsoft Intune by initiating a resetPasscode action on the specified device. Returns an empty 204 response on success. Required: managed_device_id. - **microsoft_intune_managed_devices_remote_lock** — Remotely lock a managed device in msintune. Returns an empty 204 response on success. Required: managed_device_id. - **microsoft_intune_managed_devices_request_remote_assistance** — Request remote assistance for a managed device in msintune. Returns an empty 204 response on success. Required: managed_device_id. - **microsoft_intune_managed_devices_disable_lost_mode** — Disable lost mode on a managed Intune device. Returns an empty 204 response on success. Required: managed_device_id. - **microsoft_intune_managed_devices_locate_device** — Locate a managed Intune device, triggering a request for the device to report its location. Returns an empty 204 response on success. Required: managed_device_id. - **microsoft_intune_managed_devices_bypass_activation_lock** — Bypass the activation lock on a managed Intune device. Returns an empty 204 response on success. Required: managed_device_id. - **microsoft_intune_managed_devices_reboot_now** — Reboot a managed Intune device immediately. Returns an empty 204 response on success. Required: managed_device_id. - **microsoft_intune_managed_devices_shut_down** — Shut down a managed Intune device. Returns an empty 204 response on success. Required: managed_device_id. - **microsoft_intune_managed_devices_recover_passcode** — Recover the passcode of a managed device in Microsoft Intune. Returns an empty 204 response on success. Required: managed_device_id. - **microsoft_intune_managed_devices_clean_windows_device** — Clean a Windows managed device in Microsoft Intune, specifying whether to preserve user data. Returns an empty 204 response on success. Required: managed_device_id. - **managed_devices_logout_shared_apple_device_active_user** — Log out the active user from a shared Apple managed device in Microsoft Intune. Returns an empty 204 response on success. Required: managed_device_id. - **managed_devices_delete_user_from_shared_apple_device** — Delete a specific user from a shared Apple managed device in Microsoft Intune by user principal name. Returns an empty 204 response on success. Required: managed_device_id. - **microsoft_intune_managed_devices_sync_device** — Trigger a device sync for a managed device in Microsoft Intune. Returns an empty 204 response on success. Required: managed_device_id. - **microsoft_intune_managed_devices_windows_defender_scan** — Trigger a Windows Defender scan on a managed device in Microsoft Intune. Pass quickScan as true for a quick scan or false for a full scan. Returns an empty 204 response on success. Required: managed_device_id. - **managed_devices_windows_defender_update_signatures** — Trigger a Windows Defender signature update on a managed device in Microsoft Intune. Returns an empty 204 response on success. Required: managed_device_id. - **microsoft_intune_managed_devices_update_windows_device_account** — Update the Windows device account on a managed device in Microsoft Intune. Accepts account credentials, password rotation, calendar sync, and Exchange server settings via the updateWindowsDeviceAccountActionParameter. Returns an empty 204 response on success. Required: managed_device_id. - **microsoft_intune_managed_devices_disable** — Disable a managed device in Microsoft Intune by managed_device_id. Returns an empty 204 response on success. Required: managed_device_id. - **microsoft_intune_managed_devices_execute_action** — Execute a remote action on one or more managed devices in Microsoft Intune. Returns the value object containing successfulDeviceIds, failedDeviceIds, notFoundDeviceIds, and notSupportedDeviceIds. Required: actionName, deviceIds. - **managed_devices_initiate_on_demand_proactive_remediation** — Initiate an on-demand proactive remediation on a Microsoft Intune managed device. Returns an empty 204 response on success. Required: managed_device_id, scriptPolicyId. - **managed_devices_send_custom_notification_to_company_portal** — Send a custom notification to the Company Portal app on Microsoft Intune managed devices. Returns an empty 204 response on success. Required: notificationTitle, notificationBody. - **list_all_microsoft_intune_detected_apps** — List detected apps discovered by Microsoft Intune. Returns: @odata.type, id, displayName, version, sizeInByte, deviceCount, publisher, platform.type, id, displayName, version, sizeInByte, deviceCount, publisher, platform. - **get_single_microsoft_intune_detected_app_by_id** — Get a single detected app in Microsoft Intune by id. Returns: @odata.type, id, displayName, version, sizeInByte, deviceCount, publisher, platform, value.type, id, displayName, version, sizeInByte, deviceCount, publisher, platform, value. Required: id. - **create_a_microsoft_intune_detected_app** — Create a new detected app in Microsoft Intune. Returns: @odata.type, id, displayName, version, sizeInByte, deviceCount, publisher, platform. - **delete_a_microsoft_intune_detected_app_by_id** — Delete a detected app in Microsoft Intune by id. Returns an empty 204 response on success. Required: id. - **update_a_microsoft_intune_detected_app_by_id** — Update a detected app in Microsoft Intune by id. Returns: @odata.type, id, displayName, version, sizeInByte, deviceCount, publisher, platform, value. Required: id. - **list_all_microsoft_intune_device_compliance_policies** — List device compliance policies in Microsoft Intune. Returns: @odata.type, id, createdDateTime, description, lastModifiedDateTime, displayName, version. - **get_single_microsoft_intune_device_compliance_policy_by_id** — Get a single device compliance policy in Microsoft Intune by id. Returns: @odata.type, id, createdDateTime, description, lastModifiedDateTime, displayName, version, value. Required: id. - **microsoft_intune_device_compliance_policies_assign** — Assign a device compliance policy in Microsoft Intune to specified targets. Returns a value collection of deviceCompliancePolicyAssignment objects, each including @odata.type, id, and target with targetType and entraObjectId. Required: device_compliance_policy_id, assignments. - **device_compliance_policies_schedule_actions_for_rules** — Schedule compliance actions for rules on a device compliance policy in Microsoft Intune. Returns an empty 204 response on success. Required: device_compliance_policy_id, deviceComplianceScheduledActionForRules. - **list_all_microsoft_intune_device_configurations** — List device configurations in Microsoft Intune. Returns: @odata.type, id, lastModifiedDateTime, createdDateTime, description, displayName, version. - **get_single_microsoft_intune_device_configuration_by_id** — Get a single device configuration in Microsoft Intune by id. Returns: @odata.type, id, lastModifiedDateTime, createdDateTime, description, displayName, version, value. Required: id. - **microsoft_intune_device_configurations_assign** — Assign a device configuration in Microsoft Intune to specified targets by providing a collection of assignments. Returns: value. Required: device_configuration_id, assignments. - **device_configurations_get_oma_setting_plain_text_value** — Retrieve the plain text value of an OMA setting for a device configuration in Microsoft Intune. Returns: value. Required: device_configuration_id, secretReferenceValueId. - **list_all_microsoft_intune_mobile_apps** — List mobile apps managed in Microsoft Intune. Returns a collection of mobileApp objects including id, displayName, description, publisher, largeIcon, createdDateTime, lastModifiedDateTime, isFeatured, publishingState, and more. - **get_single_microsoft_intune_mobile_app_by_id** — Get a single mobile app in Microsoft Intune by id. Returns the mobileApp object including id, displayName, description, publisher, largeIcon, createdDateTime, lastModifiedDateTime, isFeatured, publishingState, and more. Required: id. - **microsoft_intune_mobile_apps_assign** — Assign a mobile app in Microsoft Intune to target groups with a specified install intent and assignment settings. Returns an empty 204 response on success. Required: mobile_app_id. - **create_a_microsoft_intune_mobile_app** — Create a new Win32 LOB app in Microsoft Intune. Returns the created win32LobApp object including id, displayName, description, publisher, createdDateTime, lastModifiedDateTime, publishingState, installCommandLine, applicableArchitectures, rules, installExperience, returnCodes, msiInformation, and more. - **microsoft_intune_mobile_apps_enable_applicable_architectures** — Enable applicable architectures for a Win32 LOB app in Microsoft Intune. Accepts an applicableArchitectures value in the request body. Returns an empty 204 response on success. Required: mobile_app_id. - **list_all_microsoft_intune_mobile_app_assignments** — List the group assignments for a Microsoft Intune mobile app. Returns each assignment's id, intent (available, required, uninstall, or availableWithoutEnrollment), target (the assigned group), and settings (per-platform install settings). Required: mobile_app_id. - **get_single_microsoft_intune_mobile_app_assignment_by_id** — Get a single group assignment for a Microsoft Intune mobile app by id. Returns: id, intent, target, settings. Required: mobile_app_id, id. - **create_a_microsoft_intune_mobile_app_assignment** — Create a new group assignment for a Microsoft Intune mobile app. Returns the created assignment: id, intent, target, settings (201 Created). Required: mobile_app_id, intent, target. - **delete_a_microsoft_intune_mobile_app_assignment_by_id** — Delete a group assignment for a Microsoft Intune mobile app. Returns an empty 204 response on success. Required: mobile_app_id, id. - **update_a_microsoft_intune_mobile_app_assignment_by_id** — Update an existing group assignment for a Microsoft Intune mobile app. Returns the updated assignment: id, intent, target, settings (200 OK). Required: mobile_app_id, id. - **list_all_microsoft_intune_managed_app_protections** — List managed app protection policies in Microsoft Intune. Returns: @odata.type, displayName, description, createdDateTime, lastModifiedDateTime, id, version, periodOfflineBeforeAccessCheck, periodOnlineBeforeAccessCheck, allowedInboundDataTransferSources, allowedOutboundDataTransferDestinations, organizationalCredentialsRequired, allowedOutboundClipboardSharingLevel, dataBackupBlocked,… - **get_single_microsoft_intune_managed_app_protection_by_id** — Get a single managed app protection policy in Microsoft Intune by id. Returns: @odata.type, displayName, description, createdDateTime, lastModifiedDateTime, id, version, periodOfflineBeforeAccessCheck, periodOnlineBeforeAccessCheck, allowedInboundDataTransferSources, allowedOutboundDataTransferDestinations, organizationalCredentialsRequired, allowedOutboundClipboardSharingLevel,… - **microsoft_intune_managed_app_protections_target_apps** — Target apps for a managed app protection policy in Microsoft Intune by assigning a collection of managed mobile apps. Returns an empty 204 response on success. Required: managed_app_policy_id, apps. - **list_all_microsoft_intune_mobile_threat_defense_connectors** — List all mobile threat defense connectors configured in Microsoft Intune. Returns: @odata.type, id, lastHeartbeatDateTime, partnerState, androidMobileApplicationManagementEnabled, iosMobileApplicationManagementEnabled, androidEnabled, iosEnabled, windowsEnabled, androidDeviceBlockedOnMissingPartnerData, iosDeviceBlockedOnMissingPartnerData, windowsDeviceBlockedOnMissingPartnerData,… - **get_mobile_threat_defense_connector_by_id** — Get a single mobile threat defense connector in Microsoft Intune by id. Returns: @odata.type, id, lastHeartbeatDateTime, partnerState, androidMobileApplicationManagementEnabled, iosMobileApplicationManagementEnabled, androidEnabled, iosEnabled, windowsEnabled, androidDeviceBlockedOnMissingPartnerData, iosDeviceBlockedOnMissingPartnerData, windowsDeviceBlockedOnMissingPartnerData,… - **create_a_microsoft_intune_mobile_threat_defense_connector** — Create a new mobile threat defense connector in Microsoft Intune. Returns the created connector including id, lastHeartbeatDateTime, partnerState, androidEnabled, iosEnabled, windowsEnabled, and partner compliance and MAM evaluation settings. - **delete_a_microsoft_intune_mobile_threat_defense_connector_by_id** — Delete a mobile threat defense connector in Microsoft Intune by id. Returns an empty 204 response on success. Required: id. - **update_a_microsoft_intune_mobile_threat_defense_connector_by_id** — Update the properties of a mobile threat defense connector in Microsoft Intune by id. Returns the updated connector including id, lastHeartbeatDateTime, partnerState, androidEnabled, iosEnabled, windowsEnabled, and partner compliance and MAM evaluation settings. Required: id. - **list_all_microsoft_intune_windows_autopilot_device_identities** — List Windows Autopilot device identities in Microsoft Intune. Returns: @odata.type, id, groupTag, purchaseOrderIdentifier, serialNumber, productKey, manufacturer, model, enrollmentState, lastContactedDateTime, addressableUserName, userPrincipalName, resourceName, skuNumber, systemFamily, azureActiveDirectoryDeviceId, managedDeviceId, displayName.type, id, groupTag, purchaseOrderIdentifier,… - **get_windows_autopilot_device_identity_by_id** — Get a single Windows Autopilot device identity by id in Microsoft Intune. Returns: @odata.type, id, groupTag, purchaseOrderIdentifier, serialNumber, productKey, manufacturer, model, enrollmentState, lastContactedDateTime, addressableUserName, userPrincipalName, resourceName, skuNumber, systemFamily, azureActiveDirectoryDeviceId, managedDeviceId, displayName, value.type, id, groupTag,… - **create_a_microsoft_intune_windows_autopilot_device_identity** — Create a new Windows Autopilot device identity in Microsoft Intune. Returns: @odata.type, id, groupTag, purchaseOrderIdentifier, serialNumber, productKey, manufacturer, model, enrollmentState, lastContactedDateTime, addressableUserName, userPrincipalName, resourceName, skuNumber, systemFamily, azureActiveDirectoryDeviceId, managedDeviceId, displayName. - **delete_windows_autopilot_device_identity_by_id** — Delete a Windows Autopilot device identity by id in Microsoft Intune. Returns an empty 204 response on success. Required: id. - **windows_autopilot_device_identities_assign_user_to_device** — Assign a user to a Windows Autopilot device in Microsoft Intune by providing the user principal name and addressable user name. Returns an empty 204 response on success. Required: windows_autopilot_device_identity_id. - **windows_autopilot_device_identities_unassign_user_from_device** — Unassign the user from a Windows Autopilot device in msintune. Returns an empty 204 response on success. Required: windows_autopilot_device_identity_id. - **windows_autopilot_device_identities_update_device_properties** — Update properties on a Windows Autopilot device in msintune, including user principal name, addressable user name, group tag, and display name. Returns an empty 204 response on success. Required: windows_autopilot_device_identity_id. - **windows_autopilot_device_identities_delete_devices** — Delete Windows Autopilot devices by serial numbers in msintune. Returns a collection of deleted device state objects including serialNumber, deviceRegistrationId, deletionState, and errorMessage. Required: serialNumbers. - **list_all_microsoft_intune_group_policy_configurations** — List group policy configurations in Microsoft Intune. Returns: @odata.type, id, createdDateTime, description, displayName, lastModifiedDateTime, version. - **get_device_compliance_setting_state_by_id** — Get a single device compliance setting state from Microsoft Intune, nested under a device compliance policy setting state summary. Returns: @odata.type, id, setting, settingName, deviceId, deviceName, userId, userEmail, userName, userPrincipalName, deviceModel, state, complianceGracePeriodExpirationDateTime, value. Required: device_compliance_policy_setting_state_summary_id, id. Requires an… - **list_all_microsoft_intune_managed_apps** — List managed apps in Microsoft Intune, returning properties and relationships of each managedApp object. Returns: @odata.type, id, displayName, description, publisher, largeIcon, createdDateTime, lastModifiedDateTime, isFeatured, privacyInformationUrl, informationUrl, owner, developer, notes, publishingState, appAvailability, version.type, id, displayName, description, publisher, largeIcon,… - **create_a_microsoft_intune_android_device_owner_compliance_policy** — Create an Android Device Owner compliance policy in Microsoft Intune by posting to the device compliance policies endpoint. Returns the created policy including id, displayName, description, version, passwordRequired, deviceThreatProtectionEnabled, passwordRequiredType, storageRequireEncryption, and other compliance and security settings. Required: @odata.type (set to… - **create_a_microsoft_intune_windows_10_custom_configuration** — Create a new Windows 10 custom configuration in Microsoft Intune with custom OMA settings. Returns: @odata.type, id, lastModifiedDateTime, createdDateTime, description, displayName, version, omaSettings. Required: @odata.type, displayName. The omaSettings collection can contain a maximum of 1000 elements. - **list_all_microsoft_intune_device_management_scripts** — List device management scripts in Microsoft Intune. Returns: id, displayName, description, scriptContent, createdDateTime, lastModifiedDateTime, runAsAccount, enforceSignatureCheck, fileName, roleScopeTagIds, runAs32Bit. - **get_single_microsoft_intune_device_management_script_by_id** — Get a single device management script in Microsoft Intune by id. Returns: id, displayName, description, scriptContent, createdDateTime, lastModifiedDateTime, runAsAccount, enforceSignatureCheck, fileName, roleScopeTagIds, runAs32Bit. Required: id. - **create_a_microsoft_intune_device_management_script** — Create a new device management script in Microsoft Intune. Returns the created script including id, displayName, description, scriptContent, fileName, runAsAccount, enforceSignatureCheck, runAs32Bit, roleScopeTagIds, createdDateTime, and lastModifiedDateTime. - **delete_a_microsoft_intune_device_management_script_by_id** — Delete a device management script in Microsoft Intune by id. Returns an empty 204 response on success. Required: id. - **update_a_microsoft_intune_device_management_script_by_id** — Update the properties of a device management script in Microsoft Intune by id. Returns the updated script including id, displayName, description, scriptContent, fileName, runAsAccount, enforceSignatureCheck, runAs32Bit, roleScopeTagIds, createdDateTime, and lastModifiedDateTime. Required: id. - **microsoft_intune_device_management_scripts_assign** — Assign a Microsoft Intune device management script to target groups by providing a collection of assignment objects. Returns an empty 204 response on success. Required: device_management_script_id. - **list_all_microsoft_intune_role_scope_tags** — List role scope tags in Microsoft Intune. Returns: @odata.type, id, displayName, description, isBuiltIn.type for each tag. - **get_single_microsoft_intune_role_scope_tag_by_id** — Get a single role scope tag in Microsoft Intune by id. Returns: @odata.type, id, displayName, description, isBuiltIn, value.type. Required: id. - **create_a_microsoft_intune_role_scope_tag** — Create a new role scope tag in Microsoft Intune. Returns: @odata.type, id, displayName, description, isBuiltIn.type. Required: displayName. - **delete_a_microsoft_intune_role_scope_tag_by_id** — Delete a role scope tag in Microsoft Intune by id. Returns an empty 204 response on success. Required: id. - **update_a_microsoft_intune_role_scope_tag_by_id** — Update the properties of a role scope tag in Microsoft Intune by id. Returns: @odata.type, id, displayName, description, isBuiltIn.type. Required: id. - **microsoft_intune_role_scope_tags_assign** — Assign a role scope tag in Microsoft Intune to specified assignment targets. Returns a collection of roleScopeTagAutoAssignment objects, each containing id and target. Required: role_scope_tag_id. - **list_all_microsoft_intune_device_management_intents** — List device management intents in Microsoft Intune. Returns: @odata.type, id, displayName, description, isAssigned, isMigratingToConfigurationPolicy, lastModifiedDateTime, templateId, roleScopeTagIds. - **get_single_microsoft_intune_device_management_intent_by_id** — Get a single device management intent by id in Microsoft Intune. Returns: @odata.type, id, displayName, description, isAssigned, isMigratingToConfigurationPolicy, lastModifiedDateTime, templateId, roleScopeTagIds. Required: id. - **create_a_microsoft_intune_device_management_intent** — Create a new device management intent in Microsoft Intune. Returns the created intent including id, displayName, description, isAssigned, templateId, and roleScopeTagIds. - **delete_a_microsoft_intune_device_management_intent_by_id** — Delete a device management intent by id in Microsoft Intune. Returns an empty 204 response on success. Required: id. - **update_a_microsoft_intune_device_management_intent_by_id** — Update a device management intent by id in Microsoft Intune. Returns the updated intent including id, displayName, description, isAssigned, templateId, and roleScopeTagIds. Required: id. - **microsoft_intune_device_management_intents_update_settings** — Update settings for a device management intent in msintune by applying a new collection of settings. Returns an empty 204 response on success. Required: device_management_intent_id. - **microsoft_intune_device_management_intents_migrate_to_template** — Migrate a device management intent in msintune from its current template to a new template. Returns an empty 204 response on success. Required: device_management_intent_id. - **microsoft_intune_device_management_intents_create_copy** — Create a copy of an existing device management intent in Microsoft Intune. Returns the copied deviceManagementIntent object including id, displayName, description, isAssigned, isMigratingToConfigurationPolicy, lastModifiedDateTime, templateId, and roleScopeTagIds. Required: device_management_intent_id. - **microsoft_intune_device_management_intents_assign** — Assign a Microsoft Intune device management intent (a settings catalog / template-based configuration profile) to one or more groups. Returns an empty 204 response on success. Required: device_management_intent_id, assignments. - **microsoft_intune_device_management_intents_compare** — Compare a Microsoft Intune device management intent's current settings against a template's settings. Returns a 200 OK with one deviceManagementSettingComparison entry per compared setting: id, displayName, definitionId, currentValueJson, newValueJson, comparisonResult. Required: device_management_intent_id, templateId. - **device_management_intents_get_customized_settings** — Get the settings on a Microsoft Intune device management intent that have been customized away from their default values. Returns a 200 OK with one deviceManagementIntentCustomizedSetting entry per customized setting: definitionId, defaultJson, customizedJson. Required: device_management_intent_id. - **list_all_microsoft_intune_reusable_policy_settings** — List device management reusable policy settings in Microsoft Intune. Returns: id, displayName, description, settingDefinitionId, settingInstance, createdDateTime, lastModifiedDateTime, version, referencingConfigurationPolicyCount. - **get_single_microsoft_intune_reusable_policy_setting_by_id** — Get a single device management reusable policy setting in Microsoft Intune by id. Returns: id, displayName, description, settingDefinitionId, settingInstance, createdDateTime, lastModifiedDateTime, version, referencingConfigurationPolicyCount. Required: id. - **create_a_microsoft_intune_reusable_policy_setting** — Create a new device management reusable policy setting in Microsoft Intune. Returns the created setting object including id, displayName, description, settingDefinitionId, settingInstance, createdDateTime, lastModifiedDateTime, version, and referencingConfigurationPolicyCount. - **delete_a_microsoft_intune_reusable_policy_setting_by_id** — Delete a deviceManagementReusablePolicySetting in msintune by id. Returns an empty 204 response on success. Required: id. - **update_a_microsoft_intune_reusable_policy_setting_by_id** — Update the properties of a deviceManagementReusablePolicySetting in msintune by id. Returns: id, displayName, description, settingDefinitionId, settingInstance, createdDateTime, lastModifiedDateTime, version, referencingConfigurationPolicyCount. Required: id. - **microsoft_intune_reusable_policy_settings_clone** — Clone a Microsoft Intune device management reusable policy setting, producing a new copy of the original. Returns the cloned setting including id, displayName, description, settingDefinitionId, settingInstance, createdDateTime, lastModifiedDateTime, version, and referencingConfigurationPolicyCount. Required: device_management_reusable_policy_setting_id. - **list_all_microsoft_intune_intune_branding_profiles** — List Intune branding profiles in Microsoft Intune. Returns: @odata.type, id, profileName, profileDescription, isDefaultProfile, createdDateTime, lastModifiedDateTime, displayName, themeColor, showLogo, showDisplayNameNextToLogo, themeColorLogo, lightBackgroundLogo, landingPageCustomizedImage, contactITName, contactITPhoneNumber, contactITEmailAddress, contactITNotes, onlineSupportSiteUrl,… - **get_single_microsoft_intune_intune_branding_profile_by_id** — Get a single Intune branding profile by id in Microsoft Intune. Returns: id, error. Required: id. - **create_a_microsoft_intune_intune_branding_profile** — Create a new Intune branding profile. Returns: @odata.type, id, displayName, version, sizeInByte, deviceCount, publisher, platform. - **delete_a_microsoft_intune_intune_branding_profile_by_id** — Delete an Intune branding profile by id. Returns an empty 204 response on success. Required: id. - **update_a_microsoft_intune_intune_branding_profile_by_id** — Update the properties of an Intune branding profile by id. Returns: id, error. Required: id. - **microsoft_intune_intune_branding_profiles_assign** — Assign group assignments to an Intune branding profile in Microsoft Intune. The request body contains an assignments collection of intuneBrandingProfileAssignment objects, each with a target group. Returns an empty 204 response on success. Required: intune_branding_profile_id. - **list_all_microsoft_intune_managed_device_cleanup_rules** — List managed device cleanup rules in Microsoft Intune. Returns: @odata.type, id, displayName, description, deviceCleanupRulePlatformType, lastModifiedDateTime, deviceInactivityBeforeRetirementInDays.type, id, displayName, description, deviceCleanupRulePlatformType, lastModifiedDateTime, deviceInactivityBeforeRetirementInDays. - **get_single_microsoft_intune_managed_device_cleanup_rule_by_id** — Get a single managed device cleanup rule in Microsoft Intune by id. Returns: @odata.type, id, displayName, description, deviceCleanupRulePlatformType, lastModifiedDateTime, deviceInactivityBeforeRetirementInDays.type, id, displayName, description, deviceCleanupRulePlatformType, lastModifiedDateTime, deviceInactivityBeforeRetirementInDays. Required: id. - **create_a_microsoft_intune_managed_device_cleanup_rule** — Create a new managed device cleanup rule in Microsoft Intune. Returns: @odata.type, id, displayName, description, deviceCleanupRulePlatformType, lastModifiedDateTime, deviceInactivityBeforeRetirementInDays.type, id, displayName, description, deviceCleanupRulePlatformType, lastModifiedDateTime, deviceInactivityBeforeRetirementInDays. - **delete_a_microsoft_intune_managed_device_cleanup_rule_by_id** — Delete a managed device cleanup rule in Microsoft Intune by id. Returns an empty 204 response on success. Required: id. - **update_a_microsoft_intune_managed_device_cleanup_rule_by_id** — Update the properties of a managed device cleanup rule in Microsoft Intune by id. Returns: @odata.type, id, displayName, description, deviceCleanupRulePlatformType, lastModifiedDateTime, deviceInactivityBeforeRetirementInDays.type, id, displayName, description, deviceCleanupRulePlatformType, lastModifiedDateTime, deviceInactivityBeforeRetirementInDays. Required: id. - **list_all_microsoft_intune_device_custom_attribute_shell_scripts** — List device custom attribute shell scripts in Microsoft Intune. Returns: @odata.type, id, customAttributeName, customAttributeType, displayName, description, scriptContent, createdDateTime, lastModifiedDateTime, runAsAccount, fileName, roleScopeTagIds.type, id, customAttributeName, customAttributeType, displayName, description, scriptContent, createdDateTime, lastModifiedDateTime, runAsAccount,… - **get_device_custom_attribute_shell_script_by_id** — Get a single device custom attribute shell script by id in Microsoft Intune. Returns: @odata.type, id, customAttributeName, customAttributeType, displayName, description, scriptContent, createdDateTime, lastModifiedDateTime, runAsAccount, fileName, roleScopeTagIds.type, id, customAttributeName, customAttributeType, displayName, description, scriptContent, createdDateTime, lastModifiedDateTime,… - **create_a_microsoft_intune_device_custom_attribute_shell_script** — Create a new device custom attribute shell script in Microsoft Intune. Returns the created script object including id, displayName, customAttributeName, customAttributeType, scriptContent, runAsAccount, and other script properties. - **delete_device_custom_attribute_shell_script_by_id** — Delete a device custom attribute shell script by id in Microsoft Intune. Returns an empty 204 response on success. Required: id. - **update_device_custom_attribute_shell_script_by_id** — Update the properties of a device custom attribute shell script by id in Microsoft Intune. Returns the updated script object including id, displayName, customAttributeName, customAttributeType, scriptContent, runAsAccount, and other script properties. Required: id. - **microsoft_intune_device_custom_attribute_shell_scripts_assign** — Assign a device custom attribute shell script to target groups in msintune. The request body contains an assignments array of deviceManagementScriptAssignment objects specifying the target groups. Returns an empty 204 response on success. Required: device_custom_attribute_shell_script_id. - **list_all_microsoft_intune_managed_device_encryption_states** — List managed device encryption states in Microsoft Intune. Returns: @odata.type, id, userPrincipalName, deviceType, osVersion, tpmSpecificationVersion, deviceName, encryptionReadinessState, encryptionState, encryptionPolicySettingState, advancedBitLockerStates, fileVaultStates, policyDetails.type, id, userPrincipalName, deviceType, osVersion, tpmSpecificationVersion, deviceName,… - **get_managed_device_encryption_state_by_id** — Get a single managed device encryption state by id in Microsoft Intune. Returns: @odata.type, id, userPrincipalName, deviceType, osVersion, tpmSpecificationVersion, deviceName, encryptionReadinessState, encryptionState, encryptionPolicySettingState, advancedBitLockerStates, fileVaultStates, policyDetails.type, id, userPrincipalName, deviceType, osVersion, tpmSpecificationVersion, deviceName,… - **create_a_microsoft_intune_managed_device_encryption_state** — Create a new managed device encryption state in Microsoft Intune. Returns: @odata.type, id, displayName, version, sizeInByte, deviceCount, publisher, platform. - **delete_a_microsoft_intune_managed_device_encryption_state_by_id** — Delete a managed device encryption state by id in Microsoft Intune. Returns an empty 204 response on success. Required: id. - **update_a_microsoft_intune_managed_device_encryption_state_by_id** — Update the properties of a managed device encryption state by id in Microsoft Intune. Returns: @odata.type, id, userPrincipalName, deviceType, osVersion, tpmSpecificationVersion, deviceName, encryptionReadinessState, encryptionState, encryptionPolicySettingState, advancedBitLockerStates, fileVaultStates, policyDetails.type, id, userPrincipalName, deviceType, osVersion, tpmSpecificationVersion,… - **list_all_user_experience_analytics_device_scopes** — List user experience analytics device scope configurations in Microsoft Intune. Returns: @odata.type, id, deviceScopeName, ownerId, isBuiltIn, enabled, status, parameter, operator, valueObjectId, value, createdDateTime, lastModifiedDateTime. - **get_user_experience_analytics_device_scope_by_id** — Get a single user experience analytics device scope configuration in Microsoft Intune by id. Returns the full device scope object including id, deviceScopeName, ownerId, isBuiltIn, enabled, status, parameter, operator, valueObjectId, value, createdDateTime, and lastModifiedDateTime. Required: id. - **user_experience_analytics_device_scopes_trigger_device_scope_act** — Trigger an action (such as re-evaluation) on a Microsoft Intune user experience analytics device scope. Returns a 200 OK with a deviceScopeActionResult indicating the outcome: deviceScopeAction, deviceScopeId, status, and failedMessage if it failed. Required: actionName, deviceScopeId. - **list_all_microsoft_intune_operation_approval_policies** — List operation approval policies in Microsoft Intune. Returns: @odata.type, id, displayName, description, lastModifiedDateTime, policyType, policyPlatform, policySet, approverGroupIds.type, id, displayName, description, lastModifiedDateTime, policyType, policyPlatform, policySet, approverGroupIds. - **get_single_microsoft_intune_operation_approval_policy_by_id** — Get a single operation approval policy by id in Microsoft Intune. Returns: @odata.type, id, displayName, description, lastModifiedDateTime, policyType, policyPlatform, policySet, approverGroupIds.type, id, displayName, description, lastModifiedDateTime, policyType, policyPlatform, policySet, approverGroupIds. Required: id. - **create_a_microsoft_intune_operation_approval_policy** — Create a new operation approval policy in Microsoft Intune. Returns: @odata.type, id, displayName, description, lastModifiedDateTime, policyType, policyPlatform, policySet, approverGroupIds, version, sizeInByte, deviceCount, publisher, platform.type, id, displayName, description, lastModifiedDateTime, policyType, policyPlatform, policySet, approverGroupIds. Required: displayName, policySet,… - **delete_a_microsoft_intune_operation_approval_policy_by_id** — Delete an operation approval policy in Microsoft Intune by id. Returns an empty 204 response on success. Required: id. - **update_a_microsoft_intune_operation_approval_policy_by_id** — Update the properties of an operation approval policy in Microsoft Intune by id. Returns the updated policy object including id, displayName, description, lastModifiedDateTime, policyType, policyPlatform, policySet, and approverGroupIds. Required: id. - **operation_approval_policies_retrieve_approvable_operations** — Retrieve the approvable operations for a specific operation approval policy in Microsoft Intune. Returns a collection of operationApprovalPolicySet objects including @odata.type, policyType, and policyPlatform. Required: operation_approval_policy_id. - **operation_approval_policies_retrieve_operations_requiring_approv** — Retrieve the operations requiring approval for a specific operation approval policy in Microsoft Intune. Returns a collection of operationApprovalPolicySet objects including @odata.type, policyType, and policyPlatform. Required: operation_approval_policy_id. - **list_all_microsoft_intune_windows_driver_update_profiles** — List Windows driver update profiles in Microsoft Intune. Returns: @odata.type, id, displayName, description, approvalType, deviceReporting, newUpdates, deploymentDeferralInDays, createdDateTime, lastModifiedDateTime, roleScopeTagIds, inventorySyncStatus.type, id, displayName, description, approvalType, deviceReporting, newUpdates, deploymentDeferralInDays, createdDateTime, lastModifiedDateTime,… - **get_single_microsoft_intune_windows_driver_update_profile_by_id** — Get a single Windows driver update profile by id in Microsoft Intune. Returns: @odata.type, id, displayName, version, sizeInByte, deviceCount, publisher, platform. Required: id. - **create_a_microsoft_intune_windows_driver_update_profile** — Create a new Windows driver update profile in Microsoft Intune. Returns the created profile including id, displayName, description, approvalType, deviceReporting, newUpdates, deploymentDeferralInDays, createdDateTime, lastModifiedDateTime, roleScopeTagIds, and inventorySyncStatus. Required: displayName. - **delete_a_microsoft_intune_windows_driver_update_profile_by_id** — Delete a Windows driver update profile by id in Microsoft Intune. Returns an empty 204 response on success. Required: id. - **update_a_microsoft_intune_windows_driver_update_profile_by_id** — Update the properties of a Windows driver update profile by id in Microsoft Intune. Returns the updated profile including id, displayName, description, approvalType, deviceReporting, newUpdates, deploymentDeferralInDays, createdDateTime, lastModifiedDateTime, roleScopeTagIds, and inventorySyncStatus. Required: id. - **microsoft_intune_windows_driver_update_profiles_assign** — Assign group assignments to a Windows driver update profile in Microsoft Intune. Returns an empty 204 response on success. Required: windows_driver_update_profile_id. - **microsoft_intune_windows_driver_update_profiles_execute_action** — Execute a bulk action (approve, decline, or schedule) on drivers within a Microsoft Intune Windows driver update profile's inventory. Returns a 200 OK with a bulkDriverActionResult listing which driver ids succeeded, failed, or were not found. Required: windows_driver_update_profile_id, actionName, driverIds. - **microsoft_intune_windows_driver_update_profiles_sync_inventory** — Sync the driver inventory of a Windows Driver Update Profile in Microsoft Intune. Returns an empty 204 response on success. Required: windows_driver_update_profile_id. - **list_all_microsoft_intune_dep_onboarding_settings** — List DEP onboarding settings in Microsoft Intune. Returns a collection of depOnboardingSetting objects including id, appleIdentifier, tokenName, tokenType, tokenExpirationDateTime, syncedDeviceCount, and lastModifiedDateTime. - **get_single_microsoft_intune_dep_onboarding_setting_by_id** — Get a single DEP onboarding setting by id in Microsoft Intune. Returns the full depOnboardingSetting object including id, appleIdentifier, tokenName, tokenType, tokenExpirationDateTime, lastModifiedDateTime, and syncedDeviceCount. Required: id. - **create_a_microsoft_intune_dep_onboarding_setting** — Create a new DEP onboarding setting in Microsoft Intune. Returns the created depOnboardingSetting object including id, appleIdentifier, tokenName, tokenType, tokenExpirationDateTime, and syncedDeviceCount. - **delete_a_microsoft_intune_dep_onboarding_setting_by_id** — Delete a DEP onboarding setting by id in Microsoft Intune. Returns an empty 204 response on success. Required: id. - **update_a_microsoft_intune_dep_onboarding_setting_by_id** — Update the properties of a DEP onboarding setting by id in Microsoft Intune. Returns the updated depOnboardingSetting object including id, appleIdentifier, tokenName, tokenType, tokenExpirationDateTime, and syncedDeviceCount. Required: id. - **dep_onboarding_settings_get_encryption_public_key** — Get the encryption public key for a DEP onboarding setting in Microsoft Intune, used to encrypt the Apple Device Enrollment Program token. Returns: value. Required: dep_onboarding_setting_id. - **dep_onboarding_settings_generate_encryption_public_key** — Generate a new encryption public key for a DEP onboarding setting in Microsoft Intune, used to encrypt the Apple Device Enrollment Program token. Returns: value. Required: dep_onboarding_setting_id. - **microsoft_intune_dep_onboarding_settings_upload_dep_token** — Upload a new Device Enrollment Program (DEP) token to an existing DEP onboarding setting in Microsoft Intune. Returns an empty 204 response on success. Required: dep_onboarding_setting_id. - **dep_onboarding_settings_sync_with_apple_device_enrollment_progra** — Sync an Intune DEP onboarding setting with the Apple Device Enrollment Program to pull the latest devices from Apple DEP. Returns an empty 204 response on success. Required: dep_onboarding_setting_id. - **list_all_microsoft_intune_enrollment_profiles** — List enrollment profiles in Microsoft Intune. Returns: @odata.type, id, displayName, description, requiresUserAuthentication, configurationEndpointUrl, enableAuthenticationViaCompanyPortal, requireCompanyPortalOnSetupAssistantEnrolledDevices. - **list_all_microsoft_intune_imported_device_identities** — List imported device identities registered with Microsoft Intune (devices pre-registered by IMEI, serial number, or manufacturer/model/serial before enrollment). Returns each identity's id, importedDeviceIdentifier, importedDeviceIdentityType, description, enrollmentState, platform, createdDateTime, lastModifiedDateTime, lastContactedDateTime. - **get_single_microsoft_intune_imported_device_identity_by_id** — Get a single imported device identity by id. Returns: id, importedDeviceIdentifier, importedDeviceIdentityType, description, enrollmentState, platform, createdDateTime, lastModifiedDateTime, lastContactedDateTime. Required: id. - **create_a_microsoft_intune_imported_device_identity** — Create (pre-register) a single imported device identity in Microsoft Intune. Returns the created identity (201 Created). - **delete_a_microsoft_intune_imported_device_identity_by_id** — Delete an imported device identity by id. Returns an empty 204 response on success. Required: id. - **update_a_microsoft_intune_imported_device_identity_by_id** — Update an existing imported device identity by id. Returns the updated identity (200 OK). Required: id. - **imported_device_identities_import_device_identity_list** — Bulk-import a list of device identities into Microsoft Intune in a single call. Returns a 200 OK with one importedDeviceIdentityResult per submitted identity, each carrying a status flag indicating whether that individual item succeeded. Required: importedDeviceIdentities. - **imported_device_identities_search_existing_identities** — Check which of a submitted list of device identities already exist as imported device identities in Microsoft Intune. Returns a 200 OK with the subset of submitted identities that were found to already exist. Required: importedDeviceIdentities. - **list_all_android_device_owner_enrollment_profiles** — List androidDeviceOwnerEnrollmentProfiles in Microsoft Intune. Returns: @odata.type, accountId, id, displayName, description, enrollmentMode, enrollmentTokenType, createdDateTime, lastModifiedDateTime, tokenValue, tokenCreationDateTime, tokenExpirationDateTime, enrolledDeviceCount, enrollmentTokenUsageCount, qrCodeContent, qrCodeImage, roleScopeTagIds, configureWifi, wifiSsid, wifiPassword,… - **get_android_device_owner_enrollment_profile_by_id** — Get a single androidDeviceOwnerEnrollmentProfile by id in Microsoft Intune. Returns: @odata.type, id, displayName, value. Required: id. - **create_android_device_owner_enrollment_profile** — Create a new androidDeviceOwnerEnrollmentProfile in Microsoft Intune. Returns the created profile including id, accountId, displayName, enrollmentMode, enrollmentTokenType, createdDateTime, lastModifiedDateTime, and Wi-Fi configuration properties. - **delete_android_device_owner_enrollment_profile_by_id** — Delete an androidDeviceOwnerEnrollmentProfile by id in Microsoft Intune. Returns an empty 204 response on success. Required: id. - **update_android_device_owner_enrollment_profile_by_id** — Update the properties of an androidDeviceOwnerEnrollmentProfile by id in Microsoft Intune. Returns the updated profile including id, accountId, displayName, enrollmentMode, enrollmentTokenType, lastModifiedDateTime, configureWifi, wifiSsid, wifiSecurityType, and deviceNameTemplate. Required: id. - **android_device_owner_enrollment_profiles_revoke_token** — Revoke the enrollment token for an Android device owner enrollment profile in Microsoft Intune. Returns an empty 204 response on success. Required: android_device_owner_enrollment_profile_id. - **android_device_owner_enrollment_profiles_create_token** — Create a new enrollment token for an Android device owner enrollment profile in Microsoft Intune. Returns an empty 204 response on success. Required: android_device_owner_enrollment_profile_id. - **device_app_management_sync_microsoft_store_for_business_apps** — Sync the Intune account with Microsoft Store for Business to trigger an application sync. Returns an empty 204 response on success. - **list_all_microsoft_intune_device_app_management** — Get the Intune deviceAppManagement singleton object, which contains Microsoft Store for Business onboarding and sync configuration. Returns: @odata.type, id, isEnabledForMicrosoftStoreForBusiness, microsoftStoreForBusinessLanguage, microsoftStoreForBusinessLastCompletedApplicationSyncTime, microsoftStoreForBusinessLastSuccessfulSyncDateTime, microsoftStoreForBusinessPortalSelection.type. - **microsoft_intune_device_app_management_bulk_update** — Update properties of the Intune deviceAppManagement singleton object, including Microsoft Store for Business sync and portal selection settings. Returns: @odata.type, id, isEnabledForMicrosoftStoreForBusiness, microsoftStoreForBusinessLanguage, microsoftStoreForBusinessLastCompletedApplicationSyncTime, microsoftStoreForBusinessLastSuccessfulSyncDateTime, microsoftStoreForBusinessPortalSelection,… - **list_all_microsoft_intune_mobile_app_troubleshooting_events** — List mobile app troubleshooting events in Microsoft Intune. Returns: @odata.type, id, eventDateTime, correlationId, troubleshootingErrorDetails, eventName, additionalInformation, managedDeviceIdentifier, userId, applicationId, history. - **get_mobile_app_troubleshooting_event_by_id** — Get a mobile app troubleshooting event by id in Microsoft Intune. Returns: @odata.type, id, eventDateTime, correlationId, troubleshootingErrorDetails, eventName, additionalInformation, managedDeviceIdentifier, userId, applicationId, history. Required: id. - **create_a_microsoft_intune_mobile_app_troubleshooting_event** — Create a mobile app troubleshooting event in Microsoft Intune. Returns the created event including id, eventDateTime, correlationId, applicationId, userId, and troubleshootingErrorDetails. - **delete_a_microsoft_intune_mobile_app_troubleshooting_event_by_id** — Delete a mobile app troubleshooting event by id in Microsoft Intune. Returns an empty 204 response on success. Required: id. - **update_a_microsoft_intune_mobile_app_troubleshooting_event_by_id** — Update a mobile app troubleshooting event by id in Microsoft Intune. Returns the updated event including id, eventDateTime, correlationId, applicationId, userId, and troubleshootingErrorDetails. Required: id. - **list_all_privilege_management_elevation_requests** — List privilege management elevation requests in Microsoft Intune EPM. Returns: @odata.type, id, requestedByUserId, requestedOnDeviceId, requestedByUserPrincipalName, deviceName, requestCreatedDateTime, requestLastModifiedDateTime, requestJustification, applicationDetail, status, reviewCompletedByUserId, reviewCompletedByUserPrincipalName, reviewCompletedDateTime, requestExpiryDateTime,… - **get_privilege_management_elevation_request_by_id** — Get a single privilege management elevation request in Microsoft Intune EPM by id. Returns: @odata.type, id, keepEnrollmentData, keepUserData, macOsUnlockCode, obliterationBehavior, persistEsimDataPlan. Required: id. - **microsoft_intune_privilege_management_elevation_requests_approve** — Approve a pending privilege management elevation request in Microsoft Intune EPM. Returns the updated elevation request including id, status, reviewCompletedByUserId, reviewCompletedByUserPrincipalName, reviewCompletedDateTime, and reviewerJustification. Required: privilege_management_elevation_request_id. - **microsoft_intune_privilege_management_elevation_requests_deny** — Deny a pending privilege management elevation request in Microsoft Intune EPM. Returns the updated elevation request including id, status, reviewCompletedByUserId, reviewCompletedByUserPrincipalName, reviewCompletedDateTime, and reviewerJustification. Required: privilege_management_elevation_request_id. - **microsoft_intune_privilege_management_elevation_requests_revoke** — Revoke an approved privilege management elevation request in Microsoft Intune EPM. Returns the updated elevation request including id, status, reviewCompletedByUserId, reviewCompletedByUserPrincipalName, reviewCompletedDateTime, and reviewerJustification. Required: privilege_management_elevation_request_id. - **list_all_microsoft_intune_me** — Get the current authenticated user's profile in Microsoft Intune via the Microsoft Graph /me endpoint. Returns: id, value. - **list_all_microsoft_intune_mobile_app_install_summary** — Get the install status summary for a Microsoft Intune mobile app across all assigned devices and users: counts of installed, failed, not applicable, not installed, and pending-install, broken out by device and by user. Required: mobile_app_id. ## How it works 1. **Link your customer's Microsoft Intune account.** Use Truto's frontend SDK; we handle every OAuth and API key flow so you don't need to create the OAuth app. 2. **Authentication is automatic.** Truto refreshes tokens, stores credentials securely, and injects them into every API request. 3. **Call Truto's API to reach Microsoft Intune.** The Proxy API is a 1-to-1 mapping of the Microsoft Intune API. 4. **Get a unified response format.** Every response uses a single shape, with cursor-based pagination and data in the `result` field. ## Use cases - **Embed helpdesk device actions in ITSM tools** — Let IT agents trigger remote lock, wipe, sync, reboot, and locate actions on managed devices without leaving your ticketing or chat-based support product. This eliminates console switching and cuts mean time to resolution for lost device and security incident tickets. - **Sync endpoint inventory into ITAM and SaaS management platforms** — Continuously pull managed device hardware, OS, compliance state, and detected apps into your asset or spend management product. Customers get a live source of truth for hardware lifecycle, ghost assets, and shadow IT reconciliation. - **Automate zero-touch onboarding and offboarding** — HRIS and identity orchestration platforms can assign Windows Autopilot devices to new hires and trigger retire or wipe actions on termination. This closes the loop between HR events and physical endpoint provisioning without manual IT work. - **Feed compliance and encryption posture into security products** — SIEM, XDR, and zero-trust platforms can ingest device compliance state, encryption status, and jailbreak signals from Intune to refine risk scoring in real time. Customers get more accurate posture data without building an Intune connector themselves. - **Route Endpoint Privilege Management approvals through custom workflows** — PAM and workflow tools can poll privilege management elevation requests and approve, deny, or revoke them based on their own approval logic. This lets customers apply consistent access governance across Intune-managed endpoints. ## What you can build - **Unified device inventory dashboard** — Display all managed devices with OS, compliance state, last sync time, encryption status, and assigned user pulled from Intune alongside other MDM sources via Truto's Unified MDM API. - **One-click remote device actions** — Ship buttons for wipe, retire, remote lock, reset passcode, reboot, shut down, locate, and Defender scan directly inside your product's device detail views. - **Autopilot user assignment automation** — Trigger Windows Autopilot device identity creation, user assignment, and property updates from your onboarding workflows when a new hire event fires. - **Detected apps and shadow IT reporting** — Pull the full detected apps inventory per device to surface unauthorized software, license reconciliation gaps, and version drift in your SaaS management product. - **Policy and script deployment console** — Let admins create and assign device management scripts, mobile app assignments, compliance policies, and configuration profiles from inside your product without opening the Intune portal. - **EPM elevation request approval flows** — List pending privilege management elevation requests and expose approve, deny, and revoke actions through custom approval matrices in your PAM or workflow tool. ## FAQs ### How does authentication with Microsoft Intune work through Truto? Intune is accessed via the Microsoft Graph API, which uses OAuth 2.0 against Microsoft Entra ID. Truto handles the OAuth flow, token storage, and refresh so your end users connect their tenant with a standard consent screen and you never handle client secrets or tokens directly. ### Can I use the Unified MDM API to work across Intune and other device management providers? Yes. Truto's Unified MDM API normalizes core objects like Devices and Apps across MDM providers, so a single integration in your product can serve customers on Intune and other UEM platforms. You can also drop down to Intune-specific tools when you need capabilities unique to Intune, like Autopilot or EPM. ### How fresh is the device data returned by Intune? Intune devices report in on their own check-in cadence, so data freshness depends on when each endpoint last synced. You can call the sync device action to force an immediate check-in and read lastSyncDateTime on each device to know exactly how current the record is. ### Which remote device actions are supported? Truto exposes the full set of Intune managed device actions including wipe, retire, remote lock, reset passcode, recover passcode, reboot, shut down, sync, locate, disable lost mode, bypass activation lock, clean Windows device, Defender scan and signature update, custom notifications, and shared Apple device user management. ### Does the integration support Windows Autopilot and Apple DEP workflows? Yes. You can list, create, update, and delete Windows Autopilot device identities, assign and unassign users, update device properties like Group Tag, and bulk delete devices. Apple DEP onboarding settings, token upload, and sync with Apple's Device Enrollment Program are also supported. ### How does Truto handle Microsoft Graph rate limits and pagination? Microsoft Graph enforces per-tenant throttling and uses cursor-based pagination via @odata.nextLink. Truto handles pagination transparently on list endpoints and manages retries and backoff on throttled responses so you get complete result sets without writing that logic yourself.