Changes for page ACMP Intune Connector

Last modified by Sabrina V. on 2025/06/13 09:48
From version 3.1
edited by Sabrina V.
on 2025/05/12 09:07
Change comment: There is no comment for this version
To version 1.1
edited by jklein
on 2024/08/13 08:28
Change comment: Imported from XAR

Summary

Details

Page properties
Author
... ... @@ -1,1 +1,1 @@
1 -XWiki.SV
1 +XWiki.jklein
Content
... ... @@ -1,3 +1,11 @@
1 +{{figureCaption}}
2 +Intune-relevante Abfrageaktionen
3 +{{/figureCaption}}
4 +
5 +{{figureCaption}}
6 +Eingabe des geheimen Clientschlüssels
7 +{{/figureCaption}}
8 +
1 1  {{aagon.priorisierung}}
2 2  160
3 3  {{/aagon.priorisierung}}
... ... @@ -10,21 +10,192 @@
10 10  
11 11  To use the ACMP Intune Connector, the following requirements must be met:
12 12  
13 -* You need a user account with the appropriate permissions for Microsoft Entra ID
14 -
15 -{{box}}
16 -Refer to the [[//Registering an enterprise application in Microsoft Entra ID//>>doc:ACMP.68.Unternehmensanwendung registrieren in der Microsoft Entra ID.WebHome]] section for information on how to register an app and distribute the necessary permissions.
17 -{{/box}}
18 -
21 +* You need a user account with the appropriate permissions for Microsoft Azure Active Directory
19 19  * There must be a connection between AESB and ACMP. AESB must be available for this and the necessary details of the [[SICS connection>>doc:||anchor="H1.ACMPconsole:CheckSICSconnectioninACMP"]] must be stored in ACMP
20 20  * AESB must be at least version 1.8
21 21  * You need a working internet connection, as Intune is a cloud solution and requires a network connection to work.
22 22  * A running instance of Intune
23 23  
24 -= Prepare for Microsoft Entra ID and distribute permissions =
27 += Preparations in Azure Active Directory =
25 25  
26 -In order for the ACMP Intune Connector to access the Intune API, you must first register a company application in the Microsoft Entra Admin Centre and grant the necessary permissions within these applications (see [[//Registering a company application in Microsoft Entra ID//>>url:https://doc.aagon.com/bin/view/ACMP/68/Unternehmensanwendung%20registrieren%20in%20der%20Microsoft%20Entra%20ID/]]).
29 +To enable the ACMP Intune Connector to access the Intune API, you must first register an enterprise application in Azure Active Directory and grant the required permissions within those applications.
27 27  
31 +== Register the Enterprise Application ==
32 +
33 +First, sign in to the [[Azure AD (Active Directory)>>https://aad.portal.azure.com/]] and navigate to Azure Active Directory in the Overview. Click the //Manage// > //Application// //Registrations// tab and create a new application registration.
34 +
35 +{{figure}}
36 +(% style="text-align:center" %)
37 +[[image:65_Intune_App-Registrierung in der Azure AD.png]]
38 +
39 +{{figureCaption}}
40 +App registrations in the Azure AD
41 +{{/figureCaption}}
42 +{{/figure}}
43 +
44 +Enter all the necessary information: Enter a name for the application and select the accounts to support. Finish the process by clicking //Register//.
45 +
46 +{{figure}}
47 +(% style="text-align:center" %)
48 +[[image:65_Intune_Anwendung registrieren.png]]
49 +
50 +{{figureCaption}}
51 +Register application
52 +{{/figureCaption}}
53 +{{/figure}}
54 +
55 +If you now open the created application, you will see a summary of the information added. This includes the display name, the various IDs (application, object and directory ID) and details of the account types supported.
56 +
57 +{{figure}}
58 +(% style="text-align:center" %)
59 +[[image:65_Intune_Zusammenfassung der Anwendungsinformationen.png||alt="65_Intune_Anwendung registrieren.png"]]
60 +
61 +{{figureCaption}}
62 +Summary of the application information
63 +{{/figureCaption}}
64 +{{/figure}}
65 +
66 +== Distribute permissions ==
67 +
68 +The next step is to assign the necessary permissions to the business application to access the Graph API. To do this, go to the Permissions section within the registered application (//Manage// > //API// //Permissions//).
69 +
70 +{{figure}}
71 +(% style="text-align:center" %)
72 +[[image:65_Intune_API Berechtigungen.png]]
73 +
74 +{{figureCaption}}
75 +API permissions
76 +{{/figureCaption}}
77 +{{/figure}}
78 +
79 +There, click //Add Permission//. This will bring up a page where you can request the API permissions. In this step you need to select the //Microsoft Graph//.
80 +
81 +{{figure}}
82 +(% style="text-align:center" %)
83 +[[image:65_Intune_Microsoft Graph anfordern.png]]
84 +
85 +{{figureCaption}}
86 +API permissions: Request Microsoft Graph
87 +{{/figureCaption}}
88 +{{/figure}}
89 +
90 +A distinction is made between "Delegated Permissions" and "Application Permissions". Enter the following values individually under 'Delegated permissions' and repeat the process by entering each of the following list entries:
91 +
92 +* DeviceManagementManagedDevices.Read.All
93 +* DeviceManagementManagedDevices.ReadWrite.All
94 +* User.Read
95 +
96 +{{figure}}
97 +(% style="text-align:center" %)
98 +[[image:65_Intune_Delegierte Berechtigungen verteilen.png]]
99 +
100 +{{figureCaption}}
101 +Distribute delegated permissions
102 +{{/figureCaption}}
103 +{{/figure}}
104 +
105 +Tick the appropriate items, scroll back to the top, click the //Application Permissions// field and add the following permissions:
106 +
107 +* DeviceManagementApps.Read.All
108 +* DeviceManagementConfiguration.Read.All
109 +* DeviceManagementManagedDevices.PrivilegedOperations.All
110 +* DeviceManagementManagedDevices.Read.All
111 +* DeviceManagementManagedDevices.ReadWrite.All
112 +* DeviceManagementServiceConfig.Read.All
113 +* User.Read.All
114 +
115 +When you have selected all the permissions, click //Add Permissions//. You will see the entries in the overview.
116 +
117 +{{figure}}
118 +(% style="text-align:center" %)
119 +[[image:65_Intune_Verteilte Berechtigungen (ohne Einwilligung).png]]
120 +
121 +{{figureCaption}}
122 +Deployed permissions (without consent)
123 +{{/figureCaption}}
124 +{{/figure}}
125 +
126 +If you have not already done so, you may need to give your consent to the permissions. To do this, click on the //Grant administrator// //consent for// //"%Your Company%//" field. This will change the status and the user permission will be granted.
127 +
128 +{{figure}}
129 +(% style="text-align:center" %)
130 +[[image:65_Intune_Bewilligte Berechtigungen.png]]
131 +
132 +{{figureCaption}}
133 +Authorised permissions
134 +{{/figureCaption}}
135 +{{/figure}}
136 +
137 +== Upload client secret key or certificates ==
138 +
139 +Later, during the initial setup of the ACMP Intune Connector, you have to specify an authentication type in the AESB console. You can choose from two methods supported by the Microsoft Client Credentials Provider: //Certificate// or //Client Secret Key//.
140 +
141 +{{aagon.infobox}}
142 +The procedure differs depending on the authentication type selected. Read below to find out what you need to consider for each method.
143 +{{/aagon.infobox}}
144 +
145 +=== Upload certificate ===
146 +
147 +{{aagon.infobox}}
148 +Due to the higher level of security, Microsoft recommends that you use a certificate as your credential.
149 +{{/aagon.infobox}}
150 +
151 +Certificates can be used as an authentication method to log in to Azure Active Directory in the AESB console. A certificate always consists of a public and private part, where the public key is loaded directly into Azure AD. The private part is used in the AESB console. This certificate pair needs to be generated beforehand. Read how to generate a certificate via [[Microsoft>>url:https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate?tabs=apex%2Cportal]] or[[ Open SSL>>url:https://stackoverflow.com/questions/6307886/how-to-create-pfx-file-from-certificate-and-private-key]].
152 +
153 +Navigate to //Certificates & Secrets// in the previously registered application. In the details, click on the //Certificates// tab and upload the previously created certificate.
154 +
155 +{{figure}}
156 +(% style="text-align:center" %)
157 +[[image:65_Intune_Zertifikat hochladen.png]]
158 +
159 +{{figureCaption}}
160 +Upload certificate
161 +{{/figureCaption}}
162 +{{/figure}}
163 +
164 +A field will open on the right hand side where you can upload the certificate. Browse to the appropriate directory, upload the file and enter an optional description for the certificate. Then click Add and the certificate will be saved for the application.
165 +
166 +{{aagon.infobox}}
167 +Please note that only .cer, .pem and .crt file types are supported when uploading a certificate.
168 +{{/aagon.infobox}}
169 +
170 +{{figure}}
171 +(% style="text-align:center" %)
172 +[[image:65_Intune_Hochgeladenes Zertifikat in der Azure Active Directory.png]]
173 +
174 +{{figureCaption}}
175 +Uploaded certificate in the Azure Active Directory
176 +{{/figureCaption}}
177 +{{/figure}}
178 +
179 +=== Adding a secret client key ===
180 +
181 +The secret client key is a string of characters used by the enterprise application as an authentication key or proof of identity when requesting the token. To do this, go to the Permissions area within the registered application (//Security// > //Permissions//) and click the Application Registration link. Navigate to //Certificates// & //Secrets//. In the details, click the //Secret Client Keys// tab and create a new key.
182 +
183 +{{figure}}
184 +(% style="text-align:center" %)
185 +[[image:65_Intune_Neuen Clientschlüssel hinterlegen.png]]
186 +
187 +{{figureCaption}}
188 +Store new client key
189 +{{/figureCaption}}
190 +{{/figure}}
191 +
192 +When creating a new secret client key, you can configure the validity period. Note that once the validity period has expired, a new key must be created and stored in the AESB.
193 +
194 +{{figure}}
195 +(% style="text-align:center" %)
196 +[[image:65_Intune_Geheimen Clientschlüssel hinterlegen.png]]
197 +
198 +{{figureCaption}}
199 +Adding a secret client key
200 +{{/figureCaption}}
201 +{{/figure}}
202 +
203 +{{aagon.infobox}}
204 +You will need the secret client key you created when you set up the AESB. Keep this in mind for future reference.
205 +{{/aagon.infobox}}
206 +
28 28  = Configuration in AESB and ACMP =
29 29  
30 30  Before you can use Intune in ACMP, you need to do some preliminary work in the ACMP and AESB consoles.
... ... @@ -36,7 +36,8 @@
36 36  Also tick the Public API access rights box to grant access. You can now save your settings. ACMP and SICS are now connected to each other.
37 37  
38 38  {{figure}}
39 -[[image:65_Intune_SICS-Verbindung_575.png||alt="65_ACMP_Einstellungen_SICS Verbindung.png" data-xwiki-image-style-alignment="center"]]
218 +(% style="text-align:center" %)
219 +[[image:65_Intune_SICS-Verbindung_575.png||alt="65_ACMP_Einstellungen_SICS Verbindung.png"]]
40 40  
41 41  {{figureCaption}}
42 42  Set up SICS connection in ACMP
... ... @@ -48,7 +48,8 @@
48 48  Now go to the AESB console. From the Dashboard, navigate to the //Products// menu item. In the overview you will find a list of all packages available for installation or updates. Select //ACMP Intune Adapter// and click //Install// either in the quick selection bar or directly in the fields. A new window will open and the installation will begin.
49 49  
50 50  {{figure}}
51 -[[image:65_AESB_Übersicht des ACMP Intune Adapters in der AESB Console.png||data-xwiki-image-style-alignment="center"]]
231 +(% style="text-align:center" %)
232 +[[image:65_AESB_Übersicht des ACMP Intune Adapters in der AESB Console.png]]
52 52  
53 53  {{figureCaption}}
54 54  Overview of the ACMP Intune Adapter in the AESB Console
... ... @@ -72,7 +72,8 @@
72 72  Select //Certificate// as the authentication type. Enter the certificate to be used in the Certificate field. Only .pfx files can be uploaded. Then enter the certificate password, if available. Also enter the Application ID (Client) (the ID is used to identify the user to Intune) and the Directory ID (Tenant) (it runs under the tenant) in the fields provided. Both strings can be found in the general information of the previously registered business application on the Azure AD pages.
73 73  
74 74  {{figure}}
75 -[[image:65_Eingabe der Anwendungs- und Verzeichnis-ID.png||data-xwiki-image-style-alignment="center"]]
256 +(% style="text-align:center" %)
257 +[[image:65_Eingabe der Anwendungs- und Verzeichnis-ID.png]]
76 76  
77 77  {{figureCaption}}
78 78  Enter the application and directory ID
... ... @@ -80,7 +80,8 @@
80 80  {{/figure}}
81 81  
82 82  {{figure}}
83 -[[image:65_AESB_Hochladen des Zertifikats.png||data-xwiki-image-style-alignment="center"]]
265 +(% style="text-align:center" %)
266 +[[image:65_AESB_Hochladen des Zertifikats.png]]
84 84  
85 85  {{figureCaption}}
86 86  Uploading the certificate
... ... @@ -96,7 +96,8 @@
96 96  {{/aagon.infobox}}
97 97  
98 98  {{figure}}
99 -[[image:65_Eingabe des geheimen Clientschlüssels.png||data-xwiki-image-style-alignment="center" height="234" width="1000"]]
282 +(% style="text-align:center" %)
283 +[[image:65_Eingabe des geheimen Clientschlüssels.png||height="234" width="1000"]]
100 100  
101 101  {{figureCaption}}
102 102  Enter the secret client key
... ... @@ -106,7 +106,8 @@
106 106  Also enter the Application ID (Client) (the ID is used to identify the user to Intune) and the Directory ID (Tenant) (under which the Tenant runs) in the fields provided. Both strings can be found in the general information of the previously registered Enterprise Application (Azure AD).
107 107  
108 108  {{figure}}
109 -[[image:65_Eingabe der Anwendungs- und Verzeichnis-ID.png||data-xwiki-image-style-alignment="center"]]
293 +(% style="text-align:center" %)
294 +[[image:65_Eingabe der Anwendungs- und Verzeichnis-ID.png]]
110 110  
111 111  {{figureCaption}}
112 112  Enter the application and directory ID
... ... @@ -114,7 +114,8 @@
114 114  {{/figure}}
115 115  
116 116  {{figure}}
117 -[[image:65_AESB_Eingabe der Informationen zum geheimen Clientschlüssel.png||data-xwiki-image-style-alignment="center"]]
302 +(% style="text-align:center" %)
303 +[[image:65_AESB_Eingabe der Informationen zum geheimen Clientschlüssel.png]]
118 118  
119 119  {{figureCaption}}
120 120  Enter the info for the secret client key
... ... @@ -144,7 +144,8 @@
144 144  In the query result set you will see the inventoried Client types (e.g. Clients of type Android, iOS or Windows). Select the Clients on which you want to perform an Intune action.
145 145  
146 146  {{figure}}
147 -[[image:65_Abfrageaktionen_Intune relevante Abfrageaktionen.png||data-xwiki-image-style-alignment="center"]]
333 +(% style="text-align:center" %)
334 +[[image:65_Abfrageaktionen_Intune relevante Abfrageaktionen.png]]
148 148  
149 149  {{figureCaption}}
150 150  Intune-relevant Query Actions
... ... @@ -176,7 +176,8 @@
176 176  {{/aagon.infobox}}
177 177  
178 178  {{figure}}
179 -[[image:65_Abfrageaktion_Ansicht der Intune Client Details.png||data-xwiki-image-style-alignment="center"]]
366 +(% style="text-align:center" %)
367 +[[image:65_Abfrageaktion_Ansicht der Intune Client Details.png]]
180 180  
181 181  {{figureCaption}}
182 182  View of the Intune Client details
© Aagon GmbH 2026
Besuchen Sie unsere Aagon-Community