Microsoft Intune

Proofroom reads Microsoft Intune through Microsoft Graph with an app registration’s application permissions. Add it on Integrations → Catalogue → Microsoft Intune → Connect.

What each collector shows

Collector	Kind	Default cadence	What it shows	Suggested controls
Device inventory with encryption	snapshot	monthly	Every managed device with its user, platform, OS version, last check-in and disk encryption (Intune’s own isEncrypted reading). Devices not encrypted come first.	PCI DSS 12.5.1; SOC 2 CC6.1, CC6.7
Operating system versions	snapshot	monthly	Each device’s OS version against your minimum for its platform (or the highest minimum OS version an assigned compliance policy sets), or, with no minimum, the newest version seen on that platform. Without a minimum the evidence shows drift, not patching: the headline says so and PCI DSS 6.3.3 is suggested only once you set minimums.	PCI DSS 6.3.3 (with minimums); SOC 2 CC7.1
Screen lock	snapshot	quarterly	Each compliance policy’s password and lock-after-minutes settings, and each device’s lock: locked only when a policy that requires a password and locks within 15 minutes is assigned, applies to the device, and the device complies with it (from the policy’s device statuses, matched by device name and user). A policy locking later makes the device not locked in time; anything else (not listed, listed twice, non-compliant, assignments not readable) is unknown. Intune reports no per-device lock setting.	PCI DSS 8.2.8; SOC 2 CC6.1
Devices not checking in	snapshot	monthly	Devices not seen for 30 days (or the number you set). Their encryption, updates and screen lock can no longer be confirmed.	PCI DSS 12.5.1; SOC 2 CC7.1

The connection also takes staleDays (30 by default) and, optionally, minimumOsVersions: one line per platform, such as macOS 15.6, Windows 10.0.26100 or iOS 18.6. A configured minimum wins over one read from the system. Without a minimum, a platform is compared with the newest version seen on any of its devices, which shows drift but not whether a version is still supported.

Disk encryption is mapped to SOC 2 CC6.1 and CC6.7, not to PCI DSS 3.5.1: PCI DSS accepts disk-level encryption for stored card numbers only on removable media (3.5.1.2), so laptop encryption is not evidence for 3.5.1.

The device inventory also feeds the Endpoint coverage built-in (computers without endpoint protection, leavers’ devices), the Endpoints posture score, and a risk suggestion when devices in use are not encrypted (Admin → Risks → Raised automatically).

Proofroom keeps device names, serial numbers, users, platforms, versions, dates and states. It never reads recovery keys, IMEI, phone numbers or notes.

Create the app registration

In the Microsoft Entra admin center, go to Entra ID → App registrations → New registration. Name it “Proofroom” and register it. Note the Application (client) ID and Directory (tenant) ID.
Certificates & secrets → Client secrets → New client secret. Copy the secret’s Value; it is shown once.
API permissions → Add a permission → Microsoft Graph → Application permissions, and add:
- DeviceManagementManagedDevices.Read.All: managed devices.
- DeviceManagementConfiguration.Read.All: compliance policies and their device statuses (screen lock and minimum OS versions).
- Application.Read.All (optional): when the client secret expires, so Proofroom can warn before it does.
Select Grant admin consent for your directory.

The tenant needs an active Intune licence; without one Graph refuses every Intune call. One app registration can serve Azure, Entra ID, Intune and Defender for Endpoint if it has all their permissions. Proofroom never writes to Intune.

Connect

Field	Value
Directory (tenant) ID	From step 1 (or a verified domain)
Application (client) ID	From step 1
Client secret	From step 2
`staleDays`	30 unless your standard differs
`minimumOsVersions`	Optional; see above

Test connection signs in and reads one managed device and one compliance policy, naming the permission (or the missing licence) for any that is refused.

Known limits

UNVERIFIED: $select on the managed-device list and $expand=assignments on compliance policies are not stated on Microsoft’s list pages. If Graph refuses either (HTTP 400), Proofroom reads the full objects, or treats every policy as possibly assigned, and says so in the evidence.
UNVERIFIED: the exact answer for a tenant without an Intune licence. A 400 “not applicable to target tenant” and a 403 are both reported as “check the licence and the permission”.
Intune’s isEncrypted has no unknown state, so a device that never reported encryption may read as not encrypted.
A Windows device whose BitLocker protection is suspended (for example during an update) may still read as encrypted.
Device statuses per policy carry no device ID, so they are matched by device name and user; two devices with the same name and user show unknown.