M365 (Intune, Defender for Endpoint, Entra ID)

M365 Data Sources

Below are the instructions to configure a service principal (app) so Glue can access M365 information. You will need a Client ID, Secret and Azure AD Tenant ID in order to access the data.

Required API Permissions

Glue requires access to Microsoft Graph and Windows Defender ATP APIs. The following permissions are required depending on which data sources you want to use:

Intune

• Microsoft Graph: DeviceManagementManagedDevices.Read.All

Entra ID Devices

• Microsoft Graph: Device.Read.All

Defender for Endpoint

• WindowsDefenderATP: Machine.Read.All

All of these permissions can be added to a single app registration.

Setup Instructions

Create a new app in Azure AD called Glue_M365 with a web redirect URI of http://localhost.

Under Authentication -> Settings select ‘Access Tokens’.

Under API permissions, add the following permissions based on your requirements:

For Microsoft Graph:

• DeviceManagementManagedDevices.Read.All (for Intune)
• Device.Read.All (for Entra ID devices)

For WindowsDefenderATP:

• Machine.Read.All (for Defender for Endpoint)

Make sure to select ‘Application Permissions’ for each and grant admin consent.

Select Certificates and secrets. Create a Client secret

Be sure to copy the Value as it is only available when you initially create the secret. The Secret ID is not needed