Microsoft Intune integration
Pull the devices Intune manages into the register on a schedule, matched to your assets by serial number, with nothing installed on the devices.
What it does
Device sync reads the managed devices list from Microsoft Graph and reconciles each one against your register. A device whose serial number matches an existing asset is paired with it; if there is no serial match, Tagaris tries the hostname. Every device then lands in the review queue under Discovered, where an administrator links it to the matched asset, imports it as a new asset, or ignores it. Nothing is created in the register until a person says so, unless you switch the policy to auto-link confident serial matches.
Re-syncs run daily or weekly, or on demand with Sync now. Each run updates the same discovered record for a device rather than adding another, and a device you have already linked, imported or ignored never comes back. The Jamf Pro connector feeds the same queue, so a mixed Windows and Mac estate reviews in one place. Setup detail is in the device sync documentation.
What comes across
Alongside the device name, serial number, manufacturer, model and operating system, the sync reads the RAM and storage Intune reports. When you link or import a device those values fill the asset's spec fields, but only the ones you have not set by hand; a value you typed is never overwritten. Intune has no clean CPU model string, so CPU stays blank from this source.
Last check-in, ownership (company or personal) and compliance state come across too, and drive the filters. The review queue shows the specs before you import.
- Filters by operating system, seen within the last N days, ownership and compliance
- A daily or weekly schedule, or off, plus Sync now
- Review policy: queue everything, or auto-link confident serial matches and queue the rest
- Choose which descriptive fields to import; serial, hostname and name are always kept
- An optional client secret expiry date, warned 30, 7 and 1 days ahead in the daily digest
What it needs
One app registration, one permission, one secret and a free beta key.
An app registration in Entra ID
Reuse the app you registered for single sign-on or Microsoft 365 email, or create a separate one under App registrations. Note the directory (tenant) ID and application (client) ID from its Overview.
One application permission
Under API permissions, add the Microsoft Graph application permission
DeviceManagementManagedDevices.Read.All and grant admin consent. That
single permission is all the pull needs.
A client secret
Create one under Certificates and secrets and copy its value. Record the expiry, and enter it in Tagaris so the digest reminds you to rotate it.
A beta key
Device sync is a free beta. Email [email protected] for a key, then apply it under Settings, Application, Licence. It sits alongside a Team licence if you have one (see licensing).
The connector card
Settings, Integrations, then Microsoft Intune and Entra ID. Enter the three values and use Test connection: it signs in and reads one device, so a green result means the permission is consented and the pull will work. Enable the connector, pick a schedule, or run Sync now.
If the test reports that the request is not applicable to the tenant, that tenant has no Intune provisioned, so there are no managed devices to read. The credentials and the permission are fine.
What it will not do
- Install an agent. Nothing runs on the endpoint.
- Write to Intune. No enrolment, no policy, no wipe, no change to any device record.
- Create assets behind your back. Under the auto-link policy only a confident serial match to an existing asset links itself; every new or ambiguous device waits in the queue.
- Run in real time. Runs are daily, weekly or on demand.
- Replace Intune. Intune stays the MDM; the register keeps the record.
Can Intune be an asset register?
Intune knows the devices enrolled in it: model, serial number, last check-in, compliance. For a fleet of managed laptops that is real inventory, and it may cover most of what you own.
A register holds the rest. The kit that never enrols: switches, access points, printers, monitors, servers and the spares in the cupboard. The money: purchase date and cost, warranty end date, depreciation, and the supplier invoice attached to the record. The people and places: who has the device, which room it sits in, and the history of both. The stock: accessories, components and consumables. And the past: a device disposed of last year is still in the register with its book value at disposal, long after Intune has forgotten it.
Using Intune as the feed and Tagaris as the register gives each the job it is good at. Intune says what is enrolled today. The register records everything, with the Intune view as one input among several. The features page covers the rest of the register, and the integrations page lists everything else that feeds it.
Common questions
What if a device in Intune has no serial number?
Tagaris tries the hostname. If neither matches an asset, the device sits in the review queue unmatched, and you import or ignore it. A device with no serial number and no hostname is never matched automatically.
Do I need the Team licence for Intune sync?
No. Device sync is a free beta on any tier, including the free tier. Request a key from [email protected] and apply it under Settings, Application, Licence.
Will the sync overwrite hardware specs I entered by hand?
No. RAM and storage from Intune fill only the spec fields that are empty on the asset. Anything you typed stays as it is.
The test says the request is not applicable to the target tenant. What is wrong?
Nothing with the credentials. That response means the tenant has no Intune provisioned, so there are no managed devices to read. Tagaris explains it in plain words on the test result.
Try it against your own tenant
The live demo shows the register and the Integrations screen. A beta key, free on request, turns the Intune sync on in your own install.