Synchronizing Microsoft Intune Device Data

Use the product-provided Microsoft Intune - Node Data Synchronization Workflow to retrieve device information from Microsoft Intune and update matching nodes in Genian ZTNA. For example, store the Intune compliance state in a node custom field and use that field as a node group condition.

This procedure applies to an installation that provides both the Intune Workflow and the Workflow DB type in Data Synchronization.

Prerequisites

  • A Microsoft tenant with an active Intune license and an Intune-enrolled test device.

  • A Microsoft Entra application with the Microsoft Graph Application permission DeviceManagementManagedDevices.Read.All and administrator consent for that permission.

  • The application's Directory (tenant) ID, Application (client) ID, and client secret Value.

  • A node that already exists in Genian ZTNA and has a MAC address matching the Intune device.

  • HTTPS access from the policy server to login.microsoftonline.com and graph.microsoft.com on TCP port 443.

For application registration and credentials, see Microsoft's Register an application and Add credentials guides. The required Intune license and API permissions are listed in List managedDevices.

Configuring the Intune Workflow

  1. Open the Workflow page.

  2. Open Microsoft Intune - Node Data Synchronization. The product-provided icon identifies the default Workflow. Its name follows the installation language, so it may appear in another language.

  3. Expand Integration Information using the >> control.

  4. In the intune integration information, enter the following values.

    Key

    Value

    Type

    tenantId

    Directory (tenant) ID of the Entra application

    Plaintext

    clientId

    Application (client) ID of the Entra application

    Plaintext

    clientSecret

    Client secret Value, rather than Secret ID

    Secret

  5. Keep the default authentication and Microsoft Graph addresses. The default Workflow uses Microsoft Graph v1.0.

  6. Save the Workflow and use Test to check its execution. Confirm that the final device records contain deviceMac and complianceState.

Note

The three credentials are initially empty. When replacing a saved Secret, delete its entry and add it again with the same key and the Secret type. Replace the client secret when it expires.

The Workflow obtains an access token, retrieves a device list, and then queries each device by its device ID to obtain the device information and MAC address. For Workflow editor details, see Workflow.

Preparing node custom fields

  1. Go to Preferences > Properties > Custom Fields > Node.

  2. Select an unused Key and create a text field named, for example, Intune Compliance State. Note the selected Key for the field mapping.

  3. If needed, create separate text fields for values such as the serial number and the last Intune synchronization time.

See Using custom fields to enter additional information in nodes for the field creation and node view settings. Use an available field rather than overwriting a field already used for another purpose.

Configuring data synchronization

  1. Go to Preferences > User Authentication > Data Synchronization and select Tasks > Create.

  2. Enter a unique ID, such as Intune. Set Update Interval to Disabled for the first manual run and set Policy Apply according to the required policy application behavior.

  3. For DB Type, select Workflow.

  4. For Node Workflow, select Microsoft Intune - Node Data Synchronization.

  5. Leave Result Array Field Name and Next Page Field Name blank. The default Intune Workflow returns an array of device records.

  6. Enable Node Information Sync. Disable User Information Sync, Department Information Sync, Job Title Information Sync, and Device Life-Cycle Information Sync.

  7. Configure the node field mappings below. In Custom field, select the destination that corresponds to the Key used when creating the node custom field, and enter the source field in Column name.

Destination

Source column name

Description

Column Name for MAC

deviceMac

Required. MAC address selected by the Workflow.

Column Name for IPv4

Leave blank

Identifies existing nodes by MAC address.

Compliance state custom field

complianceState

Stores the compliance state returned by Intune.

Node name (optional)

deviceName

Replaces the existing node name when mapped.

Serial number (optional)

serialNumber

Stores the device serial number.

Last Intune sync (optional)

lastSyncDateTime

Stores the device's last Intune synchronization time.

Enter deviceMac directly for the MAC column. Each field name is relative to one device record, so no result. or value. prefix is required. Only fields that you map are written to the node.

For common configuration settings, see Synchronizing Data with Workflow.

Checking the result

  1. Save the synchronization configuration.

  2. Select it in the configuration list and choose Tasks > Synchronize Now.

  3. Check Last Synchronized, Duration of Synchronization, and Synchronization Status in the configuration list. Check Logs for details if synchronization fails.

  4. Open the matching node under Management > Node and check that the MAC address and the custom field value match the device record from the Workflow.

  5. After confirming the result, configure the required Update Interval.

For example, an Intune complianceState of compliant should appear as compliant in the mapped custom field. Other values include unknown, noncompliant, conflict, error, inGracePeriod, and configManager. Review each state when configuring a node group rather than treating every other value as the same state. See Managing Node Groups.

Synchronization conditions

MAC matching

The Workflow uses the Wi-Fi MAC address first and falls back to the Ethernet MAC address when the Wi-Fi MAC is absent. It returns one MAC address per device, in uppercase with colon separators. If both addresses are present, an Ethernet-only node will not match the selected Wi-Fi address. If neither address is provided, the record cannot update a node by MAC address.

Node information synchronization updates matching existing nodes. It does not create or delete nodes or change their MAC or IP addresses. If several nodes have the same MAC address, MAC-only synchronization can update all of them. An empty value in a mapped field can clear the existing node value.

Device lists with multiple pages

The default Intune Workflow processes only the first page of the device list. If Microsoft Graph returns additional pages, their devices are not collected by this Workflow. Compare the returned device list with the intended target devices before scheduling synchronization. Changing Next Page Field Name alone does not make the default Workflow collect the additional pages.

Update timing

A device's status must first be reflected in Intune and Microsoft Graph before the next Genian ZTNA synchronization can retrieve it. The lastSyncDateTime value is the device's Intune synchronization time, rather than the execution time of Genian ZTNA Data Synchronization.

If a run fails, check the client secret expiration, administrator consent, connectivity to Microsoft, and the Workflow test result. After changing credentials or field mappings, verify the result with a manual run.