Connect Microsoft Intune

The Microsoft Intune integration automatically syncs your iOS, iPadOS and Android tablets and smartphones into the mobile device inventory. You connect it once from Settings › Integrations, with the approval of a Microsoft administrator of your organisation.

This page covers syncing mobile devices. To deploy the user agent or the browser extension on your computers with Intune, see Deploy User Agent via Intune and Deploy Browser Extension via Intune.

Prerequisites

• In Kabeen: the Owner role. Installing and removing integrations is reserved for workspace administrators.
• At Microsoft:
  • a Microsoft Entra Global Administrator or Privileged Role Administrator account, to approve Kabeen's access;
  • a Microsoft Intune licence.

If you are not a Microsoft administrator yourself, send an approval link to an administrator of your organisation (see "Asking a Microsoft administrator for approval" below).

What Kabeen can read

Access is strictly read-only: Kabeen cannot change, lock or wipe your devices. The Microsoft administrator grants two permissions:

• Read the managed devices: the DeviceManagementManagedDevices.Read.All application permission, granted for the organisation;
• Verify the administrator's identity: the administrator's sign-in, which lets Kabeen check their role.

The integration's Data tab details the information retrieved:

Only iOS, iPadOS and Android devices are synced: Windows and macOS devices managed by Intune are ignored.

Connecting Intune

If you are a Microsoft administrator:

1. Open Settings › Integrations. The Microsoft Intune card is in the Mobile device management (MDM) section.
2. To sync only some of your devices, first click the card, set the criteria in the Synced devices tab (see below), then connect from that window: the criteria apply from the first sync. The card's Connect Intune to Kabeen button syncs every device.
3. A Microsoft window opens. Sign in with your administrator account and accept the permission requested for your organisation.
4. Kabeen checks your role and the Intune licence, then the window shows Integration connected and closes. The message "Microsoft Intune is connected. The first sync has started." confirms the connection.

If nothing opens, your browser has probably blocked the window: allow pop-ups for Kabeen, then try again. A connection attempt expires after 10 minutes.

Asking a Microsoft administrator for approval

If you are not a Microsoft administrator, Kabeen lets you create an approval link to send to an administrator of your organisation. They don't need a Kabeen account.

1. In Settings › Integrations, click the Microsoft Intune card.
2. If needed, first set the criteria in the Synced devices tab: the link carries them.
3. In the Overview tab, Ask a Microsoft administrator section, click Create an approval link.
4. Copy the link with Copy: it is shown only once and stays valid for 48 hours. Kabeen never sends this link itself: pass it on to your administrator however you like.

The administrator opens the link and sees a Kabeen page that presents the request: who is asking, the permissions requested, the data retrieved and the synced devices. They click Continue to Microsoft Intune, sign in to Microsoft and accept the permission, then come back to Kabeen's Confirm the connection page:

• Confirm and connect installs the integration and starts the first sync;
• Decline rejects the request.

If the domain of their email address differs from the requester's, the administrator must also type your workspace name. They have 10 minutes after signing in to Microsoft to confirm.

On your side, the integration window shows where the request stands (waiting, declined or expired) and updates itself once the integration is connected. The Connected by field then shows the administrator's Microsoft account.

Only one link can be live at a time: creating a new one cancels the previous one, and Cancel the link turns it off. You can create up to five links per 24 hours.

Choosing the synced devices

The Synced devices tab, Selection criteria section, lets you limit the sync:

By default, every value is selected: selecting everything means no filter. Once connected, click Save to apply your changes: a sync starts straight away. A device the criteria leave out stays in Kabeen with the No longer managed status.

Syncing

Kabeen syncs your devices automatically about every 30 minutes. The Sync now button starts a sync immediately.

The integration's Overview tab shows:

• the result of the last sync (succeeded, failed or in progress) and the number of synced devices;
• the time until the next sync;
• the Microsoft tenant ID, the account that connected the integration (Connected by) and when (Connected on);
• a See the full list link to the mobile devices.

A device that disappears from Intune is not deleted: it moves to the No longer managed status, and becomes managed again if it is reported again. A Microsoft organisation can only feed one Kabeen workspace.

Card status

Connection errors

Disconnecting the integration

In the integration window, click Disconnect the integration, then confirm with Remove. Kabeen stops syncing your devices; the devices already synced stay in Kabeen with the No longer managed status. If you reconnect Intune later, these devices become managed again.

Disconnecting the integration doesn't remove the permission granted at Microsoft. To revoke Kabeen's access completely, also remove Kabeen in the Microsoft Entra admin center, under Enterprise applications.

Learn more

• Mobile device inventory
• Roles and permissions
• Deploy User Agent via Intune