Microsoft Intune
Integration Context Contract
- Canonical contract:
docs/integration-context.md
| Workflow | tenantId | subscriptionId | environmentCloud | principalType | scopesOrRoles |
|---|---|---|---|---|---|
| Microsoft Intune operations | required | optional | AzureCloud* |
delegated-user or service-principal | DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementConfiguration.ReadWrite.All, DeviceManagementApps.Read.All |
- Use sovereign cloud values from the canonical contract when applicable.
Fail fast before API calls when required context is missing or malformed. Redact tenant, subscription, and object identifiers.
Command Surface
| Command | Purpose |
|---|---|
intune-setup |
Deterministic workflow for intune setup. |
intune-noncompliant-devices |
Deterministic workflow for intune noncompliant devices. |
intune-lost-device-action |
Deterministic workflow for intune lost device action. |
intune-compliance-policy-deploy |
Deterministic workflow for intune compliance policy deploy. |
intune-app-protection-review |
Deterministic workflow for intune app protection review. |
Guardrails
- Validate context schema and minimum grants before any API call.
- Run read-only discovery first whenever possible.
- Require explicit confirmation for destructive actions.
- Re-query and verify post-action state.
- Return structured, redacted output.
Progressive Disclosure - Reference Files
| Topic | File |
|---|---|
| Endpoint and permission reference | references/api-reference.md |