⚙ IntuneHydrator Licensing Gap Analysis & Intune Hydration via Microsoft Graph

Initial Setup & App Registration

This tool requires a Microsoft Entra ID App Registration in your own tenant to authenticate on your behalf (delegated permissions) and call Microsoft Graph to evaluate both Microsoft Intune and Microsoft Entra ID configurations.

1. Create the App Registration in Microsoft Entra ID

  1. In the Microsoft Entra admin center, navigate to Identity → Applications → App registrations → New registration.
  2. Name: e.g. IntuneHydrator. Supported account types: Accounts in this organizational directory only.
  3. Redirect URI: select "Mobile and desktop applications" (public client — no client secret required), then enter your custom Redirect URI: 
    https://aibilzlabs.com/intune/callback.php
    (Microsoft Entra supports http://localhost over HTTP specifically for local admin tools.)
  4. Once created, open Authentication and enable "Allow public client flows" = Yes, then save.
  5. Open API permissions → Add a permission → Microsoft Graph → Delegated permissions, and add the delegated permissions below: 
    User.Read
Organization.Read.All
Directory.Read.All
Policy.Read.All
Policy.Read.ConditionalAccess
IdentityRiskEvent.Read.All
IdentityRiskyUser.Read.All
RoleManagement.Read.Directory
DeviceManagementConfiguration.ReadWrite.All
DeviceManagementApps.ReadWrite.All
DeviceManagementServiceConfig.ReadWrite.All
DeviceManagementManagedDevices.ReadWrite.All
DeviceManagementRBAC.Read.All
    (openid, profile, and offline_access are added automatically by Entra.)
  6. Click "Grant admin consent for [your tenant]" — admin consent is required because these scopes read tenant-wide security policies, Conditional Access rules, and device configurations.
  7. Return to the Overview page and copy the Application (client) ID and Directory (tenant) ID into section 2 below.

📋 Permissions Breakdown by Domain

Domain Delegated Permission Purpose in Gap Analysis & Hydration
🛡️ Microsoft Entra ID (Identity Security) Policy.Read.All Evaluates Authorization policy, Authentication Methods, and B2B Cross-Tenant access settings.
Policy.Read.ConditionalAccess Audits Conditional Access policies (Admin MFA, Block Legacy Auth, Device Compliance Gate).
Directory.Read.All Reads directory objects, Global Administrator role memberships, and security defaults.
RoleManagement.Read.Directory Audits Privileged Identity Management (PIM) directory role governance.
IdentityRiskEvent.Read.All Audits Entra Identity Protection risk detections & sign-in risk events (Entra ID P2).
IdentityRiskyUser.Read.All Audits compromised credential detections & user risk policies (Entra ID P2).
📱 Microsoft Intune (Endpoint Management) DeviceManagementConfiguration.ReadWrite.All Audits and creates Device Compliance policies, Settings Catalog profiles, and BitLocker encryption.
DeviceManagementApps.ReadWrite.All Audits and creates Mobile Application Management (MAM) App Protection policies.
DeviceManagementServiceConfig.ReadWrite.All Audits and configures Windows Autopilot deployment profiles and Enrollment Status Page (ESP).
DeviceManagementManagedDevices.ReadWrite.All Reads enrolled device telemetry and platform compliance status.
DeviceManagementRBAC.Read.All Reads Intune role-based access control assignments.
🏢 Tenant & Account Organization.Read.All Reads subscribed licensing SKUs, verified domains, and custom company branding.
User.Read Authenticates the signed-in administrator and retrieves user profile.

2. Enter Non-Secret App Identifiers

Must match the exact Redirect URI entered in step 1.3.
No client secret is required: this tool uses the OAuth2 Authorization Code + PKCE flow for public clients, where your interactive sign-in (with MFA) authenticates each session.