Importing Device Data from Microsoft Intune to Assets

[#1]

In this article, we walk through why bringing Intune data into Assets matter, the ITSM use cases that are possible, and how to automate the integration.

Why Bring Microsoft Intune Data into JSM Assets?

When you populate Assets with device data from Intune, we can enable high-impact ITSM use cases.

Look Up Asset Data for Device Issues and Replacements

When an end user raises a ticket saying "my laptop is slow" or "I need a replacement," the service desk agent needs answers fast. With Intune data in Assets, the agent can look up the device directly from the ticket and see the model, OS version, compliance state, management agent, and whether encryption is enabled.

Assign Devices During Employee Onboarding

Onboarding a new hire involves provisioning the right hardware and ensuring it is enrolled and compliant before day one. When your Assets database reflects the current Intune inventory, HR and IT workflows in JSM can reference available devices, match them to the new employee, and update the assignment. Linking the Intune user ID or email address to a Jira user means the device-to-person relationship stays accurate and auditable.

Collect Devices for Offboarding Requests

When an employee leaves the organization, IT needs to know exactly which devices are assigned to them so that hardware can be collected, wiped, and returned to inventory. Having Intune data synchronized into Assets gives the offboarding workflow a reliable source of truth.

How OnLink Imports Intune Device Data into Assets

OnLink connects to 100+ sources be it HRIS, Identity Provider or Devices. OnLink is all you need to import to Assets.

One App for All Your Asset Integration Needs. 

Connecting OnLink to Entra ID

Because Intune is part of the Entra ID, OnLink authenticates through an Entra ID (Azure AD) app registration. The setup involves three steps:

1. Register an application in the Azure portal (Azure Active Directory → App registrations → New registration). Give it a descriptive name such as "OnLink Connection."
2. Grant API permissions. Under the app's API permissions blade, add Microsoft Graph application permissions (not delegated).
3. Create a client secret under Certificates & secrets. Copy the secret value immediately — it will not be visible again.

You will need three values to complete the connection in OnLink: the Directory (tenant) ID, the Application (client) ID, and the Client Secret — all available from the app registration's Overview and Secrets pages.

Full step-by-step instructions are available in the OnLink Entra ID documentation.

Permissions Required

The Entra ID app registration must have the following Microsoft Graph application permissions granted (with admin consent):

• DeviceManagementApps.Read.All — allows OnLink to read Intune app data, including detected applications on managed devices.
• DeviceManagementManagedDevices.Read.All — allows OnLink to read managed device properties such as model, OS, compliance state, and enrollment details.

These are read-only permissions, so OnLink will never modify your Intune environment

Field Mapping

Once the connection is established, you create an import configuration in OnLink and define the field mapping between Intune device properties and your JSM Assets object type attributes. OnLink uses a straightforward key/map syntax.

Supported Fields

Below are the commonly mapped Intune fields. Any property exposed by the Microsoft Graph managedDevice resource can be used as a source field.

Intune Field	Description
id	Unique device identifier in Intune
userId	ID of the user associated with the device
emailAddress	Email of the user associated with the device
deviceName	Name of the device
model	Device hardware model
manufacturer	Device manufacturer
serialNumber	Device serial number
operatingSystem	Operating system (Windows, macOS, iOS, Android)
osVersion	OS version number
complianceState	Compliance status (compliant, noncompliant, etc.)
managementAgent	Management channel (mdm, eas, etc.)
enrolledDateTime	Date and time the device was enrolled
azureADRegistered	Whether the device is Azure AD registered
isEncrypted	Whether disk encryption is enabled
jailBroken	Jailbreak/root detection status
activationLockBypassCode	Activation lock bypass code (iOS)
deviceCategoryDisplayName	Device category assigned in Intune
managedDeviceName	Managed device display name

Sample Mapping

key:id=id
map:userId=userId
map:emailAddress=Jira User
map:deviceName=deviceName
map:model=deviceModel
map:operatingSystem=operatingSystem
map:complianceState=complianceState
map:managementAgent=managementAgent

A few things to note about the mapping:

• The key line tells OnLink which field to use as the unique identifier, enabling upsert behavior (insert new records, update existing ones).
• When you map emailAddress to a JSM Assets attribute of type User, OnLink automatically looks up the matching Atlassian user account — no manual matching required.
• You can also map userId to a reference object (e.g., an Employee object) using the syntax map:userId=userIdRef|WorkerID=${userId}, which creates a relationship link between the device and the user object in your schema.

How to Get Apps Associated with Devices

Beyond device hardware details, OnLink can import the list of applications detected on each managed device. This is useful for software license tracking, compliance auditing, and security reviews.

To set this up, create a separate object type in your Assets schema for Apps with at least three attributes: AppID, AppName, and Devices (a reference to your Devices object type). Then create an OnLink importer with the following mapping:

key:id=AppID
map:displayName=AppName
map:devices=Devices|ID=${devices}
config:data_source=/v1.0/deviceManagement/detectedApps?$top=999
config:section=devices

This pulls detected applications from the Intune API and links each app to the devices where it is installed, giving you a complete software inventory inside JSM Assets.

Additional Features

OnLink offers several configuration options that help you tailor the import to your needs.

Filters

You can use the config:filter parameter to apply a filter expression to the Intune API query. For example, to exclude devices without a name:

config:filter=deviceName eq null or deviceName eq ''

Any valid OData filter expression supported by the Graph API can be used here, letting you narrow the import to specific device types, compliance states, or operating systems.

Data Limit

The config:data_limit parameter caps the number of records pulled from Intune in a single run. This is particularly useful during initial setup and testing — for example, config:data_limit=100 lets you validate your mapping against a small dataset before trying the full dataset.

Ready to get started? Install OnLink from the Atlassian Marketplace and try the Intune-to-Assets integration today. For detailed setup instructions, visit the OnLink documentation for Intune.