Intune Device Sync

Build an Okta Workflow that pulls every Microsoft Intune-managed device into a Workflows table on a daily schedule. Captures device name, compliance state, last check-in, and enrollment date for audit, reporting, or downstream automation.

What you're building

Okta Workflows has no native Microsoft Intune connector. Querying Intune means calling Microsoft Graph at /deviceManagement/managedDevices with an app-only OAuth token. This guide walks you through building the whole pipeline in the Workflows UI — starting from an empty folder.

Three flows, one table, one connection:

• Flow 1 — Intune Device Sync (scheduled, daily): clears the table, starts pagination.
• Flow 2 — Fetch Intune Devices Page (helper, recursive): calls Graph, iterates devices, recurses for the next page.
• Flow 3 — Create Intune Device Row (helper): writes one table row per device.

Once running you get a table you can join against Okta users, filter for noncompliant devices, drive group-membership decisions, or pipe into a BI tool.

Build order & conventions

We build bottom-up: Flow 3 first, then Flow 2, then Flow 1. That way, every Call Flow / For Each card has a real target flow to pick when you configure it — no half-wired state.

Inside each step, every card gets its own block with four things: which card to pick, what it does, where it goes in the flow, and exactly what to paste / drag into each field.

Field-kind key (inside card tables)

Prereq — Register an Entra ID app

Step 1 — Create the Microsoft Graph connection

Step 2 — Create the Intune Devices table

Step 3 — Flow 3: Create Intune Device Row

Step 4 — Test Flow 3 with one real device

{
  "id": "abcd1234-5678-90ab-cdef-1234567890ab",
  "deviceName": "LAPTOP-ABC123",
  "complianceState": "compliant",
  "lastSyncDateTime": "2026-04-29T10:15:32Z",
  "enrolledDateTime": "2025-06-12T08:00:00Z",
  "userPrincipalName": "alice@contoso.com",
  "operatingSystem": "Windows"
}

https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?$filter=deviceName eq 'LAPTOP-ABC123'&$select=id,deviceName,complianceState,lastSyncDateTime,enrolledDateTime,userPrincipalName,operatingSystem

Step 5 — Flow 2: Fetch Intune Devices Page

Step 6 — Flow 1: Intune Device Sync (scheduled main)

Step 7 — Test end-to-end

Step 8 — Turn on the schedule

Tuning & known edges

• Snapshot vs. upsert: This pattern does a full snapshot (clear + refill) so the table always reflects current Intune truth. To track compliance state changes over time, swap Clear Table for a Search Rows lookup by Device ID and a conditional Create/Update. Add a retention sweep since your row count will grow.
• Co-managed devices: If a device is co-managed with SCCM/Configuration Manager, complianceState can return configManager. Treat these as "trust the on-prem side" or filter them out before compliance alerting.
• Delta queries: For large tenants, switch the main flow's URL to https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/delta and persist the @odata.deltaLink in a scratch table. Subsequent runs only return changed devices.
• Rate limits: Graph limits device management endpoints to ~100 requests per 20 seconds per app. At $top=100, a 10k-device tenant is 100 calls — fits comfortably. At $top=50 you'll hit the limit; add a Wait For card in the paginator (e.g., 250ms) if you lower the page size.
• Select fewer fields for speed: Graph responses compress better the fewer fields you select. The URL in Step 6 already uses $select. Trim further if you don't need UPN or OS.
• Sovereign clouds: Replace graph.microsoft.com with graph.microsoft.us (GCC-High) or microsoftgraph.chinacloudapi.cn (China 21V). Tenant and token URLs also differ — check Microsoft's sovereign cloud matrix.

Extending this pattern

The paginator-helper architecture generalizes to any paged Microsoft Graph endpoint. To pivot this workflow to a different data source, change two things:

1. The initial graphUrl in Flow 1's Assign card. Use the full absolute URL with the https://graph.microsoft.com/v1.0 prefix — e.g. https://graph.microsoft.com/v1.0/users or https://graph.microsoft.com/v1.0/groups.
2. The column set on the table and the field mapping in the Create Row helper.

Useful Intune-adjacent endpoints that work identically. Prefix each path below with https://graph.microsoft.com/v1.0 when pasting into the Assign card:

Related

• Okta Username Discrepancy Audit — same scheduled-sync pattern, targeted at Okta profile/app UPN drift.
• Okta Workflows → ManageEngine ServiceDesk Plus — OAuth-with-refresh pattern for connectors whose auth is more complex than client-credentials.