---
schema_version: "1"
id: ce12961d06db8ab20463d0178b78033e4b6a7398abdf290cd5e2dcf1eed530d0
title: Create a Discovery Target for Microsoft Intune
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/it_srvcs_discovery_create_intune_trgt.md
canonical_url: https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_create_intune_trgt.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: aa3b29d317514fd8d69f8a81fcb22d9432259805668d83b0d3bf0577b2c8d9bd
description: Create a Microsoft Intune discovery target to bring managed device data into CMDB and keep endpoint configuration items (CIs) accurate and up to date. Map Intune device attributes, validate the integration connection, and run discovery using Salesforce Flow. Populate CMDB with managed computer and mobile device data, and support IT operations that rely on accurate CI data.
products:
  - Service Cloud
  - Agentforce IT Service
release: "264"
---
# Create a Discovery Target for Microsoft Intune

Create a Microsoft Intune discovery target to bring managed device data into CMDB and keep endpoint configuration items (CIs) accurate and up to date. Map Intune device attributes, validate the integration connection, and run discovery using Salesforce Flow. Populate CMDB with managed computer and mobile device data, and support IT operations that rely on accurate CI data.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions with Agentforce IT Service that have Discovery enabled.</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d117166e74">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d117166e74 ">To manage discovery:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d117166e74 ">IT Service Asset Discovery</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d117166e74 ">To create and manage the Intune connection:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d117166e74 ">Manage Integration Connections</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d117166e74 ">To create and activate the integration flow:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d117166e74 ">Manage Flow</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d117166e74 ">To use the integration template as a non-admin user:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d117166e74 ">App Framework Manage Template</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d117166e74 ">To keep connector usage unmetered:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d117166e74 ">Unmetered Base AI Usage for Service Desk permission set</td>

          </tr>
        </tbody>
      </table>

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-it_service-264-0-0-production-enus/0a574a10-4c7a-4681-aacf-0767f8beaad4/images/icon_important.png)

Important CMDB integrations are powered by MuleSoft flow connectors, which consume automation credits. Before you create a discovery target, assign the Unmetered Base AI Usage for Service Desk permission set to each user who creates or manages discovery targets. The permission set keeps the connector usage unmetered so that it doesn't count toward your credit consumption.

Complete these steps before you create the target.

- Turn on Intune discovery in Salesforce Go. For more information, see [Set Up Discovery using Salesforce Go](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_setup_salesforcego.htm&release=264.0.0&type=5 "Swiftly enable Salesforce Discovery to automate asset identification and synchronization in just a few steps by using Salesforce Go. Use the guided setup experience to turn on the Discovery feature, install the agentless discovery application, and configure targets and credentials. Reduce manual setup and ensure accurate CMDB population with a single activation flow.").
- Make sure that the FlowIntegrationAddOn license is enabled for your org. Intune discovery runs on Salesforce Flow.
- Create an app registration in Microsoft Entra ID.

Register an application in Microsoft Entra ID to get the OAuth details for the Intune connection. During registration, complete these steps:

- Capture the Application (client) ID.
- Create a client secret and capture its Value.
- Note the Directory (tenant) ID.
- Under API permissions, add these Microsoft Graph application permissions:
    - `DeviceManagementManagedDevices.Read.All`
    - `DeviceManagementApps.Read.All`
    - `User.Read.All`
- Grant admin consent for the permissions.

For more information, see [Register an application in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app).

1. From the App Launcher, find and select **CMDB and Service Graph**.
2. From the navigation panel, select **Discovery & Scanning**, and then select **Targets**.
3. Select **New**.
4. In Target Categories, select **MDM & Device Management**.
5. In Probe Types, select **Microsoft Intune**, and then select **Save and Continue**.
6. Enter a target name.
7. Optionally, enter a description and location.
8. Configure the Intune connection.
    1. In Intune Connection, select **New Connection**.
    2. Enter a name and description.
    3. Enter the authentication details from your Microsoft Entra ID app registration.
        
        | Field | Value |
        | --- | --- |
        | Client ID | Application (client) ID |
        | Client Secret | Client secret value |
        | URL | `https://graph.microsoft.com/v1.0` |
        | Scope | `https://graph.microsoft.com/.default` |
        | Token URL | `https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token` |
    4. Replace `{tenant-id}` with your Directory (tenant) ID.
    5. Save the connection.
        
        The connections that you create appear in the Intune Connection field.
    6. Test the connection to confirm that Salesforce can authenticate with Microsoft Intune.
9. Turn on Software Sync to discover installed software from Intune-managed devices.
    
    Turn off Software Sync to limit discovery to device and hardware data.
10. In **Device Types to Sync**, select the ownership types to include for each device category.
    
    Device type selection controls which Intune-managed endpoints Salesforce imports into CMDB. Use this option to align discovery with your organizational policies.
    
    | Option | Description |
    | --- | --- |
    | Corporate-owned | Syncs only company-owned devices in that category. |
    | Employee-owned | Syncs only personally owned devices. Use this option for bring-your-own-device (BYOD) policies. |
    | Both | Syncs corporate-owned and employee-owned devices. |
    | None | Excludes that device category from discovery. |
11. In **Scan Frequency**, select one of these options:
    
    | Option | Description |
    | --- | --- |
    | Immediate | Runs discovery as soon as you create the target. |
    | Daily | Keeps device and software data refreshed every day based on the schedule that you set. |
    | Weekly | Syncs data every week based on the schedule and days that you set. |
12. Select **Next**.
13. Map Intune fields to CMDB fields for compute devices, mobile devices, and installed software. Mapping makes sure that incoming Intune data aligns with your CMDB data model and identification rules.
    1. On the Field Mapping page, review how the Salesforce attributes map to the Intune device attributes for each CI type.
    2. Map any unmapped Intune fields to the appropriate CMDB fields.
        
        To capture an attribute that isn't mapped by default, create a custom field in CMDB and map the Intune attribute to it. For more information, see [Considerations for Mapping Intune Fields to CMDB](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_intune_field_mapping.htm&release=264.0.0&type=5 "Review these considerations before you map Intune device attributes to CMDB fields. Learn which mappings you can't change, how certain values are formatted, and how to capture more Intune data. These considerations help you avoid data issues and get accurate device data on the first scan.").
14. On the Integration Flows page, review the linked Salesforce flow for Intune discovery.
    
    If a flow doesn't load, retry or resolve the issue before continuing.
15. Select **Create and Run Flow**.

CMDB creates or updates configuration items based on your field mappings and identification rules.

Select **View Scan Result** to open the Scan Jobs page and monitor progress. CMDB creates a dedicated scan job for each target. Each scan job shows a summary of resources by type and a detailed list of new and updated CIs.