Add Microsoft Intune as a posture provider
Available on: Enterprise
Firezone reads Intune managed-device records to evaluate compliance, encryption, device ownership, and other security requirements before granting Resource access. Posture fields apply to Windows, macOS, iOS/iPadOS, and Android, with some checks limited to particular platforms.
Before you begin
Prepare an Intune-enrolled test device and complete the shared
Device Posture setup prerequisites.
Your tenant needs an active Intune license and an administrator who can grant
tenant-wide consent for the Microsoft Graph application permission
DeviceManagementManagedDevices.Read.All. This is the read permission for the
managed-device inventory API.
Firezone handles Microsoft authorization through Verify Now. You do not need to create an app registration or paste a client secret into the provider form. Connecting Entra ID for authentication or directory sync does not add an Intune posture provider.
Add the provider
- In Firezone, open Settings → Device Posture → Add posture provider and select Microsoft Intune.
- Enter a Name that identifies the tenant.
- Select Verify Now. In the Microsoft window, sign in as an administrator of the tenant whose devices you want to sync and grant the requested consent.
- Return to Firezone and confirm Verified and the expected Tenant ID. If you selected the wrong tenant, use Reset verification and repeat the consent flow with the correct account.
- Select Create, then use Sync Now from the provider's actions menu.
- Wait for Last Synced to update. Open the test device's Posture tab and confirm its Intune record appears.
Match Intune records to devices
Firezone first uses the certificate-attested Intune device ID, then an attested hardware serial, then a Client-reported serial. Follow the Intune Device Trust guide to provision the device ID in the certificate and require attestation on the Policy.
For personally owned Android work profiles, use the Intune device ID. These devices can restrict hardware serial access. A record existing in Intune is not enough if Firezone has no shared identifier with which to match it.
Use Intune evidence in Policies
After verifying the record, add checks to a Policy. Intune can supply the following simplified checks.
| Check | Intune evidence |
|---|---|
| Compliant | Compliance state is compliant. |
| Disk encryption | Encryption or Windows BitLocker attestation reports enabled. |
| Endpoint protection active | Partner-reported threat state is secured or lowSeverity. |
| Not jailbroken or rooted | The mobile device reports it is not jailbroken or rooted. |
| Recently seen | Intune heard from the device within the last seven days. |
| Secure boot and system integrity | Windows health attestation reports both Secure Boot and code integrity enabled. |
| Corporate owned | Ownership is company. |
| Supervised | The Apple device reports supervision. |
| OS up to date | The reported OS or Android security patch meets Firezone's current release check. |
| Managed by an MDM | A matching Intune record exists. |
Intune compliance depends on your Intune compliance policies. The Compliant check accepts Intune's result; configure the underlying requirements in Intune. Managed by an MDM only requires a matched record and does not imply compliance.
For a provider-specific requirement, the JSON tab can require Intune compliance and a check-in within 24 hours.
{
"and": [
{ "field": "intune.compliance_state", "op": "is", "value": "compliant" },
{ "field": "intune.last_sync_at", "op": "within_last", "value": "PT24H" }
]
}
See the Intune attribute reference for every field and its platform applicability.
Troubleshooting
If verification fails, confirm that the administrator can grant application
consent in the intended tenant. If syncing later reports an authorization error,
check that the Intune license and DeviceManagementManagedDevices.Read.All
consent are still present, then reset verification and grant consent again.
If devices sync but a Client has no Intune record in its Posture tab, compare its attested Intune ID or serial with Intune's inventory. Check that the provider is enabled and that you connected the tenant containing that device.
If a check fails, inspect its actual field values. An unknown compliance state, missing health attestation, or stale check-in does not establish a passing result. Have the device report to Intune, then request Sync Now in Firezone.
Need help? See all support options.