---
title: "Intune Integration with ControlUp for Compliance"
slug: "intune-integration-with-controlup-for-compliance"
updated: 2026-05-06T13:35:05Z
published: 2026-05-06T13:35:05Z
canonical: "support.controlup.com/intune-integration-with-controlup-for-compliance"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.controlup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Intune Integration with ControlUp for Compliance

Beta feature

This integration is currently in beta

Integrating Microsoft Intune with ControlUp for Compliance lets you:

- Patch applications using Intune's application deployment system instead of using the ControlUp for Compliance Agent to deploy application patches. OS patches are not currently supported. This is useful if you want to use only a single tool (Intune) for patching applications.
- Target devices for scanning and remediation using Entra ID device groups. This is useful if you have already organized your devices into Entra ID groups, and you want to use those groups to target devices for ControlUp for Compliance Templates

## How to set up the integration with Intune

There are two ways to set up the integration with Intune:

- [OAuth](/v1/docs/intune-integration-with-secure-dx#method-1-oauth)
- [Application registration](/v1/docs/intune-integration-with-secure-dx#method-2-application-registration)

To set up the integration, your ControlUp account must have the following permissions: **Manage Integrations** (under the "Access Control" permission category)

- At least one permission under the **Secure DX Management > Settings** permission category.

### Method 1 - OAuth

1. In ControlUp, go to **Settings > Integrations > Unified Endpoint Management** and click Microsoft Intune.
2. Under **Authorization method**, select **OAuth 2.0**.
3. Set the **Purpose** to **ControlUp for Compliance**.
4. Enter a **Name** of your choice. Note that you can't see the connection's configuration after you create it, so you should choose an informative name, especially if you have multiple Entra ID tenants.
5. In the **Instance Name** field, enter your Entra ID tenant name. Read [Microsoft's documentation](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name) to learn how to get your tenant name.
6. In the **Admin Email** field, enter the email address of the Entra ID user you want to use to perform the OAuth authentication.
7. Click **Add connection**.
8. Click **Authorize** and sign in using the email account you entered in step 6. You must consent to the requested permissions. See [Required OAuth permissions](/v1/docs/intune-integration-with-controlup-for-compliance#required-oauth-permissions) below for details.
9. Click **Test connection** to test and finalize the connection. **This is a mandatory step**.

#### Required OAuth permissions

**Integration permissions:**

| Permission | Purpose |
| --- | --- |
| `Group.ReadWrite.All` | Creates and deletes the Entra ID group that scopes each deployment |
| `GroupMember.ReadWrite.All` | Adds targeted devices to the group before deployment; removes them during cleanup |
| `Device.ReadWrite.All` | Looks up devices in Entra by Azure Device ID so they can be added as group members |
| `DeviceManagementApps.ReadWrite.All` | Creates the Win32 app, uploads the installer, assigns it to the group, tracks install status, and deletes it when done |
| `DeviceManagementManagedDevices.ReadWrite.All` | Reads Intune device records to match them against Entra directory entries during targeting |

**Standard OAuth permissions**

| Permission | Purpose |
| --- | --- |
| `profile` | Identifies the admin who authorized the integration |
| `openid` | Required by OpenID Connect to issue an identity token |
| `offline_access` | Issues a refresh token so background remediations work without re-authentication |

### Method 2 - Application registration

#### Step 1 - Register an application in Entra ID

1. In Entra ID, go to **App registrations > New registration**.
2. In the **Register an application** form, enter the following details:
  1. Enter a **Name** for the application.
  2. Select the **Supported account types**.
3. Click **Register**.
4. Take note of the following values because you'll need to add them into ControlUp's settings in a later step.
  - Application (client) ID
  - Object ID
  - Directory (tenant) ID  

![Entra Essential Details.png](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Entra%20Essential%20Details%281%29.png)

3rd Party Software

This image is taken from Microsoft and may not reflect the latest changes that may be made to the software over time. However, the settings and values should appear as described.

#### Step 2 - Add permissions to the application

1. In Entra ID, go to **API permissions > Add a permission**.
2. Select **Microsoft Graph**.
3. Select **Application permissions**.
4. Add the following permissions from the Microsoft Graph API:
  - Device.ReadWrite.All
  - DeviceManagementApps.ReadWrite.All
  - DeviceManagementManagedDevices.ReadWrite.All
  - Group.ReadWrite.All
  - GroupMember.ReadWrite.All
  - User.Read
5. After adding the permissions, click **Grant admin consent for Default Directory**.

#### Step 3 - Create a client secret

1. In Entra ID, go to **Certificates & secrets > New client secret**.
2. Enter a name and expiration date for the client secret. If the client secret expires and is not replaced with a new one, then ControlUp can't use the connection.
3. Take note of the client secret **Value** because you'll need to add it to ControlUp's settings. You must copy the value and save it somewhere safe now because you won't be able to view it again.  

![ClientSecretValue.png](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/ClientSecretValue.png)

#### Step 4 - Set up the connection in ControlUp

1. In ControlUp, go to **Settings > Integrations > Unified Endpoint Management** and click Microsoft Intune.
2. Under **Authorization method**, select **Application Registration**.
3. Set the **Purpose** to **ControlUp for Compliance**
4. Enter a **Name** of your choice. Note that can't see the connection's configuration after you create it, so you should choose an informative name, especially if you have multiple Entra ID tenants.
5. Add the following values you got from [Step 1 - Register an application in Entra ID](/v1/docs/intune-integration-with-secure-dx#step-1-register-an-application-in-entra-id).
  - Application (client) ID
  - Object ID
  - Directory (tenant) ID
6. Add the client secret value you got from [Step 3 - Create a client secret](/v1/docs/intune-integration-with-secure-dx#step-3-create-a-client-secret).
7. Click **Add connection**.
8. Locate the connection you added in the list and click **Test Connection** to test and finalize the connection. **This is a mandatory step**.

## Enable the integration in ControlUp

After you set up the integration with Intune using one of the methods above, perform the following steps to enable the integration:

1. Open ControlUp for Compliance and go to the settings page.
2. Select **Integrations**.
3. Under **Microsoft Intune**, click **Enable**
4. Select the Intune connection that you created.

## How to use the integration

### Target devices by Entra ID device groups

When you assign devices to a Template, you can select to assign devices based on **Entra ID device groups**, and then choose which groups to assign. The Template applies to all devices that are in the selected Entra ID device groups AND have the ControlUp for Compliance Agent installed.

![TargetByEntraGroups.png](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/TargetByEntraGroups.png)

### Remediate issues using Intune

When you configure the remediation for a Template, you can set the remediation type to **Integration**. With this option selected, the remediations are performed by Intune. The option to remediate issues using Intune is available when the Template's scanning scope contains issues from only the **Patches** and **Vulnerabilities** categories. ![RemediationTypeIntegration.png](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/RemediationTypeIntegration.png)

You can also select to remediate an issue using Intune when initiating a manual remediation Job.

When ControlUp initiates a remediation using Intune, a temporary application is created in Intune with the name **<name of the application being patched> By ControlUp Secure DX**. The description of the application contains the IDs of all ControlUp Templates and Jobs that have requested the application patch. If more Templates or Jobs request the patch through Intune while the patch deployment in Intune is ongoing, the IDs or those Templates or Jobs are added to the description, instead of creating another temporary application.

![AppName.png](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/AppName.png)

A temporary device group is created with the same name and assigned to the application in Intune. The group contains all devices that ControlUp identified as requiring the application patch. If ControlUp identifies more while the patch deployment in Intune is ongoing, they are added to the device group.

The temporary application and device group in Intune are deleted after all devices in the device group have either been successfully patches or failed to update.

You can track the remediation progress and results from ControlUp. After all of the affected devices have been patched, the temporary application is deleted from Intune.