Microsoft Intune Integration

Note: This integration requires Cisco XDR Advantage or Cisco XDR Premier licensing tier.

Microsoft Intune is a cloud-based endpoint management solution. It manages user access to organizational resources and simplifies app and device management across your many devices, including mobile devices, desktop computers, and virtual endpoints.

When you configure the Microsoft Intune integration, data about your devices will be available in XDR assets and enriched endpoint data will become available when you investigate incidents.​ A target will also become available in XDR automation for automated workflows.

  1. In the Cisco XDR navigation menu, choose Administration > Integrations.

  2. On the Integrations page, click the Third-Party tab and navigate to the Microsoft Intune integration.

  3. Click the plus sign (+) in the lower-right corner of the card. The Microsoft Intune integration page is displayed.

  4. Expand the Integration Guide area and follow the instructions on how to add the Microsoft Intune integration in Cisco XDR.

You can perform the following tasks after you integrate Microsoft Intune with Cisco XDR:

  • Assets - View device as reported by Microsoft Intune. For more information, including how to filter the view to only the reports from Microsoft Intune, see Devices.

  • Automation:

    • Atomic Actions - The atomic actions for Microsoft Intune can be used as building blocks in custom workflows. These can be found as available Actions in the left menu of the Workflow Editor. See Atomic Actions and Workflows.

    • Workflows - The workflows for Microsoft Intune can be installed from the Automation Exchange. See Workflows and Exchange.

    • Target - The Microsoft Intune target is automatically created for out-of-box and custom workflows. See Targets Created From Integrations.