TeamDynamix Intune Integration

The Microsoft Intune integration allows TeamDynamix administrators to set up a connection to Intune and automatically sync asset data into TeamDynamix. Once assets are created using this integration, technicians can open those assets in Intune or take other actions on the synced assets, and users can report on data synced from MS Intune.  

This article covers the following topics:

• Setting up the Intune integration
• Syncing assets to TeamDynamix 
• Working with assets from Intune in TDNext 
• Actions on Intune devices

Setting up the Intune integration 

The Intune integration can be configured in the Integrations page of an Asset application or in the global Organization Settings > Integrations page. Follow these steps to set up the integration: 

1. Navigate to the Integrations page in an asset application (TDAdmin > Applications > [Asset Application] > Integrations) or as a global administrator (TDAdmin > Organization Settings > Integrations). 
2. Click +New to create a new integration. 
3. Set the Integration Type to Microsoft Intune (if you're in the asset application, this will be the only option).
4. Choose a Name. 
5. Set the Application (this will be automatically set when configuring the integration from within the Assets/CIs application).
6. Choose whether to Create Assets. If this is checked, the integration will create new asset records based on managed devices. If unchecked, it will add Intune information to existing devices, but will not create any new ones. 
7. Choose an Asset Matching Mode. See the Matching Logic section below for details on the Asset Matching Mode. 
8. Choose a Form and Status for the assets created by Intune. These values will be used when new assets are created, but will not be updated on existing assets. 
9. Choose a setting for Use External Product Model.
   1. When checked, assets will be created using the selected Product Type and will use the Model field in Intune as the Product Model (creating new Product Models in TeamDynamix if there is no match). 
   2. When unchecked, a Default Product Model can be selected. If it is, that product model will be used for assets created by the integration. If omitted, no Product Model will be applied. 
10. Choose a setting for Set Owner or Set User checkboxes. When the asset user in Intune can be matched to a TeamDynamix user they will be set as the Owner or User in TeamDynamix based on these settings. Assets are matched based on the user's email address in TeamDynamix matching Intune. 
11. Set the Azure Tenant ID, Client ID, and Client Secret to connect to Intune.

    1. The asset sync features in the Intune integration uses an app registration with the Application API permission DeviceManagementManagedDevices.Read.All (not as a Delegated permission). 

       1. Note: The Client Secret field requires the client secret value, not it's ID.
    2. The managed action features (added in TeamDynamix version 121.) require the additional permissions DeviceManagementManagedDevices.ReadWrite.All and DeviceManagementManagedDevices.PrivilegedOperations.All. You will need to grant Admin Consent through the application. For organizations setting up the integration for the first time after version 12.1, DeviceManagementManagedDevices.ReadWrite.All includes all the permissions required to import devices in DeviceManagementManagedDevices.Read.All and you do not need to separately grant that permission. 

Syncing assets to TeamDynamix 

Assets are automatically generated and updated by the Intune integration when it is initially configured and kept in sync by a nightly update. Whether the integration creates assets and how it matches assets to Intune devices are controlled by the Create Assets setting and Asset Matching Mode setting respectively. 

Create Assets Flag

This check box determines if the integration is allowed to create new assets in the TeamDynamix Asset Application or only update existing assets. If the check box is checked, the integration will create assets as determined by the Asset Matching Mode. If the check box is not checked, matching will continue to respect the Asset Matching Mode, but assets that would be created will instead be skipped. Assets that are skipped will show up in the Log under the Integration in TDAdmin.

Matching Logic 

The integration matches assets in the TeamDynamix database by looking for a matching value on the following fields:

1. Intune ID - A unique identifier assigned to the asset by Intune, in the form of a UUID. This will change if an asset is removed and then re-added to Intune.
2. Serial Number - The serial number reported to Intune during enrollment. Intune does not control this and there is no guarantee this will be unique, but it typically does not change if an asset is removed and re-added.

The rules depend on the Asset Matching Mode setting chosen. Below is a breakdown for each matching settings option:

Match by Serial Number and Microsoft Intune ID (Default Behavior)

• If the Intune ID matches, the asset will be updated
  • This would be the most common match, when an asset that is in Intune has been previously updated by this integration. 
• If the Serial Number matches and Intune ID is different and Create Assets is checked, a new asset will be created 
  • This would occur when records in Intune are using a custom, repeated serial number.
  • This can also occur when an asset is removed and re-added to Intune, as a new ID is generated.
• If the Serial Number matches and Intune ID is blank, update the asset and set the Intune ID
  • This would occur when the asset was already created in TeamDynamix through another process, and links the existing asset record to the Intune record. 
• If there is no match on Serial Number or Intune ID and Create Assets is checked, create a new asset
  • This would occur when a new asset is added to Intune.  

Match by Serial Number and Set Intune ID

• Strictly matches on Serial Number. If matched, the asset will be updated
  • If the Intune ID is not already set, set it
    • This match typically occurs on your first run with an Intune Integration for an Asset Application that already has assets present
  • If the Intune ID is already set but does not match, update it
• If the Serial Number does not match and Create Assets is checked, a new asset will be created
• If the Serial Number is not present the matching is skipped
  • This can occur whenever an asset does not have a serial number present in Intune, often with virtual machines.
• If there are duplicate Serial Numbers the same asset will be overwritten every sync, making it inconsistent.

Match by Microsoft Intune ID

• Strictly matches on Intune ID. If matched, the asset will be updated
  • This will always override the existing serial number
• If the Intune ID does not match any existing asset and Create Assets is checked, a new asset will be created
• If an asset is removed and then re-added to Intune, it will generate a new Intune ID
• This is often best paired with automation against or public web API to maintain Intune mappings. If mappings are not previously set, the first synchronization would generate an asset in the specified application for every record in Intune.

Working with assets from Intune in TDNext

When viewing an asset from Intune in TDNext, users can view detailed information from Intune in the asset's Discovered Data tab. The Open in Intune button allows the user to open the asset directly in Intune (subject to the user's permissions in Intune). 

The data in the Discovered Data tab is also available in the Assets report source. The following fields are mapped from Intune to TDX. The Intune Field column refers to the field as defined in the Intune managedDevice resource type. 

Intune managed device actions

If you grant the additional permissions described above, the integration will allow technicians in TeamDynamix to take actions on devices in Intune. Because Microsoft does not provide a separate permission that can be granted for each action a user may take on a device, TeamDynamix administrators can control which actions are available to technicians in their environment based on the asset application's security role. To edit the security role, follow these steps: 

1. Navigate to the asset application's security roles (TDAdmin > Applications > [Asset Application] > Users & Roles > Security Roles). 
2.  Open the security role to be edited. 
3. Add appropriate actions from the Microsoft Intune section in the security role.
4. Save. 

The following actions are supported in the Intune integration