Configuring Microsoft Intune Connector

Configuring Microsoft Intune Connector

I. Generate Client Secret and Apply Permissions

  1. Sign in to Microsoft Azure Portal.
  2. Go to Microsoft Entra ID > App registrations and select New registration.
  3. Register a new application, and securely note the following generated values:
    1. Application (client) ID
    2. Directory (tenant) ID
  4. Generate a Client Secret for authentication.
  5. Configure a Redirect URI (platform: Web) as provided by Lenovo.
  6. Grant the following Microsoft Graph API permissions to the application:
    1. DeviceManagementManagedDevices.Read.All
    2. DeviceManagementApps.ReadWrite.All
    3. Group.ReadWrite.All
    4. Directory.Read.All
      1. These permissions are required to:
        1. Create an Intune group (“CommonAgentGroup”)
        2. Link the UDC provisioning package to the group
        3. Link devices claimed through Intune to LDO
  7. Grant admin consent to apply permissions. 

II. Add and Configure the Microsoft Intune Connector in LDO

  1. In the LDO console, go to Configuration & Settings > Organization Settings > Organization Account > Connectors.
  2. Under Microsoft Intune, click Add Connection.
  3. Enter the following credentials:
    1. Directory ID (Tenant ID)
    2. Application ID (Client ID)
    3. Client Secret
  4. Select Connect to establish the integration.
  5. LDO displays the permissions required for device onboarding. Any missing permissions appear in red. If a permission is missing, return to Microsoft Entra ID and add it before proceeding.
  6. Click Next.
  7. Select the Intune groups to synchronize, or click Select all groups.
  8. Click Sync. 
  9. Click Close.
    After synchronization is complete, the connector status changes to Active.
Notes
Group synchronization creates the group structure within LDO but does not synchronize individual group members.

III. Enroll and Configure Devices in Microsoft Intune

  1. Ensure the Company Portal app is installed on the target Windows devices.
  2. Instruct users to sign in to the Company Portal with their corporate credentials and complete the enrollment process.
  3. Verify that the devices appear as successfully enrolled in the Microsoft Intune Admin Center. Allow up to 30 minutes for the enrollment status to propagate.

IV. Deploy the Lenovo UDC Provisioning Pack via Intune

  1. In the Lenovo Device Orchestration portal, download the UDC provisioning pack (organization-setup.intunewin).
  2. In the Microsoft Intune admin center, add a new Windows app of the Win32 type.
  3. Upload the organization-setup.intunewin file.
  4. Configure the installation settings:
    1. Install command: udc_setup.exe /VERYSILENT /NORESTART
    2. Uninstall command: C:\Windows\System32\drivers\Lenovo\udc\Data\InfBackup\UDCInfInstaller.exe -uninstall
  5. Configure the detection rules and assign the application to the required device groups.

V. Onboard Devices to Lenovo Device Orchestration

  1. In the Lenovo Device Orchestration portal, go to the device onboarding section.
  2. Enter the App ID from the relevant Intune application deployment.
  3. Select the target devices for onboarding.
  4. The device status will initially appear as Pending. After the UDC provisioning pack is successfully installed and registered with the LDO service, the status changes  to Onboarded.
Notes
  1. Synchronization timing: Synchronization between Microsoft Intune and Lenovo Device Orchestration typically completes within 10–30 minutes. Large environments may require additional time.
  2. Pre-claimed devices: Devices that were previously claimed directly in Lenovo Device Orchestration before enrollment in Microsoft Intune might not onboard successfully through this workflow. Use a single onboarding method whenever possible.