Configuring Intune Connector and Adding Device Groups

Configuring Intune Connector and Adding Device Groups

I. Generate Client Secret and Apply Permissions

  1. Sign in to Microsoft Azure Portal.
  2. Go to Microsoft Entra ID > App registrations and select New registration.
  3. Register a new application, and securely note the following generated values:
    1. Application (client) ID
    2. Directory (tenant) ID
  4. Generate a Client Secret for authentication.
  5. Configure a Redirect URI (platform: Web) as provided by Lenovo.
  6. Grant the following Microsoft Graph API permissions to the application:
    1. DeviceManagementManagedDevices.Read.All
    2. DeviceManagementApps.ReadWrite.All
    3. Group.Read.All
    4. Directory.Read.All
      These permissions are required to:
      1. Create an Intune group (CommonAgentGroup)
      2. Link the UDC provisioning package to the group
      3. Link devices claimed through Intune to LDO
  7. Grant admin consent to apply permissions. 

II. Add and Configure the Microsoft Intune Connector in LDO

  1. In the LDO console, go to Configuration & Settings > Organization Settings > Organization Account > Connectors.
  2. Under Microsoft Intune, click Add Connection.
  3. Enter the following credentials:
    1. Directory ID (Tenant ID)
    2. Application ID (Client ID)
    3. Client Secret
  4. Click Connect .
  5. LDO displays the permissions required for device onboarding. Missing permissions appear in red. If a permission is missing, return to Microsoft Entra ID and add it before proceeding.
  6. Click Done.

III. Onboard Intune Device Groups through LDO

  1. Go Device Management > Devices.
  2. Select the plus icon   to onboard devices.
  3. Select Microsoft Intune.
  4. Click Next.
  5. Click Download Provisioning Pack to create the UDC agent. 
  6. Follow the instructions to add the App to Intune. For detailed instructions see Deploying Lenovo Device Orchestration Agent in Intune.
  7. Click Next.
  8. Select the device groups you wish to onboard, or check the box next to Group Name to select all.
    Note: you can use the Search box to find the groups.
  9. Click Onboard Selected.
    1. Onboarded groups will appear on the Device Management > Device Groups page. Clicking a group will display a side panel with detailed group information, including the devices included on the group.
    2. Intune Groups are also displayed in Device Management > Devices page.
    3. Groups are synced automatically but you can also sync them manually. For information, go to Creating Device Groups.

Managing Connectors

  1. Click Manage connector.
  2. Update the connector settings as needed or upload a new file.
  3. If applicable, update the Admin email address.
  4. Click Connect.

Disconnecting Microsoft Intune Connector

  1. Click Disconnect.
  2. In the popup, click Disconnect to confirm.
Info
  1. All organization data is removed from Intune.
  2. Groups in Device Groups remain unchanged.
  3. Gorups in Groups & Labels are converted to static groups.
  4. Devices are not deleted.