Configuring Microsoft Intune Connector

Configuring Microsoft Intune Connector

I. Generate Client Secret and Apply Permissions

  1. Sign in to Microsoft Azure Portal.
  2. Go to Microsoft Entra ID > App registrations and select New registration.
  3. Register a new application, and securely note the following generated values:
    1. Application (client) ID
    2. Directory (tenant) ID
  4. Generate a Client Secret for authentication.
  5. Configure a Redirect URI (platform: Web) as provided by Lenovo.
  6. Grant the following Microsoft Graph API permissions to the application:
    1. DeviceManagementManagedDevices.Read.All
    2. DeviceManagementApps.ReadWrite.All
    3. Group.ReadWrite.All
    4. Directory.Read.All
      1. These permissions are required to:
        1. Create an Intune group (“CommonAgentGroup”)
        2. Link the UDC provisioning package to the group
        3. Link devices claimed through Intune to LDO
  7. Grant admin consent to apply permissions. 

II. Add and Configure the Microsoft Intune Connector in LDO

  1. In the LDO console, go to Configuration & Settings > Organization Settings > Organization Account > Connectors.
  2. Under Microsoft Intune, click Add Connection.
  3. Enter the following credentials:
    1. Directory ID (Tenant ID)
    2. Application ID (Client ID)
    3. Client Secret
  4. Select Connect to establish the integration.
  5. LDO displays the permissions required for device onboarding. Any missing permissions appear in red. If a permission is missing, return to Microsoft Entra ID and add it before proceeding.
  6. Click Next.
  7. Select the Intune groups to synchronize, or click Select all groups.
  8. Click Sync. 
  9. Click Close.
    After synchronization is complete, the connector status changes to Active.
Notes
Group synchronization creates the group structure within LDO but does not synchronize individual group members.

III. Enroll and Configure Devices in Microsoft Intune

  1. Ensure the Company Portal app is installed on the target Windows devices.
  2. Instruct users to sign in to the Company Portal with their corporate credentials and complete the enrollment process.
  3. Verify that the devices appear as successfully enrolled in the Microsoft Intune Admin Center. Allow up to 30 minutes for the enrollment status to propagate.

IV. Deploy the Lenovo UDC Provisioning Pack via Intune

  1. In the Lenovo Device Orchestration portal, download the UDC provisioning pack (organization-setup.intunewin).
  2. In the Microsoft Intune admin center, add a new Windows app of the Win32 type.
  3. Upload the organization-setup.intunewin file.
  4. Configure the installation settings:
    1. Install command: udc_setup.exe /VERYSILENT /NORESTART
    2. Uninstall command: C:\Windows\System32\drivers\Lenovo\udc\Data\InfBackup\UDCInfInstaller.exe -uninstall
  5. Configure the detection rules and assign the application to the required device groups.

V. Onboard Devices to Lenovo Device Orchestration

  1. In the Lenovo Device Orchestration portal, go to the device onboarding section.
  2. Enter the App ID from the relevant Intune application deployment.
  3. Select the target devices for onboarding.
  4. The device status will initially appear as Pending. After the UDC provisioning pack is successfully installed and registered with the LDO service, the status changes  to Onboarded.
Notes
  1. Synchronization timing: Synchronization between Microsoft Intune and Lenovo Device Orchestration typically completes within 10–30 minutes. Large environments may require additional time.
  2. Pre-claimed devices: Devices that were previously claimed directly in Lenovo Device Orchestration before enrollment in Microsoft Intune might not onboard successfully through this workflow. Use a single onboarding method whenever possible.

    • Related Articles

    • Configuring Entra ID for LDO SSO

      This guide explains how to migrate Lenovo Device Orchestration (LDO) to Microsoft Entra ID. This process involves setting up a new app in Microsoft Entra, collecting necessary configuration data, and updating the authentication settings in LDO. ...

    • Configuring SentinelOne Connector

      This article explains how to configure the SentinelOne connector in Lenovo Device Orchestration (LDO). Once configured, the integration enables ThinkShield Firmware Assurance (TSFA) to send security posture change events to SentinelOne, improving ...

    • Setting Up Organization Accounts

      Accessing Your Account When your organization's portal is created, a single administrative account will be created. The IT Owner (Org Admin) specified to Lenovo at the time of sale will receive a Lenovo Device Orchestration (LDO) e-mail indicating ...

    • Onboarding Windows Devices

      Device Management supports an automated process that simplifies the onboarding of Windows devices. Users can easily download the .zip file package with the necessary files and apply to the devices. Any Lenovo Windows device can be automatically added ...

    • Configuring Google Workspace Integration

      This article explains how to configure Google Workspace for ChromeOS within Lenovo Device Orchestration (LDO). This setup enables LDO to securely connect with your organization’s Google Cloud environment and retrieve ChromeOS device data for ...