# How to integrate Microsoft Intune MCP with Hermes

```json
{
  "title": "How to integrate Microsoft Intune MCP with Hermes",
  "toolkit": "Microsoft Intune",
  "toolkit_slug": "microsoft_intune",
  "framework": "Hermes",
  "framework_slug": "hermes-agent",
  "url": "https://composio.dev/toolkits/microsoft_intune/framework/hermes-agent",
  "markdown_url": "https://composio.dev/toolkits/microsoft_intune/framework/hermes-agent.md",
  "updated_at": "2026-11-14T05:32:25.116Z"
}
```

## Introduction

Hermes is a 24/7 autonomous agent that lives on your computer or server — it remembers what it learns and evolves as your usage grows.
This guide explains the easiest and most robust way to connect your Microsoft Intune account to Hermes. You can do this through either Composio Connect CLI or Composio Connect MCP. For personal use we recommend the CLI, but you won't go wrong with MCP either.
For exact tool slugs and parameter tables, see the [tool catalog in the Composio docs](https://docs.composio.dev/toolkits/microsoft_intune).

## Also integrate Microsoft Intune with

- [ChatGPT](https://composio.dev/toolkits/microsoft_intune/framework/chatgpt)
- [Claude Cowork](https://composio.dev/toolkits/microsoft_intune/framework/claude-cowork)
- [Atomic Agent](https://composio.dev/toolkits/microsoft_intune/framework/atomic-agent)

## TL;DR

### What is Composio Connect?
Composio Connect is a consumer offering that lets anyone plug 1,700+ applications directly into their agent harness — including Hermes. It can:
- Search and load tools from relevant toolkits on-demand, reducing context usage.
- Chain multiple tools to accomplish complex workflows via a remote workbench, without excessive back-and-forth with the LLM.
- Manage app authentication end-to-end with zero manual overhead.

## Connect Microsoft Intune to Hermes

### Integrating Microsoft Intune with Hermes
### Using Composio Connect CLI
1. Install the Composio CLI
Run the install script directly, or paste https://composio.dev/hermes into your Hermes chat box to have it installed for you.

```bash
curl -fsSL https://composio.dev/install | bash
```

## What is the Microsoft Intune MCP server, and what's possible with it?

The Microsoft Intune MCP server is an implementation of the Model Context Protocol that connects your AI agent and assistants like Claude, Cursor, etc directly to your Microsoft Intune account. It provides structured and secure access to device management, applications, policies, enrollment, assignments, and report exports, so your agent can configure devices, deploy apps, manage compliance, and collect diagnostic information on your behalf.
- Application deployment and organization: Have your agent create Android line-of-business apps, manage iOS app configurations, organize apps with categories, and assign apps to target groups.
- Device policy and compliance management: Direct your agent to create Android device configurations and compliance policies, then assign them to users, devices, groups, or other supported targets.
- Enrollment and Autopilot administration: Let the agent create enrollment limit configurations, assign enrollment settings, stage Windows Autopilot devices, and associate users with Autopilot devices.
- Device maintenance and diagnostics: Instruct your agent to clean supported Windows devices, collect diagnostic logs, and record malware state information for detected applications.
- Reporting and app content workflows: Have your agent create Intune report export jobs, upload app content through supported content versions, and manage contained app entries for Windows Universal AppX applications.

## Supported Tools

| Tool slug | Name | Description |
|---|---|---|
| `MICROSOFT_INTUNE_ASSIGN_APP` | Assign App | Replace every assignment for the named app. An empty list clears all assignments and requires confirm_clear_all_assignments=true. |
| `MICROSOFT_INTUNE_ASSIGN_APP_CONFIG` | Assign App Config | Replace every assignment for the named app config. An empty list clears all assignments and requires confirm_clear_all_assignments=true. |
| `MICROSOFT_INTUNE_ASSIGN_COMPLIANCE_POLICY` | Assign Compliance Policy | Replace the complete assignment target set for one compliance policy; use assignment CRUD tools to manage a single assignment relationship. Clearing all targets requires `confirm_clear_all_assignments=true`. |
| `MICROSOFT_INTUNE_ASSIGN_DEVICE_CONFIG` | Assign Device Config | Replace all group, user, device, collection, exclusion, or scope-tag assignments for an Intune device configuration. Sending an empty collection removes every assignment and requires `confirm_clear_all_assignments=true`. |
| `MICROSOFT_INTUNE_ASSIGN_ENROLLMENT_CONFIG` | Assign Enrollment Config | Replace the complete assignment set for one device enrollment configuration with the supplied assignment targets. Sending an empty collection removes every assignment and requires `confirm_clear_all_assignments=true`. |
| `MICROSOFT_INTUNE_ASSIGN_USER_TO_DEVICE_AUTOPILOT_DEVICE` | Assign User To Device Autopilot Device | Associate one user, identified by the supplied user names, with one Windows Autopilot device identity; no other device identity is changed. |
| `MICROSOFT_INTUNE_BULK_DELETE_AUTOPILOT_DEVICE_IDENTITIES` | Bulk Delete Autopilot Device Identities | Permanently unregister the Windows Autopilot device identities matching the supplied serial numbers. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_CLEAN_WINDOWS_DEVICE_DETECTED_APP_DEVICE` | Clean Windows Device Detected App Device | Clean a Windows device addressed as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`, removing user-installed Win32 apps and restoring policy-managed apps and settings. Select only while traversing from a detected app; prefer `MICROSOFT_INTUNE_CLEAN_WINDOWS_DEVICE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_CLEAN_WINDOWS_DEVICE_DETECTED_APP_USER_DEVICE` | Clean Windows Device Detected App User Device | Clean a Windows device addressed through its detected-app membership and associated user, removing user-installed Win32 apps and restoring policy-managed apps and settings. Select only while traversing from that app and user; prefer `MICROSOFT_INTUNE_CLEAN_WINDOWS_DEVICE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_CLEAN_WINDOWS_DEVICE_MANAGED_DEVICE` | Clean Windows Device Managed Device | Clean a Windows device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, removing user-installed Win32 apps and restoring policy-managed apps and settings. Prefer this route whenever the device ID is known. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_COMMIT_APPS_CONTENT_VERSIONS_CONTENT_FILE` | Commit Apps Content Versions Content File | Commit an uploaded content file to a specific Intune mobile-app content version using its encryption metadata. |
| `MICROSOFT_INTUNE_CREATE_APP` | Create App | Create an Intune Android line-of-business app record for deploying an uploaded APK package. |
| `MICROSOFT_INTUNE_CREATE_APP_CATEGORY` | Create App Category | Create a tenant-wide Intune app category that can be attached to mobile apps. |
| `MICROSOFT_INTUNE_CREATE_APP_CONFIG` | Create App Config | Create an Intune iOS managed-app configuration that delivers app settings to targeted devices. |
| `MICROSOFT_INTUNE_CREATE_APPS_ASSIGNMENT` | Create Apps Assignment | Create one Intune app deployment assignment with an install intent and target, without replacing sibling assignments. |
| `MICROSOFT_INTUNE_CREATE_APPS_CATEGORIES` | Create Apps Categories | Attach an existing tenant-wide Intune category to a specific mobile app. |
| `MICROSOFT_INTUNE_CREATE_APPS_CONTENT_VERSION` | Create Apps Content Version | Create mobileAppContent through the provider-required microsoft.graph.mobileLobApp cast. This generic-call-surface variant is retained separately from the mobile-LOB and managed-LOB endpoint-fidelity variants. |
| `MICROSOFT_INTUNE_CREATE_APPS_CONTENT_VERSIONS_CONTAINED_APP` | Create Apps Content Versions Contained App | Create a Windows Universal AppX contained-app entry under a specific generic content version; use the committed-contained-app create tool for the app-level committed route. |
| `MICROSOFT_INTUNE_CREATE_COMMITTED_CONTAINED_APP` | Create Apps Windows Universal App X Committed Contained Apps | Create a contained-app entry on a Windows Universal AppX app's committedContainedApps route, independent of a specific content-version route. |
| `MICROSOFT_INTUNE_CREATE_COMPLIANCE_POLICY` | Create Compliance Policy | Create a legacy Android compliance policy with its required scheduled block action embedded in the initial request. |
| `MICROSOFT_INTUNE_CREATE_COMPLIANCE_SETTING_STATE` | Create Compliance Setting State | Create one device-and-user compliance observation under a setting summary, not aggregate setting counts. |
| `MICROSOFT_INTUNE_CREATE_DETECTED_APP_DEVICE` | Create Detected App Device | Create a managed-device record under a specific detected app's managed-devices relationship. Select this route only when the detected app owns the creation context; Microsoft Graph does not serve direct creation on the tenant-wide managed-devices collection. |
| `MICROSOFT_INTUNE_CREATE_DETECTED_APP_DEVICE_MALWARE_STATE` | Create Detected App Device Malware State | Record a Windows malware detection and its severity, execution, remediation, and threat state beneath a device reached from a detected app. Returns the created malware-state record. |
| `MICROSOFT_INTUNE_CREATE_DETECTED_APP_DEVICES_LOG_REQUEST` | Create Detected App Devices Log Request | Create a device log-collection request under the managed device reached from a detected app. Returns the request record and its status; use this route only in that relationship context. |
| `MICROSOFT_INTUNE_CREATE_DETECTED_APP_DEVICES_USER` | Create Detected App Devices User | Submit Microsoft Graph's documented discriminator-only request to create a user relationship beneath the managed device reached from a detected app. The route accepts no caller-specified user properties and does not create a Microsoft Entra user. |
| `MICROSOFT_INTUNE_CREATE_DETECTED_APP_USER_DEVICE` | Create Detected App User Device | Create a managed-device record under a user reached through a detected app and one of its devices. Select this deeply nested route only when continuing that detected-app/user traversal; Microsoft Graph does not serve direct creation on the tenant-wide managed-devices collection. |
| `MICROSOFT_INTUNE_CREATE_DEVICE_CONFIG` | Create Device Config | Create an Android custom device configuration with OMA settings in Intune. |
| `MICROSOFT_INTUNE_CREATE_DEVICE_CONFIGS_ASSIGNMENT` | Create Device Configs Assignment | Create one group, user, device, collection, exclusion, or scope-tag assignment for an Intune device configuration. |
| `MICROSOFT_INTUNE_CREATE_ENROLLMENT_CONFIGS_ASSIGNMENT` | Create Enrollment Configs Assignment | Create one target assignment on a device enrollment configuration for a group, collection, all devices, or all licensed users. |
| `MICROSOFT_INTUNE_CREATE_ENROLLMENT_LIMIT_CONFIG` | Create Enrollment Limit Config | Create one enrollment limit configuration that caps how many devices targeted users may enroll. |
| `MICROSOFT_INTUNE_CREATE_EXPORT_JOB` | Create Export Job | Create a persisted Microsoft Intune report export job. Graph returns the new job with HTTP 201; poll the job until completion before using its temporary download URL. |
| `MICROSOFT_INTUNE_CREATE_IMPORTED_AUTOPILOT_DEVICE` | Create Imported Autopilot Device | Stage one imported Windows Autopilot device identity in Intune from its serial number, hardware identifier, and optional assignment metadata. |
| `MICROSOFT_INTUNE_CREATE_LOG_REQUEST_DETECTED_APP_DEVICE` | Create Log Request Detected App Device | Create a diagnostic log-collection request for a device addressed as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`. Select only while traversing from a detected app; prefer `MICROSOFT_INTUNE_CREATE_LOG_REQUEST_MANAGED_DEVICE` otherwise. |
| `MICROSOFT_INTUNE_CREATE_LOG_REQUEST_DETECTED_APP_USER_DEVICE` | Create Log Request Detected App User Device | Create a diagnostic log-collection request for a device addressed through its detected-app membership and associated user. Select only while traversing from that app and user; prefer `MICROSOFT_INTUNE_CREATE_LOG_REQUEST_MANAGED_DEVICE` otherwise. |
| `MICROSOFT_INTUNE_CREATE_LOG_REQUEST_MANAGED_DEVICE` | Create Log Request Managed Device | Create a diagnostic log-collection request through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this direct route whenever the managed-device ID is known. |
| `MICROSOFT_INTUNE_CREATE_MANAGED_LOB_CONTENT_VERSION` | Create Apps Managed Mobile Lob App Content Version | Create mobileAppContent in a managed mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This managed-LOB endpoint-fidelity variant is retained separately from the generic and mobile-LOB variants. |
| `MICROSOFT_INTUNE_CREATE_MOBILE_LOB_CONTENT_VERSION` | Create Apps Mobile Lob App Content Version | Create mobileAppContent in a mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This mobile-LOB endpoint-fidelity variant is retained separately from the generic and managed-LOB variants. |
| `MICROSOFT_INTUNE_DELETE_APP` | Delete App | Delete an Intune Android line-of-business app record used for APK deployment. This permanently destroys only the app record; it does not imply a device wipe. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_APP_CATEGORY` | Delete App Category | Delete a tenant-wide Intune app category, not merely one app's category relationship. This permanently destroys only the category; it does not imply a device wipe. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_APP_CONFIG` | Delete App Config | Delete an Intune iOS managed-app configuration used to deliver app settings. This permanently destroys only the configuration; it does not imply a device wipe. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_APP_CONFIGS_ASSIGNMENT` | Delete App Configs Assignment | Delete one target assignment from an Intune mobile-app configuration. This permanently destroys only the assignment; it does not imply a device wipe. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_APP_CONFIGS_DEVICE_STATUS` | Delete App Configs Device Status | Delete one device deployment-status record from an Intune mobile-app configuration. This permanently destroys only the status record; it does not imply a device wipe. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_APP_CONFIGS_USER_STATUS` | Delete App Configs User Status | Delete one user deployment-status record from an Intune mobile-app configuration. This permanently destroys only the status record; it does not imply a device wipe. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_APPS_ASSIGNMENT` | Delete Apps Assignment | Delete one install-intent target assignment from an Intune mobile app. This permanently destroys only the assignment; it does not imply a device wipe. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_APPS_CATEGORIES` | Delete Apps Categories | Detach an Intune category from a specific mobile app without deleting the tenant-wide category. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_APPS_CONTENT_VERSION` | Delete Apps Content Version | Delete mobileAppContent through the provider-required microsoft.graph.mobileLobApp cast. This generic-call-surface variant is retained separately from the mobile-LOB and managed-LOB endpoint-fidelity variants. This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_APPS_CONTENT_VERSIONS_CONTAINED_APP` | Delete Apps Content Versions Contained App | Delete a Windows Universal AppX contained-app entry from a specific generic content version, not the app-level committed route. This permanently destroys only that entry; it does not imply a device wipe. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_APPS_CONTENT_VERSIONS_CONTENT_FILE` | Delete Apps Content Versions Content File | Delete an uploaded content file from a specific Intune mobile-app content version. This permanently destroys only the file record; it does not imply a device wipe. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_AUTOPILOT_DEVICE` | Delete Autopilot Device | Permanently unregister one Windows Autopilot device identity without wiping the physical device. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_COMMITTED_CONTAINED_APP` | Delete Apps Windows Universal App X Committed Contained Apps | Delete a contained-app entry from a Windows Universal AppX app's committedContainedApps route, not a specific content version. This permanently destroys only that entry; it does not imply a device wipe. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_COMPLIANCE_POLICY` | Delete Compliance Policy | Delete one legacy Android compliance policy and its device requirements. This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_COMPLIANCE_SETTING_STATE` | Delete Compliance Setting State | Delete one device-and-user compliance observation under a setting summary. This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_COMPLIANCE_SETTING_SUMMARY` | Delete Compliance Setting Summary | Delete one setting-and-platform compliance count summary. This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_DETECTED_APP` | Delete Detected App | Delete a detected application record. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_DETECTED_APP_DEVICE` | Delete Detected App Device | Delete a device addressed as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`; this removes its Intune record and can trigger Retire or Wipe. Select only while traversing from a detected app; prefer `MICROSOFT_INTUNE_DELETE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_DETECTED_APP_DEVICE_MALWARE_STATE` | Delete Detected App Device Malware State | Deletes a windowsDeviceMalwareState. This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_DETECTED_APP_DEVICES_LOG_REQUEST` | Delete Detected App Devices Log Request | Deletes a deviceLogCollectionResponse. This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_DETECTED_APP_DEVICES_USER` | Delete Detected App Devices User | Remove the user relationship record under the specified detected-app managed-device route. This does not delete the user's Microsoft Entra account or wipe the device. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_DETECTED_APP_USER_DEVICE` | Delete Detected App User Device | Delete a device addressed through its detected-app membership and associated user; this removes its Intune record and can trigger Retire or Wipe. Select only while traversing from that app and user; prefer `MICROSOFT_INTUNE_DELETE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_DEVICE_CONFIG` | Delete Device Config | Permanently delete an Android custom device configuration from Intune; this does not wipe devices. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_DEVICE_CONFIGS_ASSIGNMENT` | Delete Device Configs Assignment | Permanently delete one assignment from an Intune device configuration; this does not delete or wipe devices. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_ENROLLMENT_CONFIGS_ASSIGNMENT` | Delete Enrollment Configs Assignment | Permanently remove one target assignment from a device enrollment configuration without deleting the configuration or wiping devices. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_ENROLLMENT_LIMIT_CONFIG` | Delete Enrollment Limit Config | Permanently delete one enrollment limit configuration without wiping or unenrolling any device. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_EXPORT_JOB` | Delete Export Job | Permanently delete one Intune report export-job resource selected by ID; this does not delete or wipe devices. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_IMPORTED_AUTOPILOT_DEVICE` | Delete Imported Autopilot Device | Permanently delete one staged imported Windows Autopilot device identity without wiping the physical device. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_MANAGED_DEVICE` | Delete Managed Device | Delete a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Immediately removes its Intune record and can trigger a platform-dependent Retire or Wipe command. Prefer this direct route whenever the device ID is known. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_MANAGED_LOB_CONTENT_VERSION` | Delete Apps Managed Mobile Lob App Content Version | Delete mobileAppContent in a managed mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This managed-LOB endpoint-fidelity variant is retained separately from the generic and mobile-LOB variants. This destroys only this content version and requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_MOBILE_LOB_CONTENT_VERSION` | Delete Apps Mobile Lob App Content Version | Delete mobileAppContent in a mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This mobile-LOB endpoint-fidelity variant is retained separately from the generic and managed-LOB variants. This destroys only this content version and requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_SHARED_APPLE_USER_DETECTED_APP_DEVICE` | Delete Shared Apple User Detected App Device | Delete a user and that user's data from a shared Apple device addressed as a detected app's managed-device member. Select only while traversing from that detected app; prefer `MICROSOFT_INTUNE_DELETE_SHARED_APPLE_USER_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_SHARED_APPLE_USER_DETECTED_APP_USER_DEVICE` | Delete Shared Apple User Detected App User Device | Delete a user and that user's data from a shared Apple device addressed through a detected app and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_DELETE_SHARED_APPLE_USER_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DELETE_SHARED_APPLE_USER_MANAGED_DEVICE` | Delete Shared Apple User Managed Device | Delete a user and that user's data from a shared Apple device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the device ID is known. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DISABLE_LOST_MODE_DETECTED_APP_DEVICE` | Disable Lost Mode Detected App Device | Disable Lost Mode for a device addressed as a detected app's managed-device member, removing the recovery lock-screen details. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_DISABLE_LOST_MODE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DISABLE_LOST_MODE_DETECTED_APP_USER_DEVICE` | Disable Lost Mode Detected App User Device | Disable Lost Mode for a device addressed through its detected-app membership and associated user, removing the recovery lock-screen details. Select only while traversing that context; prefer `MICROSOFT_INTUNE_DISABLE_LOST_MODE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_DISABLE_LOST_MODE_MANAGED_DEVICE` | Disable Lost Mode Managed Device | Disable Lost Mode through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, removing the recovery lock-screen message and contact information. Prefer this route whenever the device ID is known. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_ENABLE_APP_ARCHITECTURES` | Enable App Architectures | Enable applicable processor architectures for the named Win32 app. |
| `MICROSOFT_INTUNE_GET_APP` | Get App | Get one Intune Android line-of-business app and its deployment metadata by app ID. |
| `MICROSOFT_INTUNE_GET_APP_CATEGORY` | Get App Category | Get one tenant-wide Intune app category; use GET_APPS_CATEGORIES for a category through a specific app's categories route. |
| `MICROSOFT_INTUNE_GET_APP_CONFIG` | Get App Config | Get one Intune iOS managed-app configuration and its delivered settings by configuration ID. |
| `MICROSOFT_INTUNE_GET_APP_CONFIGS_ASSIGNMENT` | Get App Configs Assignment | Get one target assignment for a specific Intune mobile-app configuration. |
| `MICROSOFT_INTUNE_GET_APP_CONFIGS_DEVICE_STATUS` | Get App Configs Device Status | Get one device's deployment status for a specific Intune mobile-app configuration. |
| `MICROSOFT_INTUNE_GET_APP_CONFIGS_DEVICE_STATUS_SUMMARY` | Get App Configs Device Status Summary | Get aggregate per-device deployment outcome counts for a specific Intune mobile-app configuration. |
| `MICROSOFT_INTUNE_GET_APP_CONFIGS_USER_STATUS` | Get App Configs User Status | Get one user's deployment status for a specific Intune mobile-app configuration. |
| `MICROSOFT_INTUNE_GET_APP_CONFIGS_USER_STATUS_SUMMARY` | Get App Configs User Status Summary | Get aggregate per-user deployment outcome counts for a specific Intune mobile-app configuration. |
| `MICROSOFT_INTUNE_GET_APPS_ASSIGNMENT` | Get Apps Assignment | Get one Intune mobile-app assignment, including its install intent, target, and settings. |
| `MICROSOFT_INTUNE_GET_APPS_CATEGORIES` | Get Apps Categories | Get one category through a specific mobile app's categories route; use GET_APP_CATEGORY for the tenant-wide category route. |
| `MICROSOFT_INTUNE_GET_APPS_CONTENT_VERSION` | Get Apps Content Version | Read mobileAppContent through the provider-required microsoft.graph.mobileLobApp cast. This generic-call-surface variant is retained separately from the mobile-LOB and managed-LOB endpoint-fidelity variants. |
| `MICROSOFT_INTUNE_GET_APPS_CONTENT_VERSIONS_CONTAINED_APP` | Get Apps Content Versions Contained App | Get one Windows Universal AppX contained app from a specific generic content version; use the committed-contained-app get tool for the app-level committed route. |
| `MICROSOFT_INTUNE_GET_AUTOPILOT_DEVICE` | Get Autopilot Device | Retrieve one Windows Autopilot device identity, including its hardware, enrollment, and assigned-user properties. |
| `MICROSOFT_INTUNE_GET_CACHED_REPORT` | Get Cached Report | Query cached Intune report data by ID, with optional column selection, grouping, ordering, search, and paging. |
| `MICROSOFT_INTUNE_GET_COMMITTED_CONTAINED_APP` | Get Apps Windows Universal App X Committed Contained Apps | Get one contained app from a Windows Universal AppX app's committedContainedApps route; use the content-version contained-app get tool for a specific version. |
| `MICROSOFT_INTUNE_GET_COMPLIANCE_DEVICE_SUMMARY` | Get Compliance Device Summary | Get tenant-wide device counts by compliance-policy state; use a policy device status overview for one policy. |
| `MICROSOFT_INTUNE_GET_COMPLIANCE_POLICIES_DEVICE_STATUS_OVERVIEW` | Get Compliance Policies Device Status Overview | Get aggregate compliant, noncompliant, error, and conflict device counts for one policy; use device statuses for individual records. |
| `MICROSOFT_INTUNE_GET_COMPLIANCE_POLICIES_USER_STATUS_OVERVIEW` | Get Compliance Policies User Status Overview | Get aggregate compliant, noncompliant, error, and conflict user counts for one policy; use user statuses for individual rollups. |
| `MICROSOFT_INTUNE_GET_COMPLIANCE_POLICY` | Get Compliance Policy | Get one legacy Android compliance policy and its device requirement settings; use LIST_COMPLIANCE_POLICIES to find its ID. |
| `MICROSOFT_INTUNE_GET_COMPLIANCE_POLICY_NON_COMPLIANCE_REPORT` | Get Compliance Policy Non Compliance Report | Query noncompliance details organized by Intune compliance policy; use the summary sibling for aggregated policy results. |
| `MICROSOFT_INTUNE_GET_COMPLIANCE_POLICY_NONCOMPLIANCE_SUMMARY` | Get Compliance Policy Non Compliance Summary Report | Query summarized noncompliance results organized by Intune compliance policy; use the detail sibling for non-summary results. |
| `MICROSOFT_INTUNE_GET_COMPLIANCE_SETTING_NON_COMPLIANCE_REPORT` | Get Compliance Setting Non Compliance Report | Query noncompliance results organized by compliance setting rather than by compliance policy. |
| `MICROSOFT_INTUNE_GET_COMPLIANCE_SETTING_STATE` | Get Compliance Setting State | Get one device-and-user compliance observation under a setting summary; use LIST_COMPLIANCE_SETTING_STATES to find its ID. |
| `MICROSOFT_INTUNE_GET_COMPLIANCE_SETTING_SUMMARY` | Get Compliance Setting Summary | Get one setting-and-platform compliance count summary; use LIST_COMPLIANCE_SETTING_SUMMARIES to find its ID. |
| `MICROSOFT_INTUNE_GET_CONFIGURATION_POLICY_NON_COMPLIANCE_REPORT` | Get Configuration Policy Non Compliance Report | Query noncompliance details organized by Intune configuration policy; use the summary sibling for aggregated policy results. |
| `MICROSOFT_INTUNE_GET_CONFIGURATION_POLICY_NONCOMPLIANCE_SUMMARY` | Get Configuration Policy Non Compliance Summary Report | Query summarized noncompliance results organized by Intune configuration policy; use the detail sibling for non-summary results. |
| `MICROSOFT_INTUNE_GET_CONFIGURATION_SETTING_NON_COMPLIANCE_REPORT` | Get Configuration Setting Non Compliance Report | Query noncompliance results organized by configuration setting rather than by configuration policy. |
| `MICROSOFT_INTUNE_GET_DETECTED_APP` | Get Detected App | Retrieve one Intune detected-app inventory record by ID, including its platform, publisher, version, size, and device-count metadata. Use its ID to traverse the app's managed-device relationships. |
| `MICROSOFT_INTUNE_GET_DETECTED_APP_DEVICE` | Get Detected App Device | Get one device as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`, returning exactly id, deviceName, operatingSystem, osVersion, complianceState, managementState, and lastSyncDateTime. Select only while traversing from a detected app; prefer `MICROSOFT_INTUNE_GET_MANAGED_DEVICE` otherwise. activationLockBypassCode and remoteAssistanceSessionUrl are omitted. |
| `MICROSOFT_INTUNE_GET_DETECTED_APP_DEVICE_MALWARE_STATE` | Get Detected App Device Malware State | Retrieve one malware-state record under a detected app's managed device, including threat identity, severity, execution state, remediation state, detection count, and timestamps. |
| `MICROSOFT_INTUNE_GET_DETECTED_APP_DEVICES_DEVICE_CATEGORY` | Get Detected App Devices Device Category | Retrieve the category assigned to a managed device reached through a detected app, including the category ID and display metadata. Use only when preserving that detected-app relationship context. |
| `MICROSOFT_INTUNE_GET_DETECTED_APP_DEVICES_LOG_REQUEST` | Get Detected App Devices Log Request | Retrieve one device log-collection request reached through a detected app and managed device, including status, timestamps, initiator, expiration, and log size. Use it to monitor a known request ID. |
| `MICROSOFT_INTUNE_GET_DETECTED_APP_DEVICES_USER` | Get Detected App Devices User | Retrieve one user relationship attached to a managed device reached through a detected app. Use this route only when the detected-app, device, and user IDs define the current traversal context. |
| `MICROSOFT_INTUNE_GET_DETECTED_APP_DEVICES_WINDOWS_PROTECTION` | Get Detected App Devices Windows Protection | Retrieve Windows protection health for a managed device reached through a detected app, including malware protection, scan, signature, reboot, engine, and tamper-protection status. |
| `MICROSOFT_INTUNE_GET_DETECTED_APP_USER_DEVICE` | Get Detected App User Device | Get one device through its detected-app membership and associated user, returning exactly id, deviceName, operatingSystem, osVersion, complianceState, managementState, and lastSyncDateTime. Select only while traversing that context; prefer `MICROSOFT_INTUNE_GET_MANAGED_DEVICE` otherwise. activationLockBypassCode and remoteAssistanceSessionUrl are omitted. |
| `MICROSOFT_INTUNE_GET_DEVICE_CONFIG` | Get Device Config | Get one Android custom device configuration and its OMA settings by ID. |
| `MICROSOFT_INTUNE_GET_DEVICE_CONFIGS_DEVICE_STATUS_OVERVIEW` | Get Device Configs Device Status Overview | Get aggregate pending, successful, failed, and not-applicable device counts for an Intune device configuration. |
| `MICROSOFT_INTUNE_GET_DEVICE_CONFIGS_USER_STATUS_OVERVIEW` | Get Device Configs User Status Overview | Get aggregate pending, successful, failed, and not-applicable user counts for an Intune device configuration. |
| `MICROSOFT_INTUNE_GET_DEVICE_CONFIGURATION_DEVICE_ACTIVITY` | Get Device Configuration Device Activity | Retrieve the Intune device configuration activity report for device-scoped activity, returned as report content. Select this when activity must be viewed by device; use `MICROSOFT_INTUNE_GET_DEVICE_CONFIGURATION_USER_ACTIVITY` for user-scoped activity. |
| `MICROSOFT_INTUNE_GET_DEVICE_CONFIGURATION_STATE_SUMMARY` | Get Device Configuration State Summary | Get tenant-wide device counts by deployment state across Intune device configurations. |
| `MICROSOFT_INTUNE_GET_DEVICE_CONFIGURATION_USER_ACTIVITY` | Get Device Configuration User Activity | Retrieve the Intune device configuration activity report for user-scoped activity, returned as report content. Select this when activity must be viewed by user; use `MICROSOFT_INTUNE_GET_DEVICE_CONFIGURATION_DEVICE_ACTIVITY` for device-scoped activity. |
| `MICROSOFT_INTUNE_GET_DEVICE_MANAGEMENT_INTENT_SETTINGS_REPORT` | Get Device Management Intent Settings Report | Query settings associated with Intune device-management intents; use the contributing-profiles sibling to identify profiles per setting. |
| `MICROSOFT_INTUNE_GET_DEVICE_MANAGEMENT_REPORTS` | Get Device Management Reports | Retrieve only the tenant's Microsoft Graph reports-root container metadata, such as its root ID and OData type. Use this to inspect the reports container itself; use a specialized report action when report rows, summaries, filters, or export jobs are needed. |
| `MICROSOFT_INTUNE_GET_DEVICE_NON_COMPLIANCE_REPORT` | Get Device Non Compliance Report | Query Intune noncompliance results organized by device rather than by policy or setting. |
| `MICROSOFT_INTUNE_GET_DEVICE_POLICIES_COMPLIANCE_REPORT` | Get Device Policies Compliance Report | Query device compliance status organized by policy; use the policy-settings sibling for setting-level status. This operation is available only on Microsoft Graph beta and may change before general availability. |
| `MICROSOFT_INTUNE_GET_DEVICE_POLICY_SETTINGS_COMPLIANCE_REPORT` | Get Device Policy Settings Compliance Report | Query device compliance status organized by policy setting; use the policies sibling for policy-level status. This operation is available only on Microsoft Graph beta and may change before general availability. |
| `MICROSOFT_INTUNE_GET_DEVICES_STATUS_BY_SETTING_REPORT` | Get Devices Status By Setting Report | Query device compliance status organized by setting without selecting a specific compliance-policy hierarchy. This operation is available only on Microsoft Graph beta and may change before general availability. |
| `MICROSOFT_INTUNE_GET_DEVICE_STATUS_BY_COMPLIANCE_POLICY_REPORT` | Get Device Status By Compliance Policy Report | Query detailed device status organized by compliance policy; use the policy summary sibling for summarized status. This operation is available only on Microsoft Graph beta and may change before general availability. |
| `MICROSOFT_INTUNE_GET_DEVICES_WITHOUT_COMPLIANCE_POLICY_REPORT` | Get Devices Without Compliance Policy Report | Query devices that have no compliance policy, for identifying gaps in policy coverage. |
| `MICROSOFT_INTUNE_GET_ENROLLMENT_CONFIG` | Get Enrollment Config | Retrieve one device enrollment configuration of any subtype by its Microsoft Graph ID. |
| `MICROSOFT_INTUNE_GET_EXPORT_JOB` | Get Export Job | Retrieve one Intune report export job by ID to inspect its current properties and relationships. |
| `MICROSOFT_INTUNE_GET_HISTORICAL_REPORT` | Get Historical Report | Query the named Intune historical report with optional projection, grouping, ordering, search, paging, and filtering. |
| `MICROSOFT_INTUNE_GET_IMPORTED_AUTOPILOT_DEVICE` | Get Imported Autopilot Device | Retrieve one staged imported Windows Autopilot device identity, including its hardware identifier, assignment, and import state. |
| `MICROSOFT_INTUNE_GET_INTENT_SETTING_CONTRIBUTING_PROFILES` | Get Device Management Intent Per Setting Contributing Profiles | Query the Intune profiles contributing to each device-management intent setting; use the intent-settings sibling for settings rather than profiles. |
| `MICROSOFT_INTUNE_GET_MANAGED_DEVICE` | Get Managed Device | Get one managed device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, returning exactly id, deviceName, operatingSystem, osVersion, complianceState, managementState, and lastSyncDateTime. Prefer this route whenever the device ID is known. activationLockBypassCode and remoteAssistanceSessionUrl are omitted. |
| `MICROSOFT_INTUNE_GET_MANAGED_DEVICE_ENROLLMENT_FAILURE_DETAILS` | Get Managed Device Enrollment Failure Details | Return detailed managed-device enrollment failures, with optional row offset, limit, filter, and continuation token. |
| `MICROSOFT_INTUNE_GET_MANAGED_DEVICE_ENROLLMENT_TOP_FAILURES` | Get Managed Device Enrollment Top Failures | Return the most frequent managed-device enrollment failures for the optional reporting period. |
| `MICROSOFT_INTUNE_GET_MANAGED_DEVICE_OVERVIEW` | Get Managed Device Overview | Retrieve the tenant-wide Intune managed-device overview: enrollment totals plus operating-system and Exchange access-state distributions. Use this for fleet summary counts, not individual devices. |
| `MICROSOFT_INTUNE_GET_MANAGED_LOB_CONTENT_VERSION` | Get Apps Managed Mobile Lob App Content Version | Read mobileAppContent in a managed mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This managed-LOB endpoint-fidelity variant is retained separately from the generic and mobile-LOB variants. |
| `MICROSOFT_INTUNE_GET_MOBILE_LOB_CONTENT_VERSION` | Get Apps Mobile Lob App Content Version | Read mobileAppContent in a mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This mobile-LOB endpoint-fidelity variant is retained separately from the generic and managed-LOB variants. |
| `MICROSOFT_INTUNE_GET_NONCOMPLIANT_DEVICES_AND_SETTINGS_REPORT` | Get Noncompliant Devices And Settings Report | Query noncompliance results across both device and setting dimensions in one report. |
| `MICROSOFT_INTUNE_GET_POLICY_DEVICE_STATUS_SUMMARY` | Get Device Status Summary By Compliance Policy Report | Query summarized device status organized by compliance policy; use the policy detail sibling for detailed status. This operation is available only on Microsoft Graph beta and may change before general availability. |
| `MICROSOFT_INTUNE_GET_POLICY_NON_COMPLIANCE_METADATA` | Get Policy Non Compliance Metadata | Query metadata for Intune policy noncompliance reporting; use report siblings when row or summary data is needed. |
| `MICROSOFT_INTUNE_GET_POLICY_NON_COMPLIANCE_REPORT` | Get Policy Non Compliance Report | Query policy noncompliance details; use the policy summary sibling for aggregated results or metadata sibling for report metadata. |
| `MICROSOFT_INTUNE_GET_POLICY_NON_COMPLIANCE_SUMMARY_REPORT` | Get Policy Non Compliance Summary Report | Query summarized policy noncompliance results; use the policy detail sibling for non-summary results. |
| `MICROSOFT_INTUNE_GET_POLICY_PLATFORM_DEVICE_STATUS` | Get Devices Status By Policy Platform Compliance Report | Query device compliance status organized by both policy and platform; use policy-only siblings when platform is not a needed dimension. This operation is available only on Microsoft Graph beta and may change before general availability. |
| `MICROSOFT_INTUNE_GET_POLICY_SETTING_DEVICE_STATUS` | Get Device Status By Compliance Policy Setting Report | Query detailed device status organized by compliance-policy setting; use the setting summary sibling for summarized status. This operation is available only on Microsoft Graph beta and may change before general availability. |
| `MICROSOFT_INTUNE_GET_POLICY_SETTING_DEVICE_STATUS_SUMMARY` | Get Device Status Summary By Compliance Policy Settings Report | Query summarized device status organized by compliance-policy setting; use the setting detail sibling for detailed status. This operation is available only on Microsoft Graph beta and may change before general availability. |
| `MICROSOFT_INTUNE_GET_REPORT_FILTERS` | Get Report Filters | Query filter metadata for an Intune report before constructing a filtered report request. |
| `MICROSOFT_INTUNE_GET_SETTING_NON_COMPLIANCE_REPORT` | Get Setting Non Compliance Report | Query setting-level noncompliance results when no compliance- or configuration-specific setting family is required. |
| `MICROSOFT_INTUNE_IMPORT_AUTOPILOT_DEVICE_IDENTITIES` | Import Autopilot Device Identities | Submit the supplied Windows Autopilot device identities together for import processing in Intune. |
| `MICROSOFT_INTUNE_LIST_APP_CATEGORIES` | List App Categories | List tenant-wide Intune app categories available for organizing mobile apps. |
| `MICROSOFT_INTUNE_LIST_APP_CONFIGS` | List App Configs | List Intune iOS managed-app configurations that deliver settings to targeted apps and devices. |
| `MICROSOFT_INTUNE_LIST_APP_CONFIGS_ASSIGNMENTS` | List App Configs Assignments | List the group or device targets assigned to a specific Intune mobile-app configuration. |
| `MICROSOFT_INTUNE_LIST_APP_CONFIGS_DEVICE_STATUSES` | List App Configs Device Statuses | List per-device deployment statuses for a specific Intune mobile-app configuration. |
| `MICROSOFT_INTUNE_LIST_APP_CONFIGS_USER_STATUSES` | List App Configs User Statuses | List per-user deployment statuses for a specific Intune mobile-app configuration. |
| `MICROSOFT_INTUNE_LIST_APP_RELATIONSHIPS` | List App Relationships | List dependency and supersedence relationships between Intune mobile apps. |
| `MICROSOFT_INTUNE_LIST_APPS` | List Apps | List Intune Android line-of-business apps used to deploy uploaded APK packages. |
| `MICROSOFT_INTUNE_LIST_APPS_ASSIGNMENTS` | List Apps Assignments | List install-intent target assignments for a specific Intune mobile app. |
| `MICROSOFT_INTUNE_LIST_APPS_CATEGORIES` | List Apps Categories | List categories attached to a specific Intune mobile app; use LIST_APP_CATEGORIES for the tenant-wide category collection. |
| `MICROSOFT_INTUNE_LIST_APPS_CONTENT_VERSIONS` | List Apps Content Versions | List mobileAppContent versions through the provider-required microsoft.graph.mobileLobApp cast. This is the generic-call-surface variant; do not use an uncast generic route unless Microsoft Graph requires it, and use the separate managedMobileLobApp subtype action only for that app context. |
| `MICROSOFT_INTUNE_LIST_APPS_CONTENT_VERSIONS_CONTAINED_APPS` | List Apps Content Versions Contained Apps | List Windows Universal AppX contained apps under a specific generic content version; use the committed-contained-app list tool for the app-level committed route. |
| `MICROSOFT_INTUNE_LIST_AUTOPILOT_DEVICES` | List Autopilot Devices | List Windows Autopilot device identities one page at a time, including their hardware, enrollment, and assigned-user properties. |
| `MICROSOFT_INTUNE_LIST_COMMITTED_CONTAINED_APPS` | List Apps Windows Universal App X Committed Contained Apps | List contained apps on a Windows Universal AppX app's committedContainedApps route; use the content-version contained-app list tool for a specific version. |
| `MICROSOFT_INTUNE_LIST_COMPLIANCE_POLICIES` | List Compliance Policies | List legacy Android compliance policies that define device security and password requirements. |
| `MICROSOFT_INTUNE_LIST_COMPLIANCE_POLICIES_ASSIGNMENTS` | List Compliance Policies Assignments | List individual target assignment relationships under one compliance policy; use ASSIGN_COMPLIANCE_POLICY to replace the complete target set. |
| `MICROSOFT_INTUNE_LIST_COMPLIANCE_POLICIES_DEVICE_SETTING_SUMMARIES` | List Compliance Policies Device Setting Summaries | List per-setting device-count rollups under one compliance policy, distinct from individual device statuses. |
| `MICROSOFT_INTUNE_LIST_COMPLIANCE_POLICIES_DEVICE_STATUSES` | List Compliance Policies Device Statuses | List individual device evaluation statuses under one compliance policy; use the device status overview for aggregate counts. |
| `MICROSOFT_INTUNE_LIST_COMPLIANCE_POLICIES_USER_STATUSES` | List Compliance Policies User Statuses | List individual user compliance rollups under one policy; use the user status overview for aggregate counts. |
| `MICROSOFT_INTUNE_LIST_COMPLIANCE_SETTING_STATES` | List Compliance Setting States | List individual device-and-user compliance observations under one setting summary, not aggregate setting counts. |
| `MICROSOFT_INTUNE_LIST_COMPLIANCE_SETTING_SUMMARIES` | List Compliance Setting Summaries | List setting-and-platform summaries of device compliance counts; use compliance setting states for individual device and user observations. |
| `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICE_MALWARE_STATES` | List Detected App Device Malware States | List paginated malware-state records beneath a detected app's managed device, including threat severity, execution and remediation states, detection counts, and timestamps. |
| `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` | List Detected App Devices | List managed devices associated with the named detected app. The sensitive fields activationLockBypassCode and remoteAssistanceSessionUrl are omitted from every returned record. Use only when intentionally traversing the detected-app relationship and its ID is available; for the ordinary device collection, use `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. |
| `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_LOG_REQUESTS` | List Detected App Devices Log Requests | List paginated log-collection requests for a managed device reached through a detected app, returning request statuses, timestamps, initiators, expiration, and sizes for monitoring or ID lookup. |
| `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` | List Detected App Devices Users | List paginated user relationships for a managed device reached through a detected app. Use the returned user IDs to continue the detected-app/device/user traversal; this does not list all tenant users. |
| `MICROSOFT_INTUNE_LIST_DETECTED_APPS` | List Detected Apps | List applications detected on managed devices in Microsoft Intune. |
| `MICROSOFT_INTUNE_LIST_DETECTED_APP_USER_DEVICES` | List Detected App User Devices | List managed devices through the named detected-app and user relationships. The sensitive fields activationLockBypassCode and remoteAssistanceSessionUrl are omitted from every returned record. Use only when intentionally traversing those relationships and all IDs are available; for the ordinary device collection, use `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. |
| `MICROSOFT_INTUNE_LIST_DEVICE_CONFIGS` | List Device Configs | List all Intune device configurations across configuration subtypes. Inspect each item's `@odata.type` before passing its ID to a subtype-specific action. |
| `MICROSOFT_INTUNE_LIST_DEVICE_CONFIGS_ASSIGNMENTS` | List Device Configs Assignments | List the group, user, device, collection, exclusion, and scope-tag assignments for an Intune device configuration. |
| `MICROSOFT_INTUNE_LIST_DEVICE_CONFIGS_DEVICE_SETTING_SUMMARIES` | List Device Configs Device Setting Summaries | List per-setting deployment-state counts for an Intune device configuration. |
| `MICROSOFT_INTUNE_LIST_DEVICE_CONFIGS_USER_STATUSES` | List Device Configs User Statuses | List per-user deployment statuses for an Intune device configuration. |
| `MICROSOFT_INTUNE_LIST_ENROLLMENT_CONFIGS` | List Enrollment Configs | List device enrollment configurations of every subtype one page at a time, including limit, enrollment-status-page, Windows Hello, and platform-restriction configurations. |
| `MICROSOFT_INTUNE_LIST_ENROLLMENT_CONFIGS_ASSIGNMENTS` | List Enrollment Configs Assignments | List one device enrollment configuration's target assignments one page at a time. |
| `MICROSOFT_INTUNE_LIST_EXPORT_JOBS` | List Export Jobs | List Intune report export jobs so an agent can select a job to inspect, update, or delete. |
| `MICROSOFT_INTUNE_LIST_IMPORTED_AUTOPILOT_DEVICES` | List Imported Autopilot Devices | List staged imported Windows Autopilot device identities one page at a time, including each identity's import state. |
| `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES` | List Managed Devices | List managed-device records. The sensitive fields activationLockBypassCode and remoteAssistanceSessionUrl are omitted from every returned record. |
| `MICROSOFT_INTUNE_LIST_MANAGED_LOB_CONTENT_VERSIONS` | List Apps Managed Mobile Lob App Content Versions | List mobileAppContent through the documented microsoft.graph.managedMobileLobApp cast in a managed mobile line-of-business app context. Use only when Microsoft Graph requires that subtype cast; otherwise use the generic content-version action. |
| `MICROSOFT_INTUNE_LIST_MOBILE_LOB_CONTENT_VERSIONS` | List Apps Mobile Lob App Content Versions | List mobileAppContent through the concrete microsoft.graph.androidLobApp cast in a mobile line-of-business app context. Use only when Microsoft Graph requires that subtype cast; otherwise use the generic content-version action. |
| `MICROSOFT_INTUNE_LOCATE_DEVICE_DETECTED_APP_DEVICE` | Locate Device Detected App Device | Asynchronously request location for a device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_LOCATE_DEVICE_MANAGED_DEVICE` otherwise. An empty response only acknowledges the request; observe the result with `MICROSOFT_INTUNE_GET_MANAGED_DEVICE`. |
| `MICROSOFT_INTUNE_LOCATE_DEVICE_DETECTED_APP_USER_DEVICE` | Locate Device Detected App User Device | Asynchronously request location for a device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_LOCATE_DEVICE_MANAGED_DEVICE` otherwise. An empty response only acknowledges the request; observe the result with `MICROSOFT_INTUNE_GET_MANAGED_DEVICE`. |
| `MICROSOFT_INTUNE_LOCATE_DEVICE_MANAGED_DEVICE` | Locate Device Managed Device | Asynchronously request device location through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the device ID is known. An empty response only acknowledges the request; observe the result with `MICROSOFT_INTUNE_GET_MANAGED_DEVICE`. |
| `MICROSOFT_INTUNE_LOGOUT_SHARED_APPLE_USER_DETECTED_APP_DEVICE` | Logout Shared Apple User Detected App Device | Log out the active user from a shared Apple device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_LOGOUT_SHARED_APPLE_USER_MANAGED_DEVICE` otherwise. Unsaved work can be lost. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_LOGOUT_SHARED_APPLE_USER_DETECTED_APP_USER_DEVICE` | Logout Shared Apple User Detected App User Device | Log out the active user from a shared Apple device addressed through a detected app and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_LOGOUT_SHARED_APPLE_USER_MANAGED_DEVICE` otherwise. Unsaved work can be lost. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_LOGOUT_SHARED_APPLE_USER_MANAGED_DEVICE` | Logout Shared Apple User Managed Device | Log out the active user from a shared Apple device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the device ID is known; unsaved work can be lost. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_REBOOT_NOW_DETECTED_APP_DEVICE` | Reboot Now Detected App Device | Reboot a device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_REBOOT_NOW_MANAGED_DEVICE` otherwise. The active user may lose unsaved work. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_REBOOT_NOW_DETECTED_APP_USER_DEVICE` | Reboot Now Detected App User Device | Reboot a device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_REBOOT_NOW_MANAGED_DEVICE` otherwise. The active user may lose unsaved work. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_REBOOT_NOW_MANAGED_DEVICE` | Reboot Now Managed Device | Reboot a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the device ID is known; the active user is interrupted and may lose unsaved work. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_REMOTE_LOCK_DETECTED_APP_DEVICE` | Remote Lock Detected App Device | Remotely lock a device addressed as a detected app's managed-device member, blocking the active user. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_REMOTE_LOCK_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_REMOTE_LOCK_DETECTED_APP_USER_DEVICE` | Remote Lock Detected App User Device | Remotely lock a device addressed through its detected-app membership and associated user, blocking the active user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_REMOTE_LOCK_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_REMOTE_LOCK_MANAGED_DEVICE` | Remote Lock Managed Device | Remotely lock a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, blocking the active user until unlock. Prefer this route whenever the device ID is known. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_REMOVE_USER_DEVICES_DETECTED_APP_DEVICES_USER` | Remove User Devices Detected App Devices User | Retire all devices from management for this user. Removes all devices associated with the named user from Intune management. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_REQUEST_DEFENDER_SCAN_DETECTED_APP_DEVICE` | Request Defender Scan Detected App Device | Request a Microsoft Defender scan for a Windows device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_REQUEST_DEFENDER_SCAN_MANAGED_DEVICE` otherwise. |
| `MICROSOFT_INTUNE_REQUEST_DEFENDER_SCAN_DETECTED_APP_USER_DEVICE` | Request Defender Scan Detected App User Device | Request a Microsoft Defender scan for a Windows device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_REQUEST_DEFENDER_SCAN_MANAGED_DEVICE` otherwise. |
| `MICROSOFT_INTUNE_REQUEST_DEFENDER_SCAN_MANAGED_DEVICE` | Request Defender Scan Managed Device | Request a Microsoft Defender scan through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the managed Windows device ID is known. |
| `MICROSOFT_INTUNE_RETIRE_DETECTED_APP_DEVICE` | Retire Detected App Device | Retire a device addressed as a detected app's managed-device member, unenrolling it and removing company-managed data while preserving personal data. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_RETIRE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_RETIRE_DETECTED_APP_USER_DEVICE` | Retire Detected App User Device | Retire a device addressed through its detected-app membership and associated user, unenrolling it and removing company-managed data while preserving personal data. Select only while traversing that context; prefer `MICROSOFT_INTUNE_RETIRE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_RETIRE_MANAGED_DEVICE` | Retire Managed Device | Retire a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, unenrolling it and removing company-managed data while preserving personal data. Prefer this route whenever the device ID is known. Delivery waits for check-in. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_SCHEDULE_RULE_ACTIONS_COMPLIANCE_POLICY` | Schedule Rule Actions Compliance Policy | Apply the supplied complete rule-action schedule to one compliance policy; use scheduled-rule-action tools to manage one schedule resource. Clearing the schedule requires `confirm_clear_all_rule_actions=true`. |
| `MICROSOFT_INTUNE_SET_PRIORITY_ENROLLMENT_CONFIG` | Set Priority Enrollment Config | Set one enrollment limit configuration's precedence position for users targeted by multiple configurations. |
| `MICROSOFT_INTUNE_SHUT_DOWN_DETECTED_APP_DEVICE` | Shut Down Detected App Device | Shut down a device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_SHUT_DOWN_MANAGED_DEVICE` otherwise. The active user may lose unsaved work. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_SHUT_DOWN_DETECTED_APP_USER_DEVICE` | Shut Down Detected App User Device | Shut down a device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_SHUT_DOWN_MANAGED_DEVICE` otherwise. The active user may lose unsaved work. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_SHUT_DOWN_MANAGED_DEVICE` | Shut Down Managed Device | Shut down a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the device ID is known; the active user may lose unsaved work. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_SYNC_DEVICE_DETECTED_APP_DEVICE` | Sync Device Detected App Device | Request an immediate policy sync for a device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_SYNC_DEVICE_MANAGED_DEVICE` otherwise. |
| `MICROSOFT_INTUNE_SYNC_DEVICE_DETECTED_APP_USER_DEVICE` | Sync Device Detected App User Device | Request an immediate policy sync for a device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_SYNC_DEVICE_MANAGED_DEVICE` otherwise. |
| `MICROSOFT_INTUNE_SYNC_DEVICE_MANAGED_DEVICE` | Sync Device Managed Device | Request an immediate Intune policy sync through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the managed-device ID is known. |
| `MICROSOFT_INTUNE_UNASSIGN_USER_FROM_DEVICE_AUTOPILOT_DEVICE` | Unassign User From Device Autopilot Device | Removes the assigned user from the Autopilot device identity, disrupting its user-targeted provisioning association. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_UPDATE_APP` | Update App | Update deployment metadata for an Intune Android line-of-business app. |
| `MICROSOFT_INTUNE_UPDATE_APP_CATEGORY` | Update App Category | Update a tenant-wide Intune app category's properties, independent of any one app relationship. |
| `MICROSOFT_INTUNE_UPDATE_APP_CONFIG` | Update App Config | Update the settings or metadata of an Intune iOS managed-app configuration. |
| `MICROSOFT_INTUNE_UPDATE_APP_CONFIGS_ASSIGNMENT` | Update App Configs Assignment | Update one target assignment for a specific Intune mobile-app configuration. |
| `MICROSOFT_INTUNE_UPDATE_APP_CONFIGS_DEVICE_STATUS` | Update App Configs Device Status | Update one device's deployment-status record for a specific Intune mobile-app configuration. |
| `MICROSOFT_INTUNE_UPDATE_APP_CONFIGS_USER_STATUS` | Update App Configs User Status | Update one user's deployment-status record for a specific Intune mobile-app configuration. |
| `MICROSOFT_INTUNE_UPDATE_APPS_ASSIGNMENT` | Update Apps Assignment | Update one Intune mobile-app assignment's target or settings. |
| `MICROSOFT_INTUNE_UPDATE_APPS_CATEGORIES` | Update Apps Categories | Update a category through a specific mobile app's categories route; use UPDATE_APP_CATEGORY for the tenant-wide route. |
| `MICROSOFT_INTUNE_UPDATE_APPS_CONTENT_VERSION` | Update Apps Content Version | Update mobileAppContent through the provider-required microsoft.graph.mobileLobApp cast. This generic-call-surface variant is retained separately from the mobile-LOB and managed-LOB endpoint-fidelity variants. |
| `MICROSOFT_INTUNE_UPDATE_APPS_CONTENT_VERSIONS_CONTAINED_APP` | Update Apps Content Versions Contained App | Update a Windows Universal AppX contained-app entry under a specific generic content version; use the committed-contained-app update tool for the app-level committed route. |
| `MICROSOFT_INTUNE_UPDATE_COMMITTED_CONTAINED_APP` | Update Apps Windows Universal App X Committed Contained Apps | Update a contained-app entry on a Windows Universal AppX app's committedContainedApps route; use the content-version update tool for an entry owned by a specific version. |
| `MICROSOFT_INTUNE_UPDATE_COMPLIANCE_POLICY` | Update Compliance Policy | Update device security or password requirements on one legacy Android compliance policy. |
| `MICROSOFT_INTUNE_UPDATE_COMPLIANCE_POLICY_RULE_ACTION_CONFIG` | Update Compliance Policy Rule Action Config | Update one enforcement action or delay within a scheduled compliance rule-action container. |
| `MICROSOFT_INTUNE_UPDATE_COMPLIANCE_SETTING_STATE` | Update Compliance Setting State | Update one device-and-user compliance observation under a setting summary, not its aggregate counts. |
| `MICROSOFT_INTUNE_UPDATE_COMPLIANCE_SETTING_SUMMARY` | Update Compliance Setting Summary | Update aggregate device compliance counts for one setting and platform, not an individual device setting state. |
| `MICROSOFT_INTUNE_UPDATE_DEFENDER_SIGNATURES_DETECTED_APP_DEVICE` | Update Defender Signatures Detected App Device | Request a Defender security-intelligence update for a Windows device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_UPDATE_DEFENDER_SIGNATURES_MANAGED_DEVICE` otherwise. |
| `MICROSOFT_INTUNE_UPDATE_DEFENDER_SIGNATURES_DETECTED_APP_USER_DEVICE` | Update Defender Signatures Detected App User Device | Request a Defender security-intelligence update for a Windows device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_UPDATE_DEFENDER_SIGNATURES_MANAGED_DEVICE` otherwise. |
| `MICROSOFT_INTUNE_UPDATE_DEFENDER_SIGNATURES_MANAGED_DEVICE` | Update Defender Signatures Managed Device | Request a Microsoft Defender security-intelligence update through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the managed Windows device ID is known. |
| `MICROSOFT_INTUNE_UPDATE_DETECTED_APP` | Update Detected App | Update a detected application's properties. |
| `MICROSOFT_INTUNE_UPDATE_DETECTED_APP_DEVICE` | Update Detected App Device | Update ownership classification, administrator-friendly name, or notes for a device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_UPDATE_MANAGED_DEVICE` otherwise. |
| `MICROSOFT_INTUNE_UPDATE_DETECTED_APP_DEVICE_MALWARE_STATE` | Update Detected App Device Malware State | Update supplied threat identity, severity, execution, remediation, detection-count, category, URL, or timestamp fields on a known malware-state record beneath a detected app's managed device. |
| `MICROSOFT_INTUNE_UPDATE_DETECTED_APP_DEVICES_DEVICE_CATEGORY` | Update Detected App Devices Device Category | Submit Microsoft Graph's documented discriminator-only device-category PATCH for a managed device reached through a detected app. This update route accepts no caller-specified category or other writable state, so it cannot assign or change a category; use `MICROSOFT_INTUNE_GET_DETECTED_APP_DEVICES_DEVICE_CATEGORY` to retrieve the same relationship without issuing a PATCH. Select this action only when the provider's exact discriminator-only PATCH operation is explicitly required. |
| `MICROSOFT_INTUNE_UPDATE_DETECTED_APP_DEVICES_LOG_REQUEST` | Update Detected App Devices Log Request | Update supplied status, identity, timing, initiator, expiration, size, or enrollment metadata on a known log-collection request reached through a detected app and managed device; returns the updated request. |
| `MICROSOFT_INTUNE_UPDATE_DETECTED_APP_DEVICES_USER` | Update Detected App Devices User | Submit Microsoft Graph's documented discriminator-only PATCH for the existing user relationship reached through a detected app and managed device. The route accepts no caller-specified user properties and does not edit the user's Microsoft Entra profile. |
| `MICROSOFT_INTUNE_UPDATE_DETECTED_APP_DEVICES_WINDOWS_PROTECTION` | Update Detected App Devices Windows Protection | Update supplied Windows protection health fields for a managed device reached through a detected app, such as malware protection, scan, signature, reboot, engine, product, or tamper status. |
| `MICROSOFT_INTUNE_UPDATE_DETECTED_APP_USER_DEVICE` | Update Detected App User Device | Update ownership classification, administrator-friendly name, or notes for a device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_UPDATE_MANAGED_DEVICE` otherwise. |
| `MICROSOFT_INTUNE_UPDATE_DEVICE_CONFIG` | Update Device Config | Update the name, description, version, or OMA settings of an Android custom device configuration in Intune. |
| `MICROSOFT_INTUNE_UPDATE_DEVICE_PROPERTIES_AUTOPILOT_DEVICE` | Update Device Properties Autopilot Device | Update only the supplied user principal name, addressable user name, group tag, or display name on one Windows Autopilot device identity. |
| `MICROSOFT_INTUNE_UPDATE_ENROLLMENT_CONFIGS_ASSIGNMENT` | Update Enrollment Configs Assignment | Replace the target of one assignment on a device enrollment configuration. |
| `MICROSOFT_INTUNE_UPDATE_ENROLLMENT_LIMIT_CONFIG` | Update Enrollment Limit Config | Update only the supplied limit, priority, version, name, or description on one enrollment limit configuration. |
| `MICROSOFT_INTUNE_UPDATE_EXPORT_JOB` | Update Export Job | Update the supplied properties of one Intune report export job selected by ID. |
| `MICROSOFT_INTUNE_UPDATE_MANAGED_DEVICE` | Update Managed Device | Update a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, changing its ownership classification, administrator-friendly name, or notes. Prefer this direct route for ordinary device maintenance over detected-app relationship variants. |
| `MICROSOFT_INTUNE_UPDATE_MANAGED_LOB_CONTENT_VERSION` | Update Apps Managed Mobile Lob App Content Version | Update mobileAppContent in a managed mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This managed-LOB endpoint-fidelity variant is retained separately from the generic and mobile-LOB variants. |
| `MICROSOFT_INTUNE_UPDATE_MOBILE_LOB_CONTENT_VERSION` | Update Apps Mobile Lob App Content Version | Update mobileAppContent in a mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This mobile-LOB endpoint-fidelity variant is retained separately from the generic and managed-LOB variants. |
| `MICROSOFT_INTUNE_VERIFY_ENROLLMENT_AUTODISCOVERY` | Verify Enrollment Autodiscovery | Check whether Windows enrollment auto-discovery is configured for one domain and return Microsoft Graph's Boolean result. |
| `MICROSOFT_INTUNE_WIPE_DETECTED_APP_DEVICE` | Wipe Detected App Device | Wipe a device addressed as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`. Select this relationship route only while traversing from a detected app; prefer `MICROSOFT_INTUNE_WIPE_MANAGED_DEVICE` for ordinary device operations. Factory-resets by default, with platform-dependent retention options. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_WIPE_DETECTED_APP_USER_DEVICE` | Wipe Detected App User Device | Wipe a device addressed through its detected-app membership and associated user. Select this nested relationship route only while traversing from that detected app and user; prefer `MICROSOFT_INTUNE_WIPE_MANAGED_DEVICE` for ordinary device operations. Factory-resets by default, with platform-dependent retention options. Requires `confirm_destructive_action=true`. |
| `MICROSOFT_INTUNE_WIPE_MANAGED_DEVICE` | Wipe Managed Device | Wipe a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Factory-resets it by default, removing personal and organizational data, apps, and configurations; retention options vary by platform. Prefer this direct route whenever the managed-device ID is known. Graph acceptance is not completion. Requires `confirm_destructive_action=true`. |

## Supported Triggers

None listed.

## Creating MCP Server - Stand-alone vs Composio SDK

The Microsoft Intune MCP server provides comprehensive access to Microsoft Intune operations through Composio. Once connected, Hermes can perform all major Microsoft Intune actions on your behalf using natural language commands.

## Complete Code

None listed.

## Conclusion

### Way Forward
With Microsoft Intune connected, Hermes can now act on your behalf whenever it detects a relevant task or you ask it to.
From here, you can extend Hermes further:
- Connect more apps: Calendar, Slack, Notion, Linear, and hundreds of others are available through the same Composio Connect setup. Each new integration compounds what Hermes can do for you.
- Build workflows across tools: Once multiple apps are connected, Hermes can chain actions together — turn an email into a calendar invite, a Slack message into a Linear ticket, or a meeting note into a follow-up draft.
- Let it learn your patterns: The more you use Hermes, the better it gets at anticipating how you'd handle recurring tasks. Give it feedback on drafts and decisions, and it will adapt.
If you run into trouble or want to share what you've built, join the [community](https://discord.com/invite/composio) or check out the [Docs](https://docs.composio.dev?cta_placement=toolkit-framework-hermes-docs) for deeper configuration options.

## How to build Microsoft Intune MCP Agent with another framework

- [ChatGPT](https://composio.dev/toolkits/microsoft_intune/framework/chatgpt)
- [Claude Cowork](https://composio.dev/toolkits/microsoft_intune/framework/claude-cowork)
- [Atomic Agent](https://composio.dev/toolkits/microsoft_intune/framework/atomic-agent)

## Related Toolkits

- [Supabase](https://composio.dev/toolkits/supabase) - Supabase is an open-source backend platform offering scalable Postgres databases, authentication, storage, and real-time APIs. It lets developers build modern apps without managing infrastructure.
- [Codeinterpreter](https://composio.dev/toolkits/codeinterpreter) - Codeinterpreter is a Python-based coding environment with built-in data analysis and visualization. It lets you instantly run scripts, plot results, and prototype solutions inside supported platforms.
- [GitHub](https://composio.dev/toolkits/github) - GitHub is a code hosting platform for version control and collaborative software development. It streamlines project management, code review, and team workflows in one place.
- [1password](https://composio.dev/toolkits/_1password) - 1Password is a password manager and digital vault for storing logins, secrets, notes, and secure documents. It helps individuals and teams protect credentials, share access safely, and reduce password risk.
- [Ably](https://composio.dev/toolkits/ably) - Ably is a real-time messaging platform for live chat and data sync in modern apps. It offers global scale and rock-solid reliability for seamless, instant experiences.
- [Abuselpdb](https://composio.dev/toolkits/abuselpdb) - Abuselpdb is a central database for reporting and checking IPs linked to malicious online activity. Use it to quickly identify and report suspicious or abusive IP addresses.
- [Alchemy](https://composio.dev/toolkits/alchemy) - Alchemy is a blockchain development platform offering APIs and tools for Ethereum apps. It simplifies building and scaling Web3 projects with robust infrastructure.
- [Algolia](https://composio.dev/toolkits/algolia) - Algolia is a hosted search API that powers lightning-fast, relevant search experiences for web and mobile apps. It helps developers deliver instant, typo-tolerant, and scalable search without complex infrastructure.
- [Anakin](https://composio.dev/toolkits/anakin_io) - Anakin is a web automation platform offering scraping, crawling, search, and browser automation. Use it to extract structured data, automate site tasks, and monitor web changes reliably.
- [Anchor browser](https://composio.dev/toolkits/anchor_browser) - Anchor browser is a developer platform for AI-powered web automation. It transforms complex browser actions into easy API endpoints for streamlined web interaction.
- [AnyAPI](https://composio.dev/toolkits/anyapi) - AnyAPI is a marketplace of utility APIs for validation, currency conversion, holidays, documents, and web data. It brings common application workflows together through one practical API platform.
- [Apiflash](https://composio.dev/toolkits/apiflash) - Apiflash is a website screenshot API for programmatically capturing web pages. It delivers high-quality screenshots on demand for automation, monitoring, or reporting.
- [Apiverve](https://composio.dev/toolkits/apiverve) - Apiverve delivers a suite of powerful APIs that simplify integration for developers. It's designed for reliability and scalability so you can build faster, smarter applications without the integration headache.
- [Appcircle](https://composio.dev/toolkits/appcircle) - Appcircle is an enterprise-grade mobile CI/CD platform for building, testing, and publishing mobile apps. It streamlines mobile DevOps so teams ship faster and with more confidence.
- [Appdrag](https://composio.dev/toolkits/appdrag) - Appdrag is a cloud platform for building websites, APIs, and databases with drag-and-drop tools and code editing. It accelerates development and iteration by combining hosting, database management, and low-code features in one place.
- [Appveyor](https://composio.dev/toolkits/appveyor) - AppVeyor is a cloud-based continuous integration service for building, testing, and deploying applications. It helps developers automate and streamline their software delivery pipelines.
- [Authyo](https://composio.dev/toolkits/authyo) - Authyo is a REST API service for passwordless authentication, OTP verification, session management, and transactional notifications. Use it to add secure login flows and user verification without building auth infrastructure from scratch.
- [AWS Marketplace MCP](https://composio.dev/toolkits/aws_marketplace_mcp) - AWS Marketplace MCP provides MCP access to AWS Marketplace's cloud software, data, and services catalog. Use it to discover, compare, and evaluate 30K+ AWS Marketplace listings faster.
- [Azure Monitor Activity Log](https://composio.dev/toolkits/azure_monitor_activity_log) - Azure Monitor Activity Log is Azure's service that records management and control-plane events for a subscription. Use it to audit changes, troubleshoot issues, and track resource operations across your Azure resources.
- [Backendless](https://composio.dev/toolkits/backendless) - Backendless is a backend-as-a-service platform for mobile and web apps, offering database, file storage, user authentication, and APIs. It helps developers ship scalable applications faster without managing server infrastructure.

## Frequently Asked Questions

### What are the differences in Tool Router MCP and Microsoft Intune MCP?

With a standalone Microsoft Intune MCP server, the agents and LLMs can only access a fixed set of Microsoft Intune tools tied to that server. However, with the Composio Tool Router, agents can dynamically load tools from Microsoft Intune and many other apps based on the task at hand, all through a single MCP endpoint.

### Can I use Tool Router MCP with Hermes?

Yes, you can. Hermes fully supports MCP integration. You get structured tool calling, message history handling, and model orchestration while Tool Router takes care of discovering and serving the right Microsoft Intune tools.

### Can I manage the permissions and scopes for Microsoft Intune while using Tool Router?

Yes, absolutely. You can configure which Microsoft Intune scopes and actions are allowed when connecting your account to Composio. You can also bring your own OAuth credentials or API configuration so you keep full control over what the agent can do.

### How safe is my data with Composio Tool Router?

All sensitive data such as tokens, keys, and configuration is fully encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant and follows strict security practices so your Microsoft Intune data and credentials are handled as safely as possible.

---
[See all toolkits](https://composio.dev/toolkits) · [Composio docs](https://docs.composio.dev/llms.txt)