Help center › Set up
Devices from Intune
Districts that manage Windows laptops, iPads, Macs or Android devices in Microsoft Intune need no devices file. On Admin › Import, the card Devices from Intune reads every managed device in your tenant and makes each one an asset in Beacon, with its serial number, model, operating system and primary user, refreshed each night. It rides on the Microsoft Entra connection: the same administrator consent, one more permission. Beacon only ever reads; nothing is written back to Intune.
What you need
- The Microsoft Entra connection from the People from Microsoft Entra card above it. A Global Administrator of your tenant accepts Microsoft's consent page once; it lists what Beacon asks for, and with devices that includes reading Intune's managed devices. Nothing is ever written.
- If your tenant's consent does not include the Intune permission (“Read Microsoft Intune devices”), for example because it was granted before devices were offered or the permission was removed from Beacon under Enterprise applications in Entra, the card says so and offers Connect Microsoft Entra again: the same round-trip, accepted once more with the permission. The people sync carries on either way.
- An Intune license on the tenant. For a tenant without Intune, Microsoft answers the device listing with “Request not applicable to target tenant”, and the card says the tenant has no Intune subscription, so there are no Intune devices to read. Connecting again does not change that, and the people sync carries on. Once the tenant has Intune, press Preview.
Preview first, then sync
No device changes until you have looked. Connecting Microsoft Entra runs a preview on its own, and Preview runs one any time: it reads the whole listing, counts what a sync would do (devices in Intune, how many would be added or changed, how many would be assigned, how many are no longer in Intune) and changes nothing. Once a preview has finished, Sync devices now runs the real pass, and Sync nightly keeps it current every night after 02:00 in your organization's time zone; switched on when no real pass has run since the last 02:00, it runs one within the hour. A preview belongs to the connection it ran on: connect Entra anew and the card asks for one more before a real pass.
What is read, per device
| In Intune | In Beacon |
|---|---|
| Serial number | The match key. A device already in Beacon with that serial number is updated, never duplicated, so a fleet imported from a spreadsheet or from Incident IQ is enriched rather than doubled. A device whose serial number is empty, or is a firmware placeholder such as “To be filled by O.E.M.”, is skipped: there is nothing to match on. |
| Device name | Kept with the device's external IDs. With Use the Intune device name as the asset tag on, it is the asset tag of a device the sync adds, and a second match key after the serial number (a device with that tag and no serial number of its own is adopted; one with a different serial number is another device, and the sync records the collision and tags the new device with its serial number instead). Off, a device the sync adds is tagged with its serial number, as an import does. |
| Model, manufacturer | Model and manufacturer. |
| Operating system | The asset type: Windows goes to Laptop, or to Desktop when Intune reports a desktop chassis or the model is a desktop family (OptiPlex, ThinkCentre, EliteDesk and the like); iOS and iPadOS to iPad (an iPhone to Phone); macOS to Mac; Android to Android; ChromeOS to Chromebook, the same type Chromebooks from Google Admin uses. A type your organization lacks is created. The version is kept with the device. |
| Primary user | The person the device is enrolled to. Their site becomes the device's site when the device has none, or when the primary user changes in Intune. They become the device's holder only with Assign devices to their Intune primary user on (below). |
| Enrolled, last check-in, ownership, compliance, category | Kept with the device's external data: when it was enrolled, when it last checked in, whether Intune calls it company-owned or personal, its compliance state and category. |
| Wi-Fi MAC address, Entra device id, the primary user's display name and Entra id, management agent, enrollment type | Kept with the device's external data as well. The API returns that data to technicians and administrators; the device page does not show it. |
Intune has no device status that maps to Beacon's. A device the sync adds is In service, or Assigned when it has a holder; a status a technician set is never changed by the sync, and only an assignment moves a device from In service or In storage to Assigned.
The primary user as the holder
By default the sync assigns nobody: who a device is enrolled to is information, and a technician checks devices out. The switch Assign devices to their Intune primary user on the card (off to start) makes the sync assign a device with no holder to its primary user, when that person is in Beacon (by address, or by the Entra account the people sync recorded). The trade-off is stated on the switch: a device whose primary user changes in Intune changes hands in Beacon. A device somebody already holds changes hands only when its primary user changes, and a sync never unassigns.
Your edits survive
After a device's first pass, Beacon follows Intune only where Intune's own value changed since the previous pass, or where the field in Beacon was empty. A technician's In repair, a corrected tag or model, a check-out to someone else and a move to another site all stay while Intune repeats itself; a new model, a new device name (with the tag switch on) and a new primary user are applied. Purchase date, cost, warranty, funding source and notes are never touched, except for the one note line below. A move to another site, which follows the primary user, leaves the location and room behind, as a hand transfer does.
Nothing is deleted
A device that disappears from Intune (retired there, wiped, re-enrolled under a new record) is left exactly as it was. Once a pass has read the whole listing, the device is flagged: its history says the sync did not find it, it gets a note line with the date it was last seen, and the card counts how many devices are flagged. A technician decides what that means: lost, retired, or merely re-enrolled. A device that comes back is un-flagged the same way, and the note line is removed. A pass that stops early (Microsoft answers with a rate limit halfway through) flags nothing.
When it runs, and what the card shows
Preview and Sync devices now run when you press them; the nightly pass runs after 02:00 in your time zone once the switch is on. Each pass is listed on the card with its counts: in Intune, added, updated, assigned from the primary user, no longer in Intune, tag conflicts, personally owned, skipped. If Microsoft refuses Beacon (the consent was withdrawn, or Beacon was removed from the tenant) the card says so and asks you to connect again; the nightly people and device passes pause until then. If the consent does not cover Intune, that pass fails with a sentence that says to connect again, the card offers Connect Microsoft Entra again, and the people sync carries on. A temporary rate-limit answer only fails that pass, and the next one tries again.
What this is not
It is a device sync from Intune only. Apple devices in Mosyle Manager have their own sync, Devices from Mosyle. Jamf and SCCM are not read; those devices come in from an import by serial number. Intune's own actions (wipe, retire, remote lock) are not offered in Beacon, and nothing Beacon does reaches Intune.