This guide reflects the updated Intune connection flow introduced on May 27 and is intended for customers setting up the integration using the current experience. For the legacy version, refer to the Legacy: Microsoft Intune Integration Guide (Windows) or Legacy Microsoft Intune Integration Guide (Mac Devices).
If you use multiple MDMs or also use the Drata Agent, refer to Multiple MDM Support.
Prerequisites
IdP Connection required: An identity provider (IdP) connection with personnel records in Drata is required so Intune device compliance can be matched to users.
Microsoft Account requirement:You need a Global Administrator account in Microsoft Entra ID or Intune.
Devices must already be enrolled in and managed by Intune in the tenant you plan to connect.
This guide covers both macOS and Windows devices, as they are the only supported platforms for this integration.
Additional Notes:
After initial setup or policy changes, Intune may take several days to fully deploy new policies across devices.
Drata reflects compliance only after Intune evaluates the relevant device and user as compliant.
Review Microsoft’s documented limitations for Windows virtual machines in Intune, especially if you manage non-persistent or cloned virtual desktops.
What you will set up
Create an Intune OAuth app on Entra ID and obtain the app’s Application ID (client ID), Tenant ID, and app secret.
Grant permissions to the app.
Create compliance policies within Intune for devices in scope to assess Autoupdates, Lock Screen, Firewall, Disk Encryption, and Antivirus compliance.
Connect your Intune instance to Drata.
Step 1: Create an Intune OAuth app on Entra ID
Sign in to the Microsoft Entra admin center.
Go to Identity > Applications > App registrations.
Select New registration.
Enter the following values:
Name: Drata - Intune App
Supported account types: Accounts in this organizational directory only (single tenant)
Select Register.
On the app overview page, copy the following values:
Application (client) ID
Directory (tenant) ID
Select Add a certificate or secret or <#> certificate, <#> secret.
Select New client secret.
Enter a description.
Set Expires to 24 months.
Select Add.
Copy the Value of the secret and save it somewhere secure. This will be the only time you can copy this secret key.
After creating the secret, refresh the Certificates & secrets page before using it. Microsoft can leave the new secret in a pending state until the page is refreshed.
Drata does not currently send a notification when this secret is nearing expiration. Track and rotate it before it expires to avoid a broken connection.
Expected outcome: At the end of this section, you should have the following values
Application (client) ID
Directory (tenant) ID
Client secret
In Step 4, you will enter these values into Drata.
Step 2: Grant permissions to the app
Drata uses Microsoft Graph application permissions for this integration.
In the app registration, open API permissions.
Select Add a permission.
Select Microsoft Graph.
Select Application permissions.
Add these permissions:
DeviceManagementManagedDevices.Read.All
DeviceManagementConfiguration.Read.All
DeviceManagementApps.Read.All if you plan to use the password manager install check
Select Add permissions.
Select Grant admin consent.
Confirm the permissions show as Granted.
Step 3: Create compliance policies
Understand what Drata validates
The Intune integration does not enforce device settings. It checks whether Intune has already evaluated the relevant device and user as compliant.
If you already have compliance policies that evaluate the required settings, you do not need to create new policies just for Drata.
Supported checks
Drata test | What Intune should evaluate |
Test 61: User Screen Lock | Password required to unlock the device and maximum inactivity timeout |
Test 63: Password Manager | Approved password manager installed through Managed Apps or validated through a configuration policy.
For more information, refer to Managed Apps & Configuration Policies section. |
Test 64: Antivirus | Antivirus-related compliance through Windows Defender, another Intune-supported antivirus setting, or Managed Apps where applicable.
For more information, refer to Managed Apps & Configuration Policies section. |
Test 65: Automatic Updates | Minimum OS version requirement |
Test 66: Encryption | (Windows Only) BitLocker on Windows or device encryption settings supported by Intune |
Create or edit a compliance policy in Intune
Sign in to the Microsoft Intune admin center.
Go to Devices.
Select Compliance under Managed devices.
Do one of the following:
To create a new policy, select Create Policy.
To edit an existing policy, open the policy and select Properties > Edit under Compliance settings.
For a new Windows policy:
Select Platform: Windows 10 and later
Select Profile type: Windows 10/11 compliance policy
Create and give it a name you desire, then click “Continue”
Continue in Windows Policy Setting section.
For a new macOS policy:
Select Platform: macOS
Create and give it a name you desire, then click “Continue”
Continue in MacOS Policy Setting section.
Windows Policy Setting
Configure the following settings for Windows devices as needed by your compliance program.
Device Health
Set BitLocker to Require if you use BitLocker.
If you do not use BitLocker, configure the encryption setting under System Security instead.
Device Properties
Set Minimum OS version according to your organization’s Windows standard.
Microsoft documents valid Windows compliance version formats in Windows compliance settings in Intune.
System Security
Password
Set Require a password to unlock mobile devices to Require.
Set Maximum minutes of inactivity before password is required to the value defined by your organization.
Set Require password when device returns from idle state (Mobile and Holographic) to Require.
Encryption
If you are not using BitLocker, set Encryption of data storage on a device to Require.
Device Security
If you use Microsoft Defender, you can skip the generic Antivirus requirement and configure the Defender-specific settings instead.
If you use another antivirus product supported by Intune, set Antivirus to Require.
Defender
Set Microsoft Defender Antimalware to Require.
Set Real-time protection to Require.
MacOS Policy Setting
Configure the following settings for macOS devices as needed by your compliance program.
Device Health
Set Require system integrity protection to Require.
Device Properties
Set Minimum OS version according to your organization’s macOS standard.
Microsoft documents the available options in macOS device compliance settings in Intune.
System Security
Password
Set Require a password to unlock devices to Require.
Set Maximum minutes of inactivity before password is required to the value defined by your organization.
Encryption
Set Require encryption of data storage on device to Require.
Gatekeeper
Set Allow apps downloaded from these locations to the value approved by your organization, such as Mac App Store and identified developers.
Managed Apps and configuration policies
Intune does not natively detect browser extensions. If your password manager is deployed as a browser extension, you may need to validate it through a configuration policy instead of relying on native extension detection.
For Managed Apps, Drata uses Intune reporting for the apps you select during the Intune connection setup. If Intune reports that the selected app is present for the user and device, Drata can use that result as part of the Password Manager or Antivirus check.
To add a managed app in Intune:
Login to Intune https://intune.microsoft.com
Go to Apps > All apps.
Select Create.
Configure the application.
Copy the App ID for the app record.
Assign the app to the users and devices in scope.
For more information, refer to Intune Manage Apps.
Test 64: Antivirus
In addition to the settings above, Test 64: Antivirus may be configured to pass based on a Managed Apps installation instead. This is helpful when the built-in antivirus policy settings compliance checks listed in Intune Compliance Policy Setup are not compatible with compliance needs. If using an EDR integration for antivirus, then please do not select an Antivirus app.
If an antivirus app is not selected, then the system will use the settings as described instead or the appropriate EDR integration.
Test 63: Password Manager
The password manager test confirms whether the approved business software is installed. These checks are provided by either a Managed App deployed via Intune or a configuration policy.
For example, if using a browser extension for password manager without a corresponding desktop application, then either a managed app bundle or a configuration policy check is required.
Password manager configuration policy scope
Browser-specific extension deployment can vary by browser and vendor. This guide does not include browser-specific extension configuration steps.
If you need to implement a password manager through a browser configuration policy, use the relevant browser or vendor documentation. For example, Google documents Chrome extension deployment here: Automatically install apps and extensions with Intune on Windows devices.
Step 4: Connect your Intune instance to Drata.
After your policies are configured or confirmed, connect the Intune tenant in Drata.
If you are connecting a brand-new Intune tenant, configure the relevant Intune policies. If you connect before configuring the policies, related checks can show as failing in Drata until setup is complete.
Initial steps:
Note: Only one connection per Tenant ID can be configured at a time.
In Drata, go to Connections.
Search for and select Connect on the Intune or Intune GCC High integration.
Enter the values that you obtained when you created the Intune OAuth app:
Tenant ID
Application ID
Application Secret
Select Next.
If you plan to use Managed Apps for the password manager check:
Select Managed Apps.
Enter a search term such as 1password.
Select Continue.
Select the apps you want to use for the password manager install check.
Select Save.
Scope Antivirus & Password Manager tests to additional checks:
Select the appropriate app from the list of managed apps available on your Intune connection. Choose the app entries that match the applications and versions you want Drata to treat as a passing result.
Test 63: Password Manager: Select the managed app(s) appropriate in the “Password manager apps (optional)” dropdown
Test 64: Antivirus: Select the managed app(s) appropriate in the “Antivirus apps (optional)” dropdown
(Configuration Policy) Test 63: Password Manager: Select the configuration policy name that is set up to apply the browser extension or other mechanism for password management check. (Be sure to select all policies that indicate a passing result.)
Important: If you use a configuration policy for Test 63, the policy itself is responsible for enforcing the correct password manager settings. Drata does not validate the policy contents. It only checks whether the configuration policy was successfully applied to the device.
Configure Intune in Drata for employee onboarding
This prevents the Drata Agent from appearing as the default onboarding method in My Drata.
In Drata, go to Settings > Personnel Compliance.
Select the Internal Security tab.
Turn Automated via Intune MDM on.
Turn Automated via Drata Agent off.