Skip to main content

Device sync

Device sync pulls managed devices from Microsoft Intune (and Jamf Pro) into Tagaris on a schedule. It is read-only: Tagaris never writes back to the source. Pulled devices are reconciled against your assets by serial number, then hostname, and land in a review queue at Discovered, where an admin links each one to its matched asset, imports it as a new asset, or ignores it.

Alongside the name, serial, model and operating system, the sync captures the hardware specification the source reports: CPU, RAM and storage. Jamf provides all three for Macs (and storage for enrolled iPhones and iPads); Intune provides RAM and storage (it has no clean CPU model). These land on the asset's CPU, RAM and Storage fields when you link or import a device, filling any you have not set by hand (a value you typed is never overwritten). Because Apple Silicon and modern mobile storage are not user-upgradeable, a synced spec stays accurate. You can also enter these fields by hand on any asset, whether it came from sync or not.

Device sync is a free beta feature (device_sync), configured under Settings then Integrations by an administrator. It is in beta because it has not yet been proven against the full range of real tenants, and it is free while we gather that evidence. Email beta@tagaris.co.uk for a beta key (Licensing covers applying it), and report anything that does not behave against your tenant. The "Pull from Microsoft Entra" people import is in the same free beta (entra_import).

Microsoft Intune (Entra ID)​

Tagaris authenticates as an application (client-credentials OAuth) and reads deviceManagement/managedDevices from Microsoft Graph. You can reuse the app you created for single sign-on or email, or use a separate one.

  1. App registration. In the Microsoft Entra admin centre, open the app (or create one under App registrations). Note the directory (tenant) ID and application (client) ID from its Overview.
  2. Permission. Go to API permissions, then Add a permission, then Microsoft Graph, then Application permissions, and add DeviceManagementManagedDevices.Read.All. Then choose Grant admin consent. That one permission is all the pull needs.
  3. Client secret. Under Certificates and secrets, create a client secret and copy its Value. Record its expiry and set a reminder to rotate it.
  4. In Tagaris. Settings then Integrations, open Microsoft Intune and Entra ID, and enter the tenant ID, client ID and client secret. Use Test connection: it signs in and reads one device, so a green result means the permission is consented and the pull will work, not merely that the credentials are valid.
  5. Schedule. Set the connector to enabled and choose a schedule (daily or weekly), or run it once with Sync now. Pulled devices appear under Discovered.

Options​

Each connector has options (Settings then Integrations): a review-versus-auto policy (auto-link confident serial matches, queue the rest), device filters (by OS, last-seen days, and Intune ownership or compliance), and which descriptive fields to import (serial, hostname and name are always kept).

If the test fails​

  • 403 or "cannot read Intune devices": the DeviceManagementManagedDevices.Read.All permission is missing or not consented. Recheck step 2.
  • Sign-in failed: the tenant ID, client ID or secret is wrong, or the secret has expired. Recheck steps 1 and 3.

Jamf Pro​

Jamf is in beta (built and unit-tested, not yet verified against a live tenant). In Jamf, create an API role with read access to computer and mobile device inventory, then an API client using that role. Enter the instance URL, client ID and client secret under Settings then Integrations, then Test connection.