Overview

Microsoft Intune Inspector (Beta)

Microsoft Intune is Microsoft's cloud-based unified endpoint management (UEM) platform for Windows, iOS/iPadOS, Android, and macOS devices. The Microsoft Intune Inspector (Beta) connects through Microsoft Graph using the same Microsoft partner sign-in that powers the Microsoft 365 Inspector, automatically discovers every Customer tenant reachable through your active GDAP relationships, and tracks each tenant's managed-device compliance, configuration, apps, Autopilot, and Conditional Access posture in Liongard. You track endpoint drift the same way you already track Microsoft 365 tenant drift, without opening the Intune admin center for every Customer.

What you can monitor

The Microsoft Intune Inspector collects endpoint management data for each Customer tenant, including:

• Managed device inventory: device name, user, OS and version, model, serial, ownership, compliance state, encryption, last sync, enrollment date, and category
• Non-compliant devices, in a filtered view for fast triage
• Compliance policies and configuration profiles (legacy and Settings Catalog), with platform and assignment counts
• The managed app catalog and App Protection Policies (MAM)
• Windows Autopilot deployment profiles and registered Autopilot devices
• Conditional Access policies, with state, targeted users and apps, and grant controls
• Windows Update for Business ring profiles
• Whether the tenant holds an active Intune license

How it works

You sign in once at the Parent level with your Microsoft partner credentials. The Parent discovers every Customer tenant where you hold an active GDAP relationship and offers each one as a ready-to-activate Child Inspector, with no per-Customer credential entry. Each Child Inspector reads only its own tenant. If you've already connected the Microsoft 365 Inspector, no new admin consent step is needed, because the Intune Inspector reuses that consent. All Microsoft Graph permissions are read-only.

Benefits

• Track compliance rates per Customer and get alerted when compliant devices drop or non-compliant devices rise.
• Detect compliance policy and configuration profile changes made outside your standard build.
• Know when a Conditional Access policy is disabled or the enabled policy count changes, an early Customer risk indicator.
• See Autopilot profiles and registered devices per Customer without a portal login.
• Track app catalog and App Protection Policy changes for BYOD-heavy Customers.
• Catch an Intune license lapse as a tracked change, not a surprise.

The Inspector ships with 14 alert rules, listed in the Microsoft Intune Inspector Summary. All rules ship turned off. To receive these alerts, turn the rules on under Admin > Actionable Alerts.

Inspector Setup Preparation

Inspector Setup:

Step 1: Configure the Microsoft Intune Parent Inspector in Liongard

1. Log in to the Liongard platform.
2. In Liongard, navigate to Admin > Inspectors > Inspector Types > Navigate to the Microsoft Intune Inspector > Select Add System.

Since Intune is managed across many Customer tenants through your Microsoft partner relationships, you'll set up a single Parent Inspector that will then auto-discover a Child Inspector for each Customer tenant.

Fill in the following information:

• Type of Inspector: Parent
• Environment: Select your MSP's Environment
• Friendly Name: Suggested Naming: [MSP Name] Microsoft Intune Parent
• Agent: Select the On-Demand Agent
• Inspector Version: Latest
• Multi-Tenant (CSP/GDAP): Leave enabled unless you're inspecting a single tenant directly
• Microsoft Sign In: Click Open Microsoft Sign In and authenticate with an account that has access to your Microsoft partner tenant. Liongard stores the resulting token securely; there's no value to copy manually.
• Scheduling: The Inspector will default to run once a day at the time it's set up. Here you can adjust the schedule
• Select Save. The Inspector will now be triggered to run within the minute.

Step 2: Child Inspector Setup

After the first run of the Parent Inspector, your Customer tenants will be auto-discovered and surfaced in the Discovered Systems tab on the Inspectors > Microsoft Intune page. Each maps one-to-one to a Liongard Environment.

• Activate or Archive your Discovered Systems by ensuring they're mapped to the correct Environment > Check the checkbox to the left of Inspector(s) > Select the Actions drop-down menu > Activate Launchpoints (or Archive Launchpoints).
• Click Save.

Troubleshooting

• This tenant does not have an active Microsoft Intune license: The Customer tenant doesn't have an assigned Intune service plan. Confirm licensing in the Customer's Microsoft 365 admin center.
• A Customer tenant doesn't appear for auto-discovery: You don't have an active GDAP relationship granting Intune access into that Customer tenant, or the relationship has expired. Check Partner Center.
• Some data is temporarily missing after a permissions change: Newly granted Microsoft Graph permissions can take a few minutes to propagate after consent. The next scheduled run picks them up automatically.

Inspector FAQs