id: intune
name: Microsoft Intune
version: 1.0.0
description: "Microsoft Intune (Microsoft Graph device management) — endpoint containment: list and read managed devices, and retire, wipe, or remote-lock a device. Azure AD OAuth2 client-credentials authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list/get managed devices, retire/wipe/remote-lock device."
category: endpoint

# Per-instance configuration. Application (client-credentials) OAuth2. The app
# registration needs Graph application permissions
# DeviceManagementManagedDevices.ReadWrite.All and .PrivilegedOperations.All.
config_schema:
  properties:
    tenant_id:
      type: string
      description: "Azure AD tenant ID"
    client_id:
      type: string
      description: "App registration (client) ID"
    client_secret:
      type: string
      description: "App registration client secret"
      x-soar-sensitive: true
  required:
    - tenant_id
    - client_id
    - client_secret

commands:
  - id: list_managed_devices
    name: intune-list-managed-devices
    description: "List Intune-managed devices (optionally filtered)."
    risk: read
    inputs_schema:
      properties:
        filter: { type: string, description: "OData $filter (e.g. userPrincipalName eq 'jdoe@corp.com')" }
        limit: { type: number, description: "Max devices (default 50)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_managed_device
    name: intune-get-managed-device
    description: "Get a single managed device by ID."
    risk: read
    inputs_schema:
      properties:
        device_id: { type: string, description: "Managed device ID" }
      required: [device_id]
    outputs_schema: { properties: {} }
  - id: retire_device
    name: intune-retire-device
    description: "Retire a device (removes company data/management)."
    inputs_schema:
      properties:
        device_id: { type: string, description: "Managed device ID" }
      required: [device_id]
    outputs_schema: { properties: {} }
  - id: wipe_device
    name: intune-wipe-device
    description: "Wipe a device (factory reset — containment)."
    inputs_schema:
      properties:
        device_id: { type: string, description: "Managed device ID" }
        keep_enrollment_data: { type: boolean, description: "Keep enrollment data (default false)" }
      required: [device_id]
    outputs_schema: { properties: {} }
  - id: remote_lock_device
    name: intune-remote-lock-device
    description: "Remotely lock a device."
    inputs_schema:
      properties:
        device_id: { type: string, description: "Managed device ID" }
      required: [device_id]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: intune-test-connection
    description: "Verify the app credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }