Guillaume BOURGEOIS
e91febd319
Microsoft Graph device management, 6 commands: list/get managed devices, retire/wipe/remote-lock device (containment). OAuth2 client-credentials auth, stdlib-only. py_compile clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
82 lines
2.9 KiB
YAML
82 lines
2.9 KiB
YAML
id: intune
|
|
name: Microsoft Intune
|
|
version: 1.0.0
|
|
description: "Microsoft Intune (Microsoft Graph device management) — endpoint containment: list and read managed devices, and retire, wipe, or remote-lock a device. Azure AD OAuth2 client-credentials authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: list/get managed devices, retire/wipe/remote-lock device."
|
|
category: endpoint
|
|
|
|
# Per-instance configuration. Application (client-credentials) OAuth2. The app
|
|
# registration needs Graph application permissions
|
|
# DeviceManagementManagedDevices.ReadWrite.All and .PrivilegedOperations.All.
|
|
config_schema:
|
|
properties:
|
|
tenant_id:
|
|
type: string
|
|
description: "Azure AD tenant ID"
|
|
client_id:
|
|
type: string
|
|
description: "App registration (client) ID"
|
|
client_secret:
|
|
type: string
|
|
description: "App registration client secret"
|
|
x-soar-sensitive: true
|
|
required:
|
|
- tenant_id
|
|
- client_id
|
|
- client_secret
|
|
|
|
commands:
|
|
- id: list_managed_devices
|
|
name: intune-list-managed-devices
|
|
description: "List Intune-managed devices (optionally filtered)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
filter: { type: string, description: "OData $filter (e.g. userPrincipalName eq 'jdoe@corp.com')" }
|
|
limit: { type: number, description: "Max devices (default 50)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_managed_device
|
|
name: intune-get-managed-device
|
|
description: "Get a single managed device by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
device_id: { type: string, description: "Managed device ID" }
|
|
required: [device_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: retire_device
|
|
name: intune-retire-device
|
|
description: "Retire a device (removes company data/management)."
|
|
inputs_schema:
|
|
properties:
|
|
device_id: { type: string, description: "Managed device ID" }
|
|
required: [device_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: wipe_device
|
|
name: intune-wipe-device
|
|
description: "Wipe a device (factory reset — containment)."
|
|
inputs_schema:
|
|
properties:
|
|
device_id: { type: string, description: "Managed device ID" }
|
|
keep_enrollment_data: { type: boolean, description: "Keep enrollment data (default false)" }
|
|
required: [device_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: remote_lock_device
|
|
name: intune-remote-lock-device
|
|
description: "Remotely lock a device."
|
|
inputs_schema:
|
|
properties:
|
|
device_id: { type: string, description: "Managed device ID" }
|
|
required: [device_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: intune-test-connection
|
|
description: "Verify the app credentials (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|