Sam360 integrates with Microsoft Intune to collect comprehensive inventory from Intune-managed Windows devices. The Management Point registers and maintains an Intune PowerShell platform script that runs on the selected schedule.

The integration is configured from the Sam360 Management Point using the Intune setup wizard. The wizard creates a dedicated Sam360 application registration and client secret, requests admin consent for the required Microsoft Graph application permissions, and stores the application credentials locally on the Management Point.

How the Intune Integration Works

On each managed Windows device, the Sam360 Intune script:

• retrieves the Sam360 web scan tool from the Sam360 portal;
• runs a detailed hardware, software, configuration, and security inventory scan; and
• uploads the generated inventory file to Sam360.

Administrator Account Required During Setup

Use the same Microsoft 365 administrator account for both Microsoft sign-in prompts. The account must have either:

• the Global Administrator role; or
• the Privileged Role Administrator role together with either the Application Administrator or Cloud Application Administrator role.

The required roles allow the setup wizard to create the Sam360 application registration and client secret, grant admin consent to the required Microsoft Graph application permissions, and verify that the application credentials work.

Sam360 does not store the administrator's password or interactive sign-in tokens. After setup, the integration runs unattended as the dedicated Sam360 application, using the application client ID and client secret stored on the Management Point.

Microsoft Graph Application Permissions

To create and manage the Intune PowerShell platform script, Sam360 uses a dedicated application in the target Microsoft Entra tenant. The application is configured with the following Microsoft Graph application permissions.

These are application permissions. The integration runs unattended as the Sam360 application identity; it does not run as the setup administrator or as an interactive user.

Before You Start

1. Check that the required PowerShell modules for Intune integration are installed on the Management Point.

   1. Start the Management Point Configuration Tool.
   2. Open the Advanced tab.
   3. Open the Components tab.
   4. Review the module list and the ActionRequired column.
   5. If any required module needs installing or updating, select Update Modules.
   

2. Ensure that the Management Point can make outbound HTTPS connections to the Microsoft endpoints used for authentication and Microsoft Graph.

   Endpoint	Purpose
   login.microsoftonline.com:443	Microsoft identity platform authentication.
   aadcdn.msauth.net:443	Microsoft authentication support content.
   graph.microsoft.com:443	Microsoft Graph and Intune API access.

3. Have one Microsoft 365 administrator account available for both sign-in prompts. The account must be a Global Administrator, or it must have Privileged Role Administrator together with either Application Administrator or Cloud Application Administrator.

Configure the Integration in the Management Point

1. Open the task list

Start the Management Point Configuration Tool and open the Tasks tab.

2. Add the Intune cloud service task

Select Add Task > Cloud Service > Intune.

3. Set the task name and inventory schedule

1. Enter a clear task name and description.
2. Set how often Intune should refresh the Sam360 inventory.
3. Select Set Up Intune Integration.

4. Sign in twice and approve the application permissions

1. At the first Microsoft sign-in prompt, sign in to the target Microsoft 365 tenant with the administrator account described above.
2. Wait while the wizard creates the Sam360 Intune Integration application registration and client secret.
3. When Microsoft's administrator-consent page opens in the default browser, sign in again with the same administrator account if prompted.
4. Confirm that the consent page is for the correct tenant and the Sam360 Intune Integration application.
5. Review the Microsoft Graph application permissions listed above, then select Accept.
6. Return to the setup wizard and leave it running while it verifies the consent and application credentials.

5. Test and save the task

1. When setup completes, confirm that the tenant and client details are populated.
2. Select Test Settings to verify the connection.
3. Select OK to save the task.

After Setup

The Management Point uses the stored application credentials to create and maintain the Sam360 Intune platform script. Intune then runs the script on managed Windows devices according to the refresh interval selected in the task.

Remove the Integration

1. Delete the Intune task from the Management Point Configuration Tool or from the Sam360 portal.
2. In the Microsoft Intune admin center, go to Devices > Scripts and remediations > Platform scripts, then delete the Sam360 Intune Scan Script for the Management Point.
3. In the Microsoft Entra admin center, go to Enterprise applications and delete Sam360 Intune Integration.

Security Notes

• The application client secret remains on the Management Point and is not transmitted to Sam360 servers.
• The Sam360 application and Intune platform script can be disabled or removed at any time.
• Rotate the client secret before expiry and update the Management Point with the new value.