Support  ·  Inventory add-on

Sync devices from Intune and Google

Read the computers, phones, and Chromebooks Intune and Google Workspace know about, and add them to the inventory.

This guide is for the inventory add-on, which is extra on any plan.

If your devices are in Microsoft Intune or Google Workspace, the helpdesk can read them, read-only, every 6 hours. They show up on Inventory, Found devices next to what the network scan finds, and you add them the same way: Add, It’s already in, or Ignore.

Nothing in the inventory changes on its own. When a device has the same serial number (or, for a Chromebook, the same asset ID set in Google) as exactly one item, it’s tied to that item, and the item’s history says so. If neither matches, a computer can also be tied by its name, when exactly one item has that name; phones never are, since so many are called “iPhone”. Everything else waits for you.

What you get

• Intune: the device name, make, model, serial number, Windows, macOS, iOS, or Android version, memory and storage, the primary user, phone number and IMEI for phones, and whether it’s compliant.
• Google: Chromebooks (model, serial number, ChromeOS version, memory, the asset ID and user you set in the Admin console, and the most recent user) and phones and tablets in Google’s endpoint management (model, serial number, OS, and owner).

When you Add one, the form is filled in from it, including fields like Operating system, Memory (GB), Storage (GB), Phone number, and IMEI when the equipment type has them. If its user is in the helpdesk, you can check it out to them in the same step.

On an item’s page, Found by shows each source that knows it. If a source says someone else uses it, or has a different serial number, the page says so, so you can decide which is right.

Setting up Intune (Super Admins)

1. In the Entra admin center, open App registrations. Either use the helpdesk’s Microsoft 365 mail app (if the helpdesk’s mailbox is Microsoft 365), or make a new one, like “Helpdesk inventory”.
2. Under API permissions, add Microsoft Graph, Application permissions, DeviceManagementManagedDevices.Read.All. Then click Grant admin consent.
3. For a new app: under Certificates and secrets, make a client secret and copy its Value. Note the app’s Application (client) ID and Directory (tenant) ID from its overview.
4. In the helpdesk: Inventory, Found devices, Settings, Microsoft Intune. Tick Sync devices from Intune, pick the mail app or fill in the new app’s details, and save.
5. Back on Found devices, click Sync now.

The permission only reads devices. It can’t wipe, lock, or change anything in Intune. A client secret runs out (Entra asks how long when you make it); put the new one in before it does.

Setting up Google (Super Admins)

1. In Google Cloud, make a project (or use one), turn on the Admin SDK API, and make a service account. Under Keys, add a JSON key and download it.
2. In the Google Admin console: Security, Access and data control, API controls, Domain-wide delegation, Add new. Paste the service account’s client ID, and these scopes (the Settings page shows them ready to copy): – https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly – https://www.googleapis.com/auth/admin.directory.device.mobile.readonly
3. In the helpdesk: Inventory, Found devices, Settings, Google Workspace. Tick Sync devices from Google, paste the JSON key, put in a Google Workspace Super Admin’s email (the sync reads devices as them), pick Chromebooks, phones, or both, and save.
4. Click Sync now on Found devices.

Both scopes only read. The key is stored encrypted. Turning a source off forgets its secret or key.

When a sync doesn’t work

The Settings page and the top of Found devices show how the last sync went, in plain words: a missing permission, a secret that ran out, a key Google doesn’t accept. Fix that, then click Sync now. A device that hasn’t checked in for six months is left off.