Intune ServiceNow Integration: Architecture, Setup, Use Cases and Troubleshooting

Introduction

Intune ServiceNow integration connects Microsoft Intune endpoint-management data with ServiceNow so that IT teams can use device, software, incident, and configuration information in their existing ITSM and CMDB processes. In a typical enterprise implementation, Microsoft Intune remains responsible for managing endpoints, applications, compliance, and device configuration, while ServiceNow provides the operational layer for incidents, configuration management, service workflows, and IT operations.

There are actually several integration patterns that consultants should distinguish before starting implementation. Microsoft provides a ServiceNow connector that allows Intune administrators to view ServiceNow incidents from the Intune troubleshooting experience. ServiceNow also provides a Service Graph Connector for Microsoft Intune, which imports Intune device and software information into the ServiceNow CMDB. In addition, ServiceNow provides a Microsoft Intune Spoke for IntegrationHub-based automation.

This distinction is important because an organization asking for “Intune ServiceNow integration” may actually need one of three different solutions:

This article focuses on the implementation approach, architecture, authentication, configuration, testing, troubleshooting, and practical considerations involved in these scenarios.

What Is Intune ServiceNow Integration?

Microsoft Intune is Microsoft’s cloud-based endpoint management platform. It manages devices, applications, configuration policies, compliance information, and other endpoint-management capabilities.

ServiceNow is commonly used as the enterprise IT service-management and configuration-management platform.

The integration allows information to move between these platforms instead of forcing service-desk engineers to manually search multiple systems.

A simplified architecture looks like this:

                 Microsoft Entra ID
                        |
                  OAuth 2.0
                        |
                        v
Microsoft Intune ---> Microsoft Graph API
                        |
                        |
              ServiceNow Integration Layer
                  /          |          \
                 /           |           \
                v            v            v
        Service Graph     Intune       Native
         Connector        Spoke       Connector
                |            |            |
                v            v            v
              CMDB       Automation    Incidents
                |
                v
        ITSM / ITOM / SAM

The important point is that Microsoft Graph is generally the API layer used for Intune data, while ServiceNow provides different integration mechanisms depending on the business requirement.

For example, the Service Graph Connector for Microsoft Intune is designed to pull mobile devices, computers, and software applications into the ServiceNow CMDB. ServiceNow documents Microsoft Intune Graph API v1.0 as a supported API for the connector.

Key Integration Components

A consultant should understand the role of each component before beginning configuration.

Microsoft Intune

Intune is the source system for endpoint-management information.

Typical information includes:

• Managed devices
• Device operating system
• Device ownership
• Device compliance
• Primary user
• Installed or managed software
• Device identifiers
• Device management state

Microsoft Graph API

Microsoft Graph provides the API interface used by integration components to access Microsoft 365 and Intune data.

For ServiceNow’s Service Graph Connector, the connection uses OAuth credentials and Microsoft Graph permissions.

Microsoft Entra ID

Microsoft Entra ID provides application registration and OAuth authentication.

A typical application registration contains:

• Client ID
• Client secret
• Tenant ID
• API permissions
• Token endpoint

ServiceNow CMDB

The CMDB stores configuration items representing managed infrastructure and endpoint assets.

The Service Graph Connector maps Intune information into appropriate CMDB classes rather than simply dumping raw API responses into arbitrary tables. ServiceNow documents targeted CMDB classes and Intune data sources for this purpose.

Service Graph Connector

The Service Graph Connector for Microsoft Intune is appropriate when the primary objective is bringing Intune device and software information into ServiceNow CMDB.

Microsoft Intune Spoke

The Microsoft Intune Spoke is appropriate when the requirement involves performing Intune-related actions from ServiceNow workflows. ServiceNow documents this as an IntegrationHub capability and requires an IntegrationHub subscription.

Real-World Integration Use Cases

Use Case 1 – Populate CMDB with Intune Devices

Suppose a company has 25,000 Windows laptops managed through Intune.

The ServiceNow CMDB team wants every managed laptop represented as a configuration item.

Without integration, administrators may have to maintain asset information manually.

With the Service Graph Connector:

Intune
   |
   | Microsoft Graph
   v
Service Graph Connector
   |
   v
Robust Transform Engine
   |
   v
ServiceNow CMDB

ServiceNow can then use these CIs in ITSM and ITOM processes.

For example, when an employee raises an incident against a laptop, the service desk can associate the incident with the corresponding CI.

Use Case 2 – Service Desk Troubleshooting

Consider an employee reporting:

“My corporate laptop cannot connect to the VPN.”

The service desk engineer opens the user’s troubleshooting information in Intune.

With the Microsoft-supported ServiceNow connector configured, the engineer can view associated ServiceNow incidents from the Intune troubleshooting experience. Microsoft documents the ability to authenticate the help-desk operator and display incidents associated with the selected user.

This is particularly useful when the user has reported the same issue several times.

Use Case 3 – Automated Device Operations

Suppose an organization wants the following process:

Employee leaves company
        |
        v
HR / Identity workflow
        |
        v
ServiceNow request
        |
        v
IntegrationHub
        |
        v
Microsoft Intune
        |
        v
Device/application action

Instead of manually opening Intune, the ServiceNow workflow can invoke appropriate Intune actions through the Microsoft Intune Spoke.

This approach is useful when endpoint management becomes part of a larger enterprise workflow.

Architecture and Technical Flow

There are two important architecture patterns.

Pattern 1 – Intune to ServiceNow CMDB

Microsoft Intune
       |
       v
Microsoft Graph API
       |
       v
OAuth 2.0
       |
       v
Service Graph Connector
       |
       v
Robust Transform Engine
       |
       v
ServiceNow CMDB

The connector periodically retrieves information from Intune and transforms it into ServiceNow CMDB data.

ServiceNow identifies device, software, and related information according to the connector’s supported data model.

Pattern 2 – ServiceNow to Intune

For automation:

ServiceNow Business Rule / Flow
             |
             v
IntegrationHub
             |
             v
Microsoft Intune Spoke
             |
             v
Microsoft Graph API
             |
             v
Microsoft Intune

This is fundamentally different from simply importing CMDB data.

The first pattern is primarily data synchronization.

The second pattern is primarily process automation.

Prerequisites

Before starting implementation, confirm the following.

Microsoft prerequisites

You normally need:

• Microsoft Intune environment
• Microsoft Entra ID
• Permission to register an application
• Microsoft Graph API permissions
• Tenant ID
• Client ID
• Client secret
• Appropriate Intune administrator access

For the Service Graph Connector, ServiceNow specifically documents Microsoft Graph permissions such as DeviceManagementManagedDevices.Read.All and other permissions depending on the selected data sources.

Do not blindly assign every available Graph permission.

Use the minimum permissions required by the selected integration scope.

ServiceNow prerequisites

Depending on the architecture:

• ServiceNow instance
• Service Graph Connector for Microsoft Intune
• IntegrationHub subscription if using the Intune Spoke
• Appropriate ServiceNow roles
• CMDB configured
• Required ITOM subscription where applicable
• OAuth credential configuration

The Service Graph Connector documentation notes that its newer setup uses SGC Central, while the older guided setup method is deprecated from connector version 2.7.0 onward.

Step-by-Step Build Process

Step 1 – Decide the Integration Objective

Before touching configuration, document exactly what the integration must accomplish.

For example:

Requirement:
Import Windows and mobile devices from Intune into CMDB.

Data required:
- Device name
- Serial number
- Operating system
- User
- Compliance status
- Device identifier

Frequency:
Scheduled synchronization

Target:
ServiceNow CMDB

This prevents the common mistake of installing an integration first and defining requirements afterward.

Step 2 – Register an Application in Microsoft Entra ID

Create an application registration in Microsoft Entra ID.

Capture:

• Application/client ID
• Directory/tenant ID
• Client secret
• Token URL

The application becomes the identity used by ServiceNow when requesting access tokens.

A conceptual token flow is:

ServiceNow
   |
   | Client ID + Secret
   v
Microsoft Entra ID
   |
   | Access Token
   v
Microsoft Graph

Keep the client secret in a secure credential store.

Do not place it directly in scripts, Flow Designer actions, or configuration files.

Step 3 – Assign Microsoft Graph Permissions

Open the application registration and add the Microsoft Graph permissions required by the connector.

The exact permissions depend on which Intune information you plan to retrieve.

For example, the Service Graph Connector documentation identifies:

DeviceManagementManagedDevices.Read.All

as an application permission used for accessing managed-device information.

After assigning permissions, complete administrator consent where required.

Consultant Tip

Do not design permissions around what is technically possible.

Design them around what the business process actually requires.

If CMDB only needs managed-device information, avoid granting unrelated write permissions.

Step 4 – Install the Service Graph Connector

In ServiceNow, install the Service Graph Connector for Microsoft Intune from the ServiceNow Store.

ServiceNow’s current documentation directs implementations toward SGC Central for configuring the connector.

After installation, verify:

• Application installed successfully
• Required dependencies available
• Correct connector version
• Subscription requirements
• Appropriate roles assigned

ServiceNow documentation currently identifies version-specific connector behavior, so consultants should verify the connector release against their ServiceNow instance before implementation.

Step 5 – Configure the Connection

Navigate to the Service Graph Connector configuration area.

Depending on the ServiceNow release and installed application, use:

Service Graph Workspace → Service Graph Connector / SGC Central → Microsoft Intune

Create or configure the connection.

Typical values include:

For the global Microsoft Graph environment, ServiceNow documents https://graph.microsoft.com as the connection URL.

Step 6 – Select the Appropriate Data Sources

Do not automatically import everything.

The connector supports different Intune data sources, including device and software-oriented sources. ServiceNow also documents advanced report-based data sources.

A practical implementation might start with:

SG-Intune Computer
SG-Intune Devices
SG-Intune Software

Then add additional data sources only when there is a clear reporting or operational requirement.

Step 7 – Configure User Matching

User matching becomes important when device ownership needs to be represented accurately.

For example:

Intune UPN:
john.smith@company.com

ServiceNow User:
john.smith@company.com

If ServiceNow cannot match the user, the CI may exist correctly but lack the expected ownership relationship.

Recent Service Graph Connector updates include configuration options for matching users using UPN or email address.

Step 8 – Configure Primary User Information Carefully

Some implementations need the primary user assigned to a device.

ServiceNow provides a connection property for retrieving primary-user details.

However, retrieving additional user information can increase API calls and import time.

This is a good example of an implementation trade-off:

More data
   ↓
More API calls
   ↓
Longer import
   ↓
Potentially better CI ownership information

Do not enable additional enrichment simply because the option exists.

Step 9 – Configure the Import Schedule

Define when synchronization should occur.

For example:

The correct frequency depends on how quickly device information changes and how heavily the integration consumes API resources.

For CMDB purposes, there is often little value in synchronizing every few minutes if device attributes change only occasionally.

Alternative: Configure the Microsoft Intune Spoke

If the requirement is workflow automation rather than CMDB population, use the Microsoft Intune Spoke.

ServiceNow documents the following basic setup approach:

All → System OAuth → Application Registry

Register the Microsoft Intune OAuth information.

Then configure the connection under:

All → Connections & Credentials → Connections & Credentials Aliases

Create the Microsoft Intune connection and use:

Connection URL:
https://graph.microsoft.com

API version:
v1.0

ServiceNow documents this configuration for the Microsoft Intune Spoke.

A typical Flow Designer process could then look like:

Service Request Created
        |
        v
Validate User
        |
        v
Identify Device
        |
        v
Microsoft Intune Action
        |
        v
Update ServiceNow Request
        |
        v
Close / Continue Workflow

Testing the Integration

Testing should be performed in stages rather than immediately testing the complete business workflow.

Test 1 – Authentication

Confirm that:

• Client ID is correct
• Secret is valid
• Tenant ID is correct
• Token endpoint is correct
• Graph permissions are granted

Expected result:

Access token successfully generated

Test 2 – Graph API Access

Test a read-only managed-device API operation.

Expected result:

HTTP 200
Device data returned

If you receive 401, investigate authentication.

If you receive 403, investigate permissions and administrator consent.

Test 3 – ServiceNow Connection

Run the connector’s connection/test process.

Expected result:

Connection successful
Authentication successful
API accessible

Test 4 – Import One Data Set

Do not begin by loading the entire enterprise CMDB.

Start with a controlled data set.

For example:

5–10 test devices

Validate:

• Device name
• Serial number
• Manufacturer
• Model
• Operating system
• User
• Intune identifier
• CI class
• Relationships

Test 5 – Validate CMDB

After import, open the resulting configuration items in ServiceNow.

Check whether the same physical device has created multiple CIs.

This is critical.

A technically successful API import can still produce a poor CMDB if identification rules are not correct.

Common Errors and Troubleshooting

1. HTTP 401 Unauthorized

Common causes:

• Invalid client secret
• Incorrect tenant
• Wrong token URL
• Expired secret
• Incorrect OAuth configuration

Check the Entra application first.

2. HTTP 403 Forbidden

Usually investigate:

• Missing Microsoft Graph permission
• Administrator consent not granted
• Wrong application permission type
• Insufficient ServiceNow configuration

Do not immediately regenerate credentials.

First verify the permission model.

3. Authentication Works but No Devices Appear

Possible causes include:

• Incorrect API endpoint
• Incorrect data source
• No matching Intune data
• Connector filters
• Import job failure
• Graph permissions insufficient for the selected data source

Start by testing the Graph API independently.

4. Devices Are Imported but Users Are Missing

This usually indicates a user-matching or enrichment problem.

Check:

• UPN
• Email address
• ServiceNow user record
• Primary-user configuration
• User lookup configuration

A device can successfully exist in CMDB even when its user relationship is incomplete.

5. Duplicate Configuration Items

This is one of the most important CMDB issues.

Example:

Laptop ABC123
    |
    +-- CI #1
    +-- CI #2
    +-- CI #3

Instead of importing more data, investigate identification and reconciliation.

The objective is:

One physical device
       ↓
One authoritative CI

6. Slow Import Performance

Possible causes:

• Too many data sources
• Excessive user enrichment
• Large device population
• API throttling
• Inefficient import schedule
• Excessive transformations

Start by measuring each stage instead of simply increasing execution frequency.

7. Connector Configuration Doesn’t Match Documentation

This is increasingly relevant because ServiceNow connector versions evolve.

For example, ServiceNow’s current documentation states that guided setup is deprecated from Service Graph Connector version 2.7.0 and recommends SGC Central instead.

Therefore, always check the documentation for the actual connector version installed in the target instance.

Best Practices

1. Define the business outcome first

Do not begin with:

“We need Intune integration.”

Begin with:

“We need Intune-managed laptops represented as ServiceNow CIs so incidents can be associated with accurate endpoint information.”

That produces a much clearer technical design.

2. Use least-privilege access

Grant only the Microsoft Graph permissions required for the integration.

3. Protect client secrets

Store secrets using ServiceNow credential mechanisms or equivalent secure secret storage.

Never hard-code secrets in:

• Scripts
• Flow Designer
• Business Rules
• Integration configuration
• Source-control repositories

4. Separate CMDB integration from workflow automation

Do not use one integration pattern for every requirement.

Use:

Service Graph Connector

when the objective is CMDB data ingestion.

Use:

Microsoft Intune Spoke

when the objective is ServiceNow-driven Intune automation.

Use the Microsoft Intune ServiceNow connector when the requirement is primarily viewing ServiceNow incidents within Intune’s troubleshooting experience.

5. Start with a pilot

A practical rollout might be:

Development
   ↓
10 test devices
   ↓
100 devices
   ↓
One business unit
   ↓
Production rollout

This allows identification and reconciliation issues to be resolved before the CMDB becomes polluted.

6. Monitor data quality, not just integration status

A green connection does not necessarily mean a successful implementation.

Track:

• Import success rate
• Failed records
• Duplicate CIs
• Missing users
• Stale devices
• API failures
• Reconciliation issues

7. Document ownership

Clearly define:

This avoids the common problem where every team assumes another team owns integration failures.

Frequently Asked Questions

What is Intune ServiceNow integration used for?

It can be used for several purposes, including bringing Intune-managed devices and software into the ServiceNow CMDB, viewing ServiceNow incidents from Intune troubleshooting, and automating Intune operations through ServiceNow IntegrationHub. The appropriate integration method depends on the business requirement.

Does ServiceNow use Microsoft Graph for Intune integration?

Yes. ServiceNow’s Service Graph Connector for Microsoft Intune uses Microsoft Graph to retrieve Intune information, with OAuth credentials and appropriate Microsoft Graph permissions.

What is the difference between the Service Graph Connector and Microsoft Intune Spoke?

The Service Graph Connector is primarily designed to bring Intune device and software information into ServiceNow CMDB. The Microsoft Intune Spoke is designed for ServiceNow automation and actions involving devices and applications in Intune.

Summary

Intune ServiceNow integration is not a single configuration. It is a set of integration patterns designed for different enterprise requirements.

For CMDB visibility, the Service Graph Connector for Microsoft Intune provides a structured way to bring Intune-managed device and software information into ServiceNow. For workflow automation, the Microsoft Intune Spoke allows ServiceNow processes to interact with Intune through IntegrationHub. For help-desk troubleshooting, Microsoft’s ServiceNow connector allows ServiceNow incidents associated with users to be viewed from the Intune troubleshooting experience.

The most important implementation lesson is to design the data model and business process before configuring authentication. A successful OAuth connection is only the beginning. The real implementation work involves permissions, data mapping, user matching, CI identification, reconciliation, scheduling, security, monitoring, and operational ownership.

Because this article is focused on ServiceNow and Microsoft Intune rather than Oracle Fusion Cloud, the Oracle Fusion 26A release documentation does not define the Intune integration itself. Oracle’s 26A documentation remains relevant when Intune/ServiceNow processes are part of a wider Oracle Fusion architecture, while Microsoft and ServiceNow documentation should be treated as the authoritative sources for this integration.

For broader Oracle Cloud reference material, see Oracle Cloud Applications documentation. For an unrelated Oracle HCM Time and Labor reference, the current documentation is available in the Oracle Fusion Cloud Human Resources – Implementing Time and Labor guide. The 26A Time and Labor documentation also contains the current 26A feature information.

For the Intune-specific implementation, always validate the installed ServiceNow connector version and follow the current Microsoft Intune and ServiceNow documentation because connector capabilities and setup procedures can change between releases.