Azure AD & Intune Connectors - Best Practice

Modified on Thu, 22 Jan at 1:31 PM

TABLE OF CONTENTS

Configuring Azure AD and Intune Connectors for User-Device-App Linkage

Install both the Azure AD and Intune connectors to enable creation of user-device-app links.

Configure the Azure AD connector with the following options:

Create and Update Users:
Enables creation and update of user objects. For user migrations, obtain an Intune group as required.
Create and Update Devices:
Allows creation and update of device objects.
Application Update Options:
Enables app linkage based on assignment groups. The deployment group must be specified in each application. Note that the Intune connector will create links based on application installations (rather than group membership), which is generally recommended.

Configure the Intune connector with the following settings:

Import Managed Applications:
Set to Yes to import managed apps.
Import Discovered Applications:
Optionally enable to import applications found in the "Add/Remove Programs" area. This is optional and may generate a large volume of application records.
Import Devices:
The Azure AD connector will create devices found in Intune. If the on-premises AD connector is also in use and devices are hybrid joined, it will ensure these are created. For devices managed only via modern management, enable this option. You may also use a hostname filter to restrict import to devices managed only in Intune.
Update Devices:
Set to Yes to add additional information such as hardware details and last seen dates, which are not available from Azure AD.
Mapping Rules:
Enable mapping rules to use application installation status to link users and devices:
- Use Device Install Status:
  Links applications, devices, and users. Recommended option (Link Apps-Devices-Users).
- Use User Install Status:
  Creates App-User links for applications assigned to a user; devices are not included. Recommended only for scenarios where apps are user-assigned (Link Apps-Users).

In the Devices module, navigate to the Details tab and enable the following fields to assist with troubleshooting: