Agentbeamdocs

Start here

MDM / Getting startedDevice managementOne place to understand your Apple and Windows fleet, deliver configuration, and request device actions.MDM / Getting startedSet up your workspaceRequest MDM access, check platform readiness, and get your first managed device into inventory.Agent CLI / Getting startedAgent CLI overviewUnderstand agent activity locally, scan the files your assistants use, and connect shared workspace controls when needed.Agent CLI / Getting startedCLI quickstartInstall Beam, capture a first event, and open your local activity dashboard.Agent CLI / Getting startedConnect a workspacePair your machine through the browser or an enrollment code, then verify identity and policy synchronization.
↑ ↓ to navigate · Enter to openEsc to close
Website Open dashboard
Device management/Connections
Connections

Microsoft Intune

Connect an existing Intune tenant for inventory, compliance, encryption visibility, and optional device sync.

On this page

The Intune connection is for devices you already manage in Intune. Beam reads supported Apple and Windows inventory and optionally requests sync. Enrollment, policy creation, app installation, lock, retire, and wipe remain outside this integration. Only the Microsoft global cloud is supported.

Prepare a dedicated connection

Verify ownership of the tenant and Beam workspace. One Intune tenant maps to exactly one Beam workspace. Beam does not partition tenant inventory using Intune scope tags.

An operator registers an application in the customer's Microsoft Entra tenant with Microsoft Graph application permission DeviceManagementManagedDevices.Read.All and administrator consent. Record the tenant ID, client ID, and client secret value, not the secret ID. Keep credentials server-side.

Configure the dashboard server

Set BEAM_MDM_INTUNE_CONNECTIONS in the dashboard secret manager:

Code
[
  {
    "orgId": "BEAM_WORKSPACE_ID",
    "tenantId": "00000000-0000-4000-8000-000000000001",
    "clientId": "00000000-0000-4000-8000-000000000002",
    "clientSecret": "REPLACE_IN_SECRET_MANAGER",
    "enableSync": false
  }
]

Restart or redeploy Dashboard v1. Duplicate tenant or workspace mappings invalidate configuration. Do not use a NEXT_PUBLIC_ variable or commit credentials. There is no browser credential-entry form for this connection.

Open Device management with an authorized role and compare returned names, OS versions, compliance, encryption, and last check-in against Intune. Inventory is read live, limited to ten provider pages, and marked partial when truncated.

Enable optional sync

Sync requires an additional Graph application permission: DeviceManagementManagedDevices.PrivilegedOperations.All. This provider permission is broader than sync, even though Beam exposes only sync. Use a dedicated application and monitor its credentials.

After granting administrator consent, set enableSync to true and redeploy. Owners and administrators can request sync. Beam records intent and outcome and applies a rolling 60-second per-device cooldown across operators. There is no automatic mutation retry.

Verify and maintain

A successful sync response acknowledges the request, not a completed device check-in. Refresh and verify a later check-in in Intune. For a timeout, inspect provider state before trying again.

Rotate credentials before expiry. Remove the connection mapping and redeploy to disconnect the workspace; revoke application consent when provider access should end. Disconnection does not unenroll devices. Unknown encryption or compliance remains unknown, and reported encryption is not recovery-key escrow.

Keep exploring

Explore the docs