Service Graph Connector for Microsoft Intune - Add a custom field

[Palani Chockali]

In this example, we will be adding a field from Intune device pull called 'chassisType' and map it to 'Chassis type'(chassis_type) in the 'cmdb_ci_handheld_computing' class in CMDB. 

Changes to the data stream action:

1. Open up Flow Designer
2. Find out which data stream action is being called in the SG-Intune Devices data source. In this case, it will be 'mobiledevices'
3. Open up the 'mobiledevices' action
4. Click on 'Script Parser step' section
5. Add the following line to the bottom of the script:
outputs.targetObject.chassisType = record.chassisType;
6. Click on 'Outputs' section
7. Click on 'Edit Outputs' for editing
8. Click on the arrow on the left to expand the targetObject
9. Click on the '+' sign on the top right of the targetObject to create another item under there
9. Add the following record to the object:
   Label: chassisType
   Name: chassisType
   Type: String
10. Save the action
11. Run a 'Test' to test the changes
12. Click on 'Your test has finished running. View the action execution details' to see the output
13. Click on 'mobiledevices Data Stream' to see the details
14. Click on the 'Outputitems' under the Output data
15. You must see the 'chassisType' in the payload with a value
16. If there are no issues and the data got pulled in, click 'Publish' to publish the action

Changes to mapping using IH-ETL:

1. Open up IH-ETL application and select 'SG-Intune Devices'
2. Click on the down arrow and do a 'Auto pull a new import set' and click 'Save'
3. Wait for a few seconds so it populates the drop down with a new import set
5. Click 'Mark as Complete'
6. Click on 'Preview and Prepare Data'
7. If you are not seeing the new column, try to repeat steps 2-6 couple of times for it to take effect
8. Click 'Mark as Complete'
9. Select 'Select CMDB Classes to Map Source Data'
10. Click on 'Edit Mapping' under 'Handheld Computing Device 1' entity which is the
     'cmdb_ci_handheld_computing' class that we want to target
11. Click on 'Add Attribute' at the top to add a CMDB class field to the map
12. Choose 'Chassis Type' from the drop down list and hit 'Save'
13. This newly added class column will show up at the bottom, ready to be mapped
14. Pick the 'u_chassistype' from the data on the right and drop it in the 'Source Column' for Chassis type
     to map it
15. Click the browser back button and click 'Mark as Complete'
16. Click on 'Add Relationsips' and mark that as complete as we are not adding any new relationships
17. Click on 'Test and Rollback Integration Results'
18. Click on 'Run Integtration'
19. You must see the new column called 'Chassis type' in the output under the
     'Handheld Computing Device' tab
20. If you cannot see it in this output, you can go to the table listing and verify if the column got
     populated by doing 'cmdb_ci_handheld_computing.list'

You are done mapping a custom field from Intune to CMDB.

Note:
There is an attachment which captures some screen shots to illustrate this process

IntuneCustomMapping.docx

[Loic Fournier]

@Palani Chockalingam  Thank you a lot for your information

I would like to know if you find a way to extract hardware information it seems to be a sublayer of fields that are inside intune but i don't know how to extract this with the flow designer

If you see below the microsoft Graph Schema we can see that there is Hardware Information and below we can get Ram Info and other interesting value like the domain for computer. Do you know how to get these fields ? 

{
"@odata.type": "#microsoft.graph.windowsManagedDevice",
"id": "String (identifier)",
"userId": "String",
"deviceName": "String",
"hardwareInformation": {
"@odata.type": "microsoft.graph.hardwareInformation",
"serialNumber": "String",
"totalStorageSpace": 1024,
"freeStorageSpace": 1024,
"imei": "String",
"meid": "String",
"manufacturer": "String",
"model": "String",
"phoneNumber": "String",
"subscriberCarrier": "String",
"cellularTechnology": "String",
"wifiMac": "String",
"operatingSystemLanguage": "String",
"isSupervised": true,
"isEncrypted": true,
"batterySerialNumber": "String",
"batteryHealthPercentage": 1024,
"batteryChargeCycles": 1024,
"isSharedDevice": true,
"sharedDeviceCachedUsers": [
{
"@odata.type": "microsoft.graph.sharedAppleDeviceUser",
"userPrincipalName": "String",
"dataToSync": true,
"dataQuota": 1024,
"dataUsed": 1024
}
],
"tpmSpecificationVersion": "String",
"operatingSystemEdition": "String",
"deviceFullQualifiedDomainName": "String",
"deviceGuardVirtualizationBasedSecurityHardwareRequirementState": "String",
"deviceGuardVirtualizationBasedSecurityState": "String",
"deviceGuardLocalSystemAuthorityCredentialGuardState": "String",
"osBuildNumber": "String",
"operatingSystemProductType": 1024,
"ipAddressV4": "String",
"subnetAddress": "String",
"esimIdentifier": "String",
"systemManagementBIOSVersion": "String",
"tpmManufacturer": "String",
"tpmVersion": "String"
},
"ownerType": "String",
"managedDeviceOwnerType": "String",
"deviceActionResults": [
{
"@odata.type": "microsoft.graph.deviceActionResult",
"actionName": "String",
"actionState": "String",
"startDateTime": "String (timestamp)",
"lastUpdatedDateTime": "String (timestamp)"
}
],
"managementState": "String",
"enrolledDateTime": "String (timestamp)",
"lastSyncDateTime": "String (timestamp)",
"chassisType": "String",
"operatingSystem": "String",
"deviceType": "String",
"complianceState": "String",
"jailBroken": "String",
"managementAgent": "String",
"osVersion": "String",
"easActivated": true,
"easDeviceId": "String",
"easActivationDateTime": "String (timestamp)",
"aadRegistered": true,
"azureADRegistered": true,
"deviceEnrollmentType": "String",
"lostModeState": "String",
"activationLockBypassCode": "String",
"emailAddress": "String",
"azureActiveDirectoryDeviceId": "String",
"azureADDeviceId": "String",
"deviceRegistrationState": "String",
"deviceCategoryDisplayName": "String",
"isSupervised": true,
"exchangeLastSuccessfulSyncDateTime": "String (timestamp)",
"exchangeAccessState": "String",
"exchangeAccessStateReason": "String",
"remoteAssistanceSessionUrl": "String",
"remoteAssistanceSessionErrorDetails": "String",
"isEncrypted": true,
"userPrincipalName": "String",
"model": "String",
"manufacturer": "String",
"imei": "String",
"complianceGracePeriodExpirationDateTime": "String (timestamp)",
"serialNumber": "String",
"phoneNumber": "String",
"androidSecurityPatchLevel": "String",
"userDisplayName": "String",
"configurationManagerClientEnabledFeatures": {
"@odata.type": "microsoft.graph.configurationManagerClientEnabledFeatures",
"inventory": true,
"modernApps": true,
"resourceAccess": true,
"deviceConfiguration": true,
"compliancePolicy": true,
"windowsUpdateForBusiness": true,
"endpointProtection": true,
"officeApps": true
},
"wiFiMacAddress": "String",
"deviceHealthAttestationState": {
"@odata.type": "microsoft.graph.deviceHealthAttestationState",
"lastUpdateDateTime": "String",
"contentNamespaceUrl": "String",
"deviceHealthAttestationStatus": "String",
"contentVersion": "String",
"issuedDateTime": "String (timestamp)",
"attestationIdentityKey": "String",
"resetCount": 1024,
"restartCount": 1024,
"dataExcutionPolicy": "String",
"bitLockerStatus": "String",
"bootManagerVersion": "String",
"codeIntegrityCheckVersion": "String",
"secureBoot": "String",
"bootDebugging": "String",
"operatingSystemKernelDebugging": "String",
"codeIntegrity": "String",
"testSigning": "String",
"safeMode": "String",
"windowsPE": "String",
"earlyLaunchAntiMalwareDriverProtection": "String",
"virtualSecureMode": "String",
"pcrHashAlgorithm": "String",
"bootAppSecurityVersion": "String",
"bootManagerSecurityVersion": "String",
"tpmVersion": "String",
"pcr0": "String",
"secureBootConfigurationPolicyFingerPrint": "String",
"codeIntegrityPolicy": "String",
"bootRevisionListInfo": "String",
"operatingSystemRevListInfo": "String",
"healthStatusMismatchInfo": "String",
"healthAttestationSupportedStatus": "String"
},
"subscriberCarrier": "String",
"meid": "String",
"totalStorageSpaceInBytes": 1024,
"freeStorageSpaceInBytes": 1024,
"managedDeviceName": "String",
"partnerReportedThreatState": "String",
"retireAfterDateTime": "String (timestamp)",
"usersLoggedOn": [
{
"@odata.type": "microsoft.graph.loggedOnUser",
"userId": "String",
"lastLogOnDateTime": "String (timestamp)"
}
],
"preferMdmOverGroupPolicyAppliedDateTime": "String (timestamp)",
"autopilotEnrolled": true,
"requireUserEnrollmentApproval": true,
"managementCertificateExpirationDate": "String (timestamp)",
"iccid": "String",
"udid": "String",
"roleScopeTagIds": [
"String"
],
"windowsActiveMalwareCount": 1024,
"windowsRemediatedMalwareCount": 1024,
"notes": "String",
"configurationManagerClientHealthState": {
"@odata.type": "microsoft.graph.configurationManagerClientHealthState",
"state": "String",
"errorCode": 1024,
"lastSyncDateTime": "String (timestamp)"
},
"configurationManagerClientInformation": {
"@odata.type": "microsoft.graph.configurationManagerClientInformation",
"clientIdentifier": "String",
"isBlocked": true
},
"ethernetMacAddress": "String",
"physicalMemoryInBytes": 1024,
"processorArchitecture": "String",
"specificationVersion": "String",
"joinType": "String",
"skuFamily": "String",
"skuNumber": 1024,
"managementFeatures": "String",
"chromeOSDeviceInfo": [
{
"@odata.type": "microsoft.graph.chromeOSDeviceProperty",
"name": "String",
"value": "String",
"valueType": "String",
"updatable": true
}
],
"enrollmentProfileName": "String"
}

[Community Alums]

Hi Loic,

Basically, follow Palani's actions above, and add a new line to the script, and one output for each piece of hardware data you require.

So, for example, add this line into the script and create a matching 'totalStorageSpace' output:

outputs.targetObject.totalStorageSpace= record.hardwareInformation.totalStorageSpace;

Then, you need to process / map the new totalStorageSpace field in the ETL, after pulling a new Import Set.

Note, that in the MS Graph Intune data that I'm pulling, totalStorageSpaceInBytes appears in the 'main' record, so I wouldn't need need to traverse the hardwareInformation list for this info.

I hope that this helps? Please mark as helpful, if so - thanks.

[Jayesh Mohan3]

@Palani Chockali  - Are the steps similar for adding new fields to the Jamf action. One issue that I am seeing is that new fields added don't show up in the 'Preview and prepare' stage even after tried 'Auto pull import set'.

[Vini]

Hi @Palani Chockali 

Thank you so much for document, I am able to pull custom attribute [SkuFamily] from Intune integration.

My customer is looking for  UserID and lastLogOnDateTime from Intune and we could see this information from JSON output but not able to parse these values in ServiceNow attributes because these are part of an array (usersLoggedOn).

Ex#

            "usersLoggedOn": [

                {

                    "userId": "b225eee8-b81c-4c44-9b06-c0eeff8d3b0e",

                    "lastLogOnDateTime": "2023-03-01T01:30:57.35Z"

                }

Can you please provide inputs to bring these values from array

@Community Alums @Loic Fournier 

#intune integration, #intune

Regards,

Vini.

[Community Alums]

Hi @Vini ,

In the Intune 'mobiledevices' and 'computers' Actions, I did this:

//Parse the most recent logged in user

var usersLoggedOn = record.usersLoggedOn;

var maxDate = '0';

var userId = '';

for (x=0;x < usersLoggedOn.length;x++) {

   if (usersLoggedOn[x].lastLogOnDateTime > maxDate) {

      maxDate = usersLoggedOn[x].lastLogOnDateTime;

      userId = usersLoggedOn[x].userId;

   }

}

outputs.targetObject.usersLoggedOn = userId;

Make sure you also create a targetObject.usersLoggedOn output 🙂

usersLoggedOn will now appear in your Import Sets, and you can perform user record lookups using transforms in the ETL.

Please mark as helpful, if it helped.

[Jacopo Carraro]

Hi @Community Alums ,

Thank you for your explanation. I am having the same issue or similar to Vini.

A quick question about your solution:

In which part of the flow action did you add your script?

Would I then follow the same process Palani described to add the mapping between the two?

I am a bit confused as of how the two fields are mapped on the instance; for example, if I want to map an Intune field called "last check in" with another field on the CMDB, how would I approach it? Or would this mapping create a new one for me?

My apologies if the questions aren't as clear, this is the first time i am setting up the intune connector, and I have got multiple requirements to map additional fields.

Thank you very much everyone for your help and thank you @Palani Chockali for the amazing guide.

Regards,

Jacopo

[Community Alums]

Hi Jacopo,

You need to add the script in the 'Script Parser step' in the flow Action.

And, yes, absolutely, then you would follow the same process Palani described to add the mapping.

Once you have mapped the value coming from Intune to an 'outputs.targetObject' variable, the variable will appear in your Import Set (you may need to view the XML on a record to see the field).

When you can see the field in your Import Set, then you can map it in the ETL - Palani's step-by-step instructions will help, there.

I don't see a 'last check-in' field in Intune. I use 'lastSyncDateTime' to indicate the last time that Intune refreshed the device data, and the 'userLoggedOn' value to determine who last used the device (this is a pretty specific use case, because multiple users could log into these particular devices).

I hope that this helps - please mark as helpful, if so.

Thanks,

Jason

[Mark Tuffey]

I do not see/get the "+Create Output" button on the Outputs step. Any idea why?

Cheers

Mark

[Menno Aret1]

@Palani Chockali Thanks for sharing!

For anyone wondering why the import is not creating the additional field in the Data Source table make sure that System Property "glide.import_set_row.dynamically_add_fields" is set on "true" otherwise the fields will not be created.

[mb27]

Our users want "Last Check in date" to appear on CIs.

I added this line to the Script Parser step:

   outputs.targetObject.lastCheckIn = record.lastCheckIn;  

However, when I run Test, i get Null value back:

  "id": "6e8b2561-92f2-4e3f-923a-18fd6383b207",
            "isEncrypted": "false",
            "isSupervised": "false",
            "jailBroken": "Unknown",
            "lastCheckIn": null,
            "lastSyncDateTime": "2023-11-06T13:03:54Z",
            "managedDeviceOwnerType": "company",
            "managementAgent": "mdm",
            "manufacturer": "Microsoft Corporation",
            "model": "Cloud PC Enterprise 2vCPU/8GB/128GB",
            "operatingSystem": "Windows",



What am I doing wrong?

My previous post on this subject seems to have disappeared.