Create an app registration in Entra

You must create an app registration in Entra that UEM can use to authenticate with Entra.
  • Review the Prerequisites to support Intune app protection.
  • In the UEM management console, on the menu bar, click Settings > External integration > Microsoft Intune. Record the value of the Reply URL. You will use this URL in step 3.
  1. Log in to the Entra portal.
  2. In the section for app registrations, add a new registration.
  3. Specify the following and complete the registration:
    1. Type a name for the registration.
    2. Select which account types can use the application or access the API.
    3. For the redirect URI, click Public client/native (mobile & desktop) and enter the Reply URL from the management console.
  4. Register, then copy the application ID. The application ID is the Client ID that you will register with UEM.
  5. Optionally, to maintain a successful connection to Intune based on the client key, add the following additional application permissions:
    • Microsoft Graph
    • Application permissions
    • Set the following application permissions:
      • Read and write Microsoft Intune apps (DeviceManagementApps > DeviceManagementApps.ReadWrite.All)
      • Read all groups (Group > Group.Read.All)
      • Read all users' basic profile (User > User.ReadBasic.All)

    It is a best practice to add Application permissions instead of Delegated permissions. If you grant Delegated permissions, the connection to Intune requires an update when the Intune administrator's refresh token expires (the token expires on a regular schedule and when the administrator password changes). Application permissions uses the client key for authentication when the administrator's refresh token expires.

  6. Grant administrator consent for all accounts in the current directory.
  7. In the section for managing certificates and secrets, add a new client secret and specify a description and duration.
  8. Copy the Value field of the new client secret (not the Secret ID).
    This is the Client key that you will register with UEM.
Configure BlackBerry UEM to synchronize with Microsoft Intune.