Skip to content
MDO Documentation

Getting started

MDO connects to a tenant through Microsoft admin consent to MDO’s app. You don’t create an app registration or a client secret for this. MDO then reads the tenant’s Intune data through Microsoft Graph.

Before you start

Section titled “Before you start”
  • A Microsoft 365 tenant with Intune.
  • Someone who can grant admin consent in that tenant: a Global Administrator or a Privileged Role Administrator.
  • An MDO account. MDO is in private beta. Once your early access request is approved, sign in at app.moderndeviceops.com with your work account.

Step 1: Open the onboarding wizard

Section titled “Step 1: Open the onboarding wizard”

When your organisation has no tenant connected yet, MDO opens the onboarding wizard after you sign in. To connect another tenant later, open the tenant switcher in the sidebar and choose Connect another tenant.

Click Connect a tenant to start.

Section titled “Step 2: Grant consent”
  1. Optionally enter a Friendly name for the tenant.
  2. Click Grant permissions. Microsoft’s admin consent page opens.
  3. The administrator signs in to the tenant being connected and accepts.

The wizard lists what you are agreeing to under MDO will be able to:

  • Read Intune apps, policies, scripts, enrollment and Autopilot settings, devices and their compliance status, and your organization’s name.
  • Read users, groups and assignment filters, so you can choose who gets what, and Intune’s audit log, to show who changed a policy.
  • Create, change and delete Intune apps and their assignments when someone on your team deploys, edits or removes an app.
  • Create or change Intune policies when someone on your team deploys a baseline, restores a backup or rolls back a change.
  • Create security groups for the apps it deploys (Required, Available, Uninstall), and add members to or delete only those groups. This needs Group.Create. It’s on by default; change that in Settings › Apps.

MDO doesn’t send mail from your tenant, and it doesn’t change users or groups it didn’t create. The permissions cover this tenant only, and you can remove them in Entra ID at any time.

The exact Graph permissions, and what each is used for, are listed on How MDO treats your tenant. Per-app groups are covered in Deploying apps.

Step 3: First sync

Section titled “Step 3: First sync”

After consent, MDO adds the tenant and starts its first collection. The wizard shows progress while it runs. When it finishes, click Go to dashboard.

From then on MDO collects the tenant’s Intune data every night at 04:00 UTC, and whenever someone clicks Sync with Intune on Intune › Overview.

Next steps

Section titled “Next steps”