top of page
Search

Setting Up an Intune MCP Server on Your Mac: Talk to Your Fleet in Plain English

  • Writer: MacSmithAI
    MacSmithAI
  • 2 days ago
  • 6 min read

If you manage a Mac fleet through Microsoft Intune, you already know the rhythm: open the admin center, wait for it to load, click through three blades, copy a device ID, paste it somewhere, cross-reference with a report, and eventually answer a question that took your colleague ten seconds to ask in Slack.


The Model Context Protocol (MCP) changes that workflow. By running an Intune MCP server locally on your Mac and connecting it to Claude, you can ask things like "how many macOS devices are still on Sonoma?" or "which devices haven't checked in for 30 days?" and get an answer in the time it takes to type the question.

This post walks through the setup end to end — Entra app registration, permissions, local server, and connection to Claude — and covers the handful of gotchas that tripped me up the first time.


What you'll be able to do

Once the server is running, you can run read-only reporting and some light write operations against your Intune tenant from chat. A few examples:

  • Get total counts of macOS or iOS/iPadOS devices

  • Break down devices by OS version, compliance state, or pending-restart status

  • Look up a specific device by serial number or the user's UPN

  • See every app installed on a given Mac, or every Mac a given app is installed on

  • Check FileVault escrow status across the fleet

  • Find stale devices that haven't checked in for N days

  • Add devices to an Entra group by name

It's not a replacement for the Intune admin center — it's a faster front door for the questions you ask every day.


Prerequisites

Before you start, make sure you have:

  1. A Mac running macOS 13 or later. Apple Silicon or Intel, either works.

  2. Admin or Intune Administrator rights in your Microsoft Entra tenant, or a friendly admin who can create an app registration for you.

  3. Node.js 20+ and Python 3.11+ installed. I recommend brew install node python@3.12 if you don't have them.

  4. Claude Desktop installed from claude.ai/download. The MCP integration lives in its config file.

If you're missing any of these, stop here and get them sorted — the rest of the guide assumes they're in place.


Step 1: Register an app in Microsoft Entra

The MCP server authenticates to Microsoft Graph as an application, so you need an app registration with the right Graph permissions.

  1. Sign in to the Microsoft Entra admin center and go to Identity → Applications → App registrations → New registration.

  2. Name it something obvious like Intune MCP — <your name>. Leave redirect URI blank. Click Register.

  3. On the new app's Overview page, copy the Application (client) ID and the Directory (tenant) ID. You'll need both in a minute.

  4. Go to Certificates & secrets → Client secrets → New client secret. Give it a description and an expiry (I use 6 months — longer is tempting but rotate-and-forget is a bad habit). Copy the Value immediately; it's only shown once.

  5. Go to API permissions → Add a permission → Microsoft Graph → Application permissions and add:

  6. Click Grant admin consent for <tenant>. Without this step, every call will fail with AADSTS65001 and you will blame the MCP server when it's actually you.

Keep the client ID, tenant ID, and client secret somewhere safe for the next step. I put mine in 1Password as a single "Intune MCP" entry.


Step 2: Install the MCP server

Open Terminal and clone or install the server. The community implementation I use is straightforward to run from source:

mkdir -p ~/mcp-servers && cd ~/mcp-servers
git clone https://github.com/your-org/intune-mcp.git
cd intune-mcp
npm install
npm run build

Then create a .env file in the project root with your credentials:

AZURE_TENANT_ID=00000000-0000-0000-0000-000000000000
AZURE_CLIENT_ID=11111111-1111-1111-1111-111111111111
AZURE_CLIENT_SECRET=your-secret-value-here

Test it from the command line before wiring it up to Claude:

node dist/index.js --test

You should see a successful auth message and a device count. If you get a 401, double-check that admin consent was granted. If you get a 403 on a specific call, you're missing a permission — go back to Step 1 and add it.


Step 3: Connect the server to Claude Desktop

Claude Desktop reads MCP server config from a JSON file. On macOS it lives at:

~/Library/Application Support/Claude/claude_desktop_config.json

Open it in your editor of choice. If the file doesn't exist yet, create it. Add an mcpServers block:

{
  "mcpServers": {
    "intune": {
      "command": "node",
      "args": ["/Users/yourname/mcp-servers/intune-mcp/dist/index.js"],
      "env": {
        "AZURE_TENANT_ID": "00000000-0000-0000-0000-000000000000",
        "AZURE_CLIENT_ID": "11111111-1111-1111-1111-111111111111",
        "AZURE_CLIENT_SECRET": "your-secret-value-here"
      }
    }
  }
}

A few notes on this config:

  • Use the absolute path to index.js. Claude doesn't expand ~.

  • You can reference the .env file instead of inlining secrets if the server supports it — check its docs. I prefer inlining here because the config file is already user-scoped and easier to back up as a single blob.

  • If you have other MCP servers already configured (GitHub, filesystem, etc.), just add "intune" as a sibling key.


Save the file and fully quit Claude Desktop (⌘Q — closing the window isn't enough). Relaunch it.


Step 4: Try it out

In a new Claude conversation, you should see the Intune tools appear in the tools panel. Ask something simple to confirm it works:

How many macOS devices are enrolled in Intune?

Claude will call the get-macos-device-count tool and return a number. If it does, you're done with setup.

From here, the prompts that pay for themselves in the first week:

Show me all devices that haven't checked in for 21 days, grouped by user.
Which of our Macs are still on macOS 14.x? List them with their last check-in date.
Look up the device with serial C02XXXXX and tell me what apps are installed.
Get FileVault escrow status across the fleet and flag any Macs where the key isn't escrowed.

Gotchas I ran into

A few things that cost me time on the first setup, so they don't cost you yours:

Admin consent is per-tenant, not per-user. If your account can't grant consent, the whole thing is dead in the water until an admin clicks the button. Get this lined up before you start.

Secret expiry is silent. When your client secret expires, calls just start failing with 401s and the error messages aren't especially helpful. Put the expiry date on your calendar when you create the secret.

Graph API has throttling limits. If you ask Claude to enumerate every app on every device in a 2,000-device fleet in a single prompt, you will get rate-limited. Ask for the specific thing you need, or narrow by OS version / compliance state first.

Write operations deserve extra care. The add-devices-to-group tool is useful but Claude will happily execute it if you ask. I keep the GroupMember.ReadWrite.All permission off unless I specifically need it that week, and add it back temporarily. Read-only by default is the right posture for an LLM touching your production directory.

Tenant data leaves your Mac. When Claude processes a response from the MCP server, that data goes to Anthropic for inference. Check your organization's policy on this before pointing it at sensitive device lists. For a lot of IT teams this is fine; for some it isn't. Know which you are.


Where this fits in a day-to-day workflow

The honest answer is that this doesn't replace the Intune admin center — complex policy work still belongs there. What it replaces is the fifteen small lookups a day that interrupt whatever you were actually trying to do. "Is so-and-so's laptop compliant?" "How many devices are pending a restart after the last update?" "Did the Chrome deployment land on the marketing team's Macs?" Those questions go from two-minute context switches to ten-second chat exchanges.


If you pair this with an MDM-specific MCP server for your other platforms (there are community ones for Jamf, Kandji, and Mosyle), you end up with a single chat surface for fleet questions across your whole stack. That's where it stops feeling like a novelty and starts feeling like infrastructure.


Next in this series: using Raycast's AI commands to trigger MCP workflows without opening Claude — for the times when even a chat window is too much friction.

Comments

bottom of page