How to use your own Microsoft Entra application with PacKit

By default, PacKit uses its built-in multitenant application to connect to Microsoft Intune. In this case, the user organization only needs to approve the requested permissions.

If our user organization prefers to manage its own application registration, he needs to follow this guide to create one in Microsoft Entra ID and configure PacKit to use it.

You need:

• A Microsoft Entra tenant with an active Microsoft Intune subscription.
• Permission to register applications in that tenant.
• An administrator who can grant tenant-wide consent for the requested Microsoft Graph permissions.
• A user account with the Intune permissions needed to manage applications, assignments, and any other features you intend to use.

Application consent does not grant the signed-in user additional Intune privileges. The user’s Intune roles, scope groups, and scope tags still apply.

Step 1 : Register an application in Microsoft Entra ID

1. Open the Microsoft Entra admin center: https://entra.microsoft.com/
2. Navigate to Entra ID > App registrations.
3. Select New registration.
4. Enter a descriptive name, such as “PacKit – Intune Integration”.
5. Under Supported account types, select: Accounts in this organizational directory only (Single tenant).
6. Leave Redirect URI empty for now. You will configure it in step 3.
7. Select Register.

A single-tenant application is appropriate when the integration will only be used within your organization.

Step 2: Copy the application and tenant IDs

On the application’s Overview page, copy these two values:

• Application (client) ID
  Enter this later in PacKit’s “Custom app (client) ID” field.
• Directory (tenant) ID
  Enter this later in PacKit’s “Tenant ID” field.

Keep these values available for the following steps.

Step 3: Configure desktop Authentication

PacKit is a desktop application. Its redirect URI must match the application’s client ID.

1. Open Authentication in your app registration.
2. Select Add a platform.
3. Select Mobile and desktop applications.
4. Add this custom redirect URI, replacing it with the Application (client) ID you copied: msal://auth. For example, if the client ID is:
   12345678-1234-1234-1234-123456789abc Enter:
   msal12345678-1234-1234-1234-123456789abc://auth
5. Select Configure and save any remaining changes.

Do not register this URI as a Web or Single-page application redirect URI. Do not use https://localhost as a substitute: PacKit’s current sign-in flow uses the custom URI shown above.

Step 4 : Add Microsoft Graph permissions

1. Open API permissions.
2. Select Add a permission.
3. Select Microsoft Graph.
4. Select Delegated permissions, NOT Application permissions.
5. Search for and add the following permissions:

DeviceManagementApps.ReadWrite.All
Purpose: Read, upload, and update Intune applications; manage application assignments; retrieve application installation status.

DeviceManagementRBAC.Read.All
Purpose: Read Intune role assignments and scope tags used by PacKit’s scope-tag selection.

Group.ReadWrite.All
Purpose: List Microsoft Entra groups and create groups from PacKit.

If users do not need to create groups:

For a more restricted configuration, use GroupMember.Read.All instead of Group.ReadWrite.All. It allows PacKit to retrieve the basic group information needed to select existing assignment groups.

With this configuration, users cannot create new groups through PacKit.

User.Read may already be present by default. It does not replace the Intune and group permissions listed above. Do not add broad permissions such as Directory.ReadWrite.All for this setup.

Step 5: Grant Administrator consent

After adding the permissions:

1. On API permissions, select “Grant admin consent for “.
2. Review the requested permissions.
3. Confirm the consent.
4. Verify that the required permissions show “Granted for “.

If you cannot grant consent, ask an authorized Microsoft Entra administrator to complete this step.

IMPORTANT: Whenever you add or change permissions later, grant administrator consent again.

Step 6: Enter the IDs in PacKit

1. Open PacKit.
2. Navigate to Settings > Intune Settings.
3. Select Edit.
4. Configure the following fields: Cloud environment:
   Select “Commercial (public)” for a standard Microsoft cloud tenant. Custom app (client) ID:
   Enter the Application (client) ID from step 2. Tenant ID:
   Enter the Directory (tenant) ID from step 2.
5. Select Save.

GCC High tenants:

If your tenant is hosted in GCC High:

• Register the application in your organization’s US Government tenant, using the corresponding government portal.
• Configure the same desktop redirect URI and applicable delegated permissions.
• In PacKit, select “GCC High (US Government)”.
• Enter the client ID and tenant ID from that government tenant.

PacKit’s built-in application is registered only in the commercial cloud, so GCC High requires a custom application.

Step 7: Sign in and verify the connection

1. Start the Intune sign-in or deployment flow in PacKit.
2. Sign in with an account from the tenant where you registered the application.
3. Complete any MFA or other sign-in requirements.
4. Verify the features you intend to use:
   • View existing Intune applications.
   • Upload a test application.
   • Select an existing assignment group.
   • Load scope tags.
   • Create a group, if you granted Group.ReadWrite.All.

PacKit now uses your organization’s application registration instead of the built-in PacKit application.

Return to the Default PacKit application

For commercial-cloud tenants:

1. Open Settings > Intune Settings > Edit.
2. Clear Custom app (client) ID and Tenant ID.
3. Select Save.
4. Sign in again and approve the built-in PacKit application if prompted.