Microsoft Intune Integration Guide

Overview

Cup’n’String Guard integrates with Microsoft Intune to deploy AI tool firewall rule profiles to managed Windows and macOS endpoints. Guard pushes declarative configuration profiles via the Microsoft Graph API — enforcement is cooperative and device-resident (the Intune MDM client applies rules locally). Guard continuously tracks device compliance posture and associates it with each registered Cup’n’String agent.

Support level

Cooperative Endpoint Control — declarative profile apply via Microsoft Graph with async deployment tracking. Device-posture-aware: Guard reads compliance signals from Intune.

Recommended Guard mode

Observe to audit which devices have the required firewall profiles deployed, then Enforce to push and maintain profiles automatically.

Known limitations

• Enforcement is cooperative: the Intune MDM client applies rules locally. A device can be non-compliant if the MDM agent is disabled or the device is offline.
• Guard cannot guarantee immediate enforcement — profile deployment depends on device check-in cadence.
• Per-process rules are supported at the OS firewall layer (via Windows Defender / nftables / pf), not at the Intune profile layer.

Setup outline

1. Confirm the supported platform and deployment requirements with your administrator.
2. Use a dedicated integration identity with the minimum required permissions and validated TLS connections.
3. Review policy in your environment before enabling enforcement, then verify the intended access outcomes.

Contact the Cup’n’String team for deployment-specific configuration and verification guidance. Never share credentials in support messages or screenshots.