This document explains how to integrate Secret Double Octopus with Microsoft Intune for device management and application propagation.
This integration enables organizations to:
deploy the Secret Double Octopus client through Intune
support passwordless authentication
automate client propagation across managed Windows devices
Integration Environment
The environment used for the integration described in this document is based on the following software versions:
Secret Double Octopus Authentication Server
Microsoft Intune
Microsoft Entra ID
Windows 10/11 Enterprise
Hybrid Azure AD Joined or Azure AD Joined devices
Integration Workflow
The Secret Double Octopus integration with Intune involves the following sequential phases:
Preparing for Integration
Packaging the Client and Uploading the Application
Configuring Application Deployment
Monitoring Deployment and Installation Status
Upgrading the SDO Windows Agent
The following sections describe integration prerequisites.
Preparing the Intune Environment
In your Microsoft Intune environment, verify that:
Devices are enrolled in Microsoft Intune
Devices are Azure AD Joined or Hybrid Azure AD Joined
Users are licensed for Intune
Devices have a valid Primary Refresh Token (PRT)
The recommended validation command is:
dsregcmd /status
Expected return values are:
AzureAdJoined : YES AzureAdPrt : YES MdmUrl : populated
Verifying Device Enrollment and MDM Connectivity
In the Microsoft Intune Admin Center, verify that:
the device is listed under Managed Devices
the device is compliant
the last check-in time is recent
On the client machine, verify that:
The Microsoft Intune Management Extension is installed
The Microsoft Intune Management Extension service exists
Follow these steps to package the Secret Double Octopus client:
Create a source folder containing the SDO installer.
For example:
C:\Apps\SDO\ sdo-client.msiDownload the Microsoft Win32 Content Prep Tool
Run the following packaging command:
IntuneWinAppUtil.exe -c C:\Apps\SDO -s sdo-client.msi -o C:\Output
The tool generates:
sdo-client.intunewin
Uploading to Intune
In the Microsoft Intune Admin Center, navigate to Apps > Windows > Add > Windows app (Win32)
Then, upload the generated .intunewin
The following sections describe deployment configuration and assignment for the Win32 application.
Installing
Configure the installation command:
msiexec /i "sdo-client.msi" /qn
The optional logging command is:
msiexec /i "sdo-client.msi" /qn /L*v C:\Windows\Temp\sdo-install.log
Uninstalling
Configure the uninstall command. For example:
msiexec /x "{PRODUCT-CODE}" /qn /norestartDetection Rules
The recommended detection method is MSI product code.
Alternative methods are:
File existence
File version
Registry key
Application Assignment Guidelines
When assigning the application to users or devices, assign it as Required.
It is recommended to first use a dedicated device groups for pilot deployments. This phase should be followed by staged production rollout.
Avoid assigning the legacy MSI/LOB app and the Win32 application simultaneously to the same devices.
The following sections describe how to monitor log files and events.
Client Logs
The primary Intune deployment logs are located at C:\ProgramData\Microsoft\IntuneManagementExtension\Logs
The primary log file is IntuneManagementExtension.log
MSI Installation Logs
If MSI logging is enabled, the following file can be reviewed: C:\Windows\Temp\sdo-install.log
Event Viewer
Useful event channels can be found at Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider
To upgrade the Agent, create another instance of App propagation in Intune using the following installation command:
msiexec /I "intune.msi" REINSTALL=ALL REINSTALLMODE=vomus IS_MINOR_UPGRADE=1 /norestart /qn
Detection rules are:
File existence
File version
Registry key
IMPORTANT: The MSI file name should remain consistent for all versions. Do not change the file name when upgrading to a new version.