The Microsoft Intune integration exists for environments already invested in the Microsoft ecosystem that do not want to migrate everything at once. Rather than replacing Intune, Zonix EM sends the compliance state of the Android devices it manages into Intune, so the conditional access policies the company already maintains keep applying.
Configuration is per organisation, using Azure credentials (tenant identifier, client identifier and secret). The secret is stored encrypted. Synchronisation runs automatically every six hours and can also be triggered on demand from the console.
Enabling the integration goes through an administrative approval from Zonix EM before it becomes active on the organisation.
Events and workflow automation
The platform emits events for external automation, covering both the account lifecycle and the device lifecycle. That lets you connect Zonix EM to automation tooling without writing an intermediate service.
Event delivery retries on failure, so a momentary outage at the destination does not mean a lost event.
— Organisation lifecycle: creation, suspension, reactivation and cancellation.
— Trial lifecycle: approaching expiry and expired.
— Billing: payment failed, payment succeeded, subscription created and cancelled.
— Devices: enrollment, removal from management, alerts, lost mode, wipe and command execution.
Google Pub/Sub notifications
To receive device state changes in real time, the platform provisions a Google Cloud Pub/Sub topic and subscription per organisation and receives Android Management API notifications through a webhook.
This piece is internal to how the platform works and needs no manual configuration in normal use — but knowing it exists helps explain why a device state can lag behind a change made outside the console.
Platform API
The platform exposes a versioned API (v1) covering the same core operations as the console. It is used today by the console itself, and access is controlled by a plan capability: organisations on plans without that capability do not have the API enabled.
— Devices: read, update, remove, location and geofence events.
— Device commands and tracking of asynchronous operations, including cancellation.
— Policies: listing, creation from the four management modes, and management of the policy’s applications.
— Enrollment tokens: creation, listing and lookup.
— Geofences and geofencing policies.
— Approved applications and the managed configuration schema for each app.
In the meantime, integrations that need to react to platform events are better served by the automation events described above, which already work without an interactive credential.
Information needed from the product owner
API authentication today runs through the console’s authenticated session — there is no issuance of API keys or tokens for use by external systems yet. Making machine credentials available, and the endpoint documentation that would sensibly ship alongside them, depends on a decision from the product owner.