Agentic Packr needs permission in Microsoft Entra ID before it can publish apps to your Intune tenant. This article covers Express Registration (recommended), where Splashtop manages the app registration and an administrator approves it once.
Note: Note: Advanced Registration lets you register your own Entra app instead. Use it if your organization restricts third-party apps, you want to control which permissions are granted, or you use a sovereign cloud (US Government or China). This article does not cover Advanced Registration.
Before you start
You need:
- A Microsoft Entra account with the Privileged Role Administrator or Global Administrator role. Other admin roles, such as Application Administrator, Cloud Application Administrator, and Intune Administrator, cannot approve these permissions.
- Access to that account’s MFA method (for example, its authenticator app or phone).
- Pop-ups allowed for my.apps.splashtop.com in your browser.
- Go to Settings → Integrations and click Configure on the Microsoft Intune card.
Review the permissions listed on the Express Registration card, then click Connect to Intune.
- In the new tab, sign in with an admin account for the tenant you want to connect, then complete the password and MFA steps.
Review the permissions and click Accept. The tab closes and you return to Agentic Packr.
Confirm that the green banner appears and that the connection card shows the tenant name, tenant ID, who connected it, and health.
- Click Test Connection. When the page shows Test Connection passed and the card shows Health: Healthy, you can start deploying apps.
TIP: If an orange "missing permissions" banner appears right after approval, Entra ID has not finished saving the approval yet. Reload the page. Click Re-approve permissions only if the banner is still there after a few minutes.
| Microsoft Graph permission | Used to |
|---|---|
| DeviceManagementApps.ReadWrite.All | Create and update Win32 apps, upload content, and set detection rules and assignments |
| DeviceManagementManagedDevices.Read.All | Read managed devices for discovery and monitoring |
| DeviceManagementConfiguration.Read.All | Read device configuration and assignment filters |
| DeviceManagementScripts.ReadWrite.All | Create and assign Remediations (Convert-to-Managed only) |
| Device.Read.All | Read Entra device objects |
| Group.Create | Create security groups for app assignments |
| GroupMember.Read.All | Read groups and their members |
| Organization.Read.All | Read tenant name, domains, and ID |
| User.Read (delegated) | Sign in the approving administrator |
NOTE: The Express Registration card in Agentic Packr lists seven of these permissions. The Microsoft consent screen asks for all nine, including the two not shown on the card: DeviceManagementScripts.ReadWrite.All and User.Read.
To review or remove these permissions, go to the Entra admin center → Enterprise applications and search for Splashtop Agentic Packr (App ID 2132eda3-03c3-49ed-900c-3c408990d906). If you delete the app there, also click Disconnect in Agentic Packr. To grant fewer permissions, use Advanced Registration.
| Problem | Solution |
|---|---|
| Nothing happens when you click Connect to Intune | Your browser blocked the pop-up. Allow pop-ups for my.apps.splashtop.com and try again. |
| Microsoft shows "Need admin approval" | Your account lacks the required role. Ask a Privileged Role Administrator or Global Administrator to sign in, or send an admin consent request if your tenant allows it. |
| "Missing permissions" banner reappears weeks later | Splashtop added a permission. Ask a Privileged Role Administrator to click Re-approve permissions. |
| Conditional Access blocks the sign-in | Approve from a compliant device and location, or use an excluded admin account. |
Need more help?
When contacting Splashtop support, have your portal version (bottom left of the menu, e.g., v1.1.0 build 493), organization name, and tenant ID ready.