Service Graph Connector for Microsoft Intune advanced data sources setup fails with 401 authentication error and empty chunks tableIssue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } When configuring the Service Graph Connector (SGC) for Microsoft Intune using the Advanced Data Sources option, the connection test fails with a 401 authentication error and no data appears in the Intune report chunks table (`sn_intune_integrat_report_chunks`). The device import jobs do not complete successfully. Symptoms<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } - Test connection returns: Test Connection Failed - Unable to make a connection to Intune API Call, please check your credential configuration. Check the System log for more details. HTTP Return status code was 401.- Outbound HTTP log shows: Method failed: (/v1.0/deviceManagement/managedDevices) with code: 401 - Invalid username/password combo- API response contains: {"error":{"code":"InvalidAuthenticationToken","message":"Access token is empty."}}- The sn_intune_integrat_report_chunks table remains empty after running the Trigger Device Reports scheduled job- The SG-Intune Device Reports import schedule does not create an import set because its precondition script fails- The following error may also appear when saving credentials: Save credential failed - Unable to create child alias for parent with id: <alias-id>. Cannot set parent alias to id: sn_intune_integrat.SGC_Microsoft_Intune. Alias is a child alias.- Scheduled jobs run but no Configuration Items (CIs) are created or updated in the Configuration Management Database (CMDB) Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } All currently supported releases. Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Check whether the OAuth provider record (Application Registry) for SGC-Intune is missing the Azure **Tenant ID** value. Without the Tenant ID, the OAuth profile cannot request a valid access token from Microsoft, resulting in every outbound API call failing with a 401 Invalid Authentication Token error. Because no valid token is retrieved, the Trigger Device Reports subflow cannot communicate with Microsoft Intune, so no records are written to the 'sn_intune_integrat_report_chunks' table.The Device Reports import schedule includes a precondition script that checks for completed chunk records before creating an import set; when the table is empty, the precondition fails and no import set is generated, so no data reaches the CMDB.The 'child alias' credential error is a separate symptom caused by attempting to create a new connection when an existing Connection Alias is already registered to the same parent — this can occur when prior incomplete setup attempts left orphaned connection records. Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } **Before you begin:** Confirm that an active MID Server is available and that your Azure App Registration has been provisioned with a Client ID, Client Secret, and Tenant ID scoped to this instance. 1. Navigate to **SGC Central** in your ServiceNow instance. 2. Locate the existing draft connection for SGC-Intune. If no draft connection is visible, create a new connection from SGC Central and complete the initial credential entry screen before continuing. > Do not create a duplicate connection if a draft already exists — open and resume the existing one. 3. Open the OAuth provider record associated with the connection. In SGC Central, this record is named **SG-Intune OAuth** (suffixed with the connection name, for example `SG-Intune Oauth.1`). You can navigate directly to the Application Registry table: go to **System OAuth > Application Registry** and search for records with `SG-Intune` in the name. 4. Confirm that the **Tenant ID** field is populated with the correct Azure Tenant ID for this instance. If the field is blank or contains an incorrect value, enter the correct Tenant ID and click **Update**. 5. Return to SGC Central and click **Test Connection** on the connection record. Confirm the test returns a success status before continuing. > If the test still returns 401, verify that the Client ID and Client Secret in the credential record match the values provisioned in your Azure App Registration and have not expired. 6. Resume the guided setup playbook from SGC Central. Complete all steps in order, paying particular attention to **Step 9: Activate the Trigger Device Reports scheduled job**. > Step 9 is mandatory. Skipping it means the `SG-Intune Trigger Device Reports` job never runs, no chunk records are created, and the Device Reports import schedule will not generate an import set. Reference: Configure the SGC for Microsoft Intune integration (Steps 8–10) 7. After completing Step 9, allow the `SG-Intune Trigger Device Reports` scheduled job to execute. Confirm that records now appear in the **sn_intune_integrat_report_chunks** table with a status of `completed` before proceeding. 8. Run the **SG-Intune Device Reports** import schedule manually or wait for its next scheduled execution. Confirm that an import set is created. > The import schedule includes a precondition script that checks for completed chunk records. If the table is still empty, the import set will not be created. Revisit Steps 6–7. 9. Configure the import schedule timing so that the Device Reports and Software Reports import schedules run **at least 3 hours after** their respective Trigger jobs. For example: if `SG-Intune Trigger Device Reports` runs at 9:00 AM and `SG-Intune Trigger Software Reports` runs at 10:00 AM, configure the Device Reports import schedule to run at 1:00 PM. Reference: Service Graph Connector for Microsoft Intune — Advanced Data Sources (KB1641546) 10. Verify that CIs are being created or updated in the CMDB by reviewing the integration execution log under **CMDB > Integrations > Integration Executions**.