API capability pack for bounded Microsoft Intune endpoint-management operations through Microsoft Graph at https://graph.microsoft.com/v1.0 only. Enroll a Microsoft Graph OAuth bearer connection named microsoft with least-privilege Intune Graph scopes for the installed operations. The pack reads managed devices, detected apps, compliance policies, device configuration profiles, mobile apps, and Intune audit events for device compliance triage, endpoint inventory review, and help-desk action context. It bundles a scheduled device compliance digest, an AI-assisted device brief, and approval-gated workflows for syncing one managed device or remotely locking one managed device. The pack intentionally excludes wipe, retire, delete, reboot, shutdown, passcode recovery or reset, activation-lock bypass, lost-mode, remote assistance, Windows Defender scan/signature actions, Autopilot mutation, app or policy mutation, role/admin changes, beta endpoints, arbitrary Graph passthrough, and credential-bearing fields in operation arguments.