Eido works from its own copy of your Intune and Entra data. It does not query Microsoft each time you open a screen. Instead it reads each tenant on a schedule, which is why screens are fast and why something you changed in Intune a minute ago is not in Eido yet. This page explains what is read, how often, and how to tell how fresh it is.
For the access this relies on, see Permissions Eido needs.
How a sync works#
- Each linked tenant is synced by itself, about once an hour. The next sync starts one hour after the previous one finished, so the gap between syncs is an hour plus however long a sync takes.
- A sync works through the areas below in a fixed order: people and groups, then devices, then the results for each device, then the grades and issues worked out from them, then everything else.
- A sync only reads. Nothing is changed in Intune or Entra.
- Most of what Eido reads comes from Intune’s own reports. Intune prepares each report on request, which takes time, and Microsoft limits how quickly reports can be asked for. On a large tenant that is what a sync spends most of its time waiting for.
- The first sync of a tenant reads everything and can take up to 30 minutes. Later syncs are quicker because areas that change slowly are not read every time.
What is read, and how often#
“Every sync” means about once an hour.
Devices and people#
| Area | What Eido reads | Refreshed |
|---|---|---|
| Devices | Every device Intune manages, with its name, owner, operating system and version, model, serial number, enrolment and last check-in. Devices outside your device scoping rules are left out. | Every sync |
| Device directory details | Each device’s Entra extension attributes, enrolment profile and enrolment type. | Every sync |
| Hardware inventory | The additional hardware details Intune holds for each device, such as storage and memory. | Once a day |
| People | Entra users and their profile properties. See User properties. | Every sync |
| Groups | The name and description of every Entra group. | Every sync |
| Group members | Only for groups named in device scoping (every sync), and groups used in a report filter (when the report is run, then reused for up to 30 minutes). | As described |
| Autopilot deployments | The status and timings of Windows Autopilot deployments. | Every sync |
Policies and apps#
| Area | What Eido reads | Refreshed |
|---|---|---|
| Compliance policy results | Which devices pass or fail each compliance policy. | Every sync. Eido reads each policy’s totals, then reads the device-by-device results again for every policy whose totals have changed. A policy with no change is read again at least once a day. |
| Configuration policy results | Which devices succeeded, failed or conflicted on each configuration profile. | Every sync |
| Managed app results | Which devices have each assigned app installed, pending or failed, with the error for a failure. | Every sync. Eido reads each app’s totals, then reads the device-by-device results again for every app whose totals have changed. An app with no change is read again at least every two days. |
| Policy definitions | The full settings and assignments of each policy, kept as a backup whenever one changes. Covers compliance and configuration policies, scripts, remediations, update profiles, app configuration and app protection policies, and Conditional Access policies. | Every sync, while Backup Policies is on for the tenant |
| App details | Names, types, versions and publishers of the apps in Intune, and Apple VPP licence counts. | Every sync |
| Discovered apps | The apps Intune has found installed on each device. | Once a day, while Sync Discovered Apps is on for the tenant |
| Remediations and scripts | The result of each remediation and platform script on each device, for the remediations and scripts Eido holds from its policy backup. | Every sync, while Backup Policies is on for the tenant |
Windows updates#
| Area | What Eido reads | Refreshed |
|---|---|---|
| Patch level | Worked out from each device’s operating system version, against Eido’s own catalogue of released updates. | Every sync |
| Update rings | Each Windows Update ring and its deferral settings. | Once a day |
| Driver updates | Driver update profiles, the drivers waiting for or given approval, and devices where a driver update failed. | Once a day |
Security and service health#
| Area | What Eido reads | Refreshed |
|---|---|---|
| Defender | The state of the Defender agent on each device, and active malware. | Every sync |
| Firewall | Firewall status per device. | Every sync |
| Health and TPM attestation | Windows health attestation and TPM attestation status. | Once a day |
| Endpoint Privilege Management | Elevation events. | Every sync |
| Remote Help | Remote assistance sessions. | Every sync |
| Certificates and tokens | The Apple push certificate, Apple enrolment tokens and Apple VPP tokens, with their expiry dates. | Every sync |
| Intune audit log | Who changed what in Intune. The first sync reads the last 30 days. After that, only new events are added. | Every sync |
Worked out by Eido#
These are not read from Microsoft. Eido calculates them at the end of each sync from what it has just read.
| Area | Refreshed |
|---|---|
| Health grades for each device (patching, compliance, configuration, apps, operating system support) | Every sync, for devices whose data changed. Every device is recalculated at least once a day. |
| Issues | Every sync |
| Automations | Checked at the end of every sync, against the data just read |
Read only when you ask#
Some detail is fetched from Intune at the moment you open it, and is not kept. The setting-by-setting result of one policy on one device is the main example. If Intune is slow or unavailable at that moment, Eido tells you that part could not be loaded.
Not from Microsoft at all#
| Area | Where it comes from |
|---|---|
| App usage | Sent by your devices, once App Metering is set up. |
| Live tools, detailed inventory, performance and Windows events | Sent by the Eido Client, where you have deployed it. |
| Warranty dates | Looked up with the manufacturer by serial number, about once a month per device. Dell is always on. HP and Lenovo need their integration switched on. |
How fresh is what I am looking at?#
Open Admin, then Intune Tenants. Each tenant shows its sync status.
| You see | It means |
|---|---|
| 42 mins until next sync | The last sync finished 18 minutes ago. Subtract the number from 60. |
| Sync in progress | A sync is running. What you see is from the previous sync, with some areas already updated. |
| Pending or Overdue by … | The last sync finished more than an hour ago. |
The full list of statuses is in Intune tenants.
Two other dates are easy to confuse with this.
- Intune Last Sync on a device is when that device last checked in with Intune. It says nothing about Eido. A device that has been switched off for a month has an old check-in date however recently Eido synced.
- Intune’s own reports lag behind devices. A device can install an update, and Intune may take some hours to reflect it in the report that Eido reads. Eido can never be more up to date than Intune is.
So when a device has just been fixed, the path is: the device reports to Intune, Intune updates its report, Eido reads it at the next sync. Allow a few hours before treating a stale result as a problem.
Sync a tenant now#
You can start a sync without waiting for the hour.
- Open Admin, Intune Tenants and press the tenant.
- Under Tenant Settings, in Actions, press Sync Now.
- Sync Tenant opens with one switch, Force Full Sync. Leave it off for a normal sync, or turn it on for a full one.
- Press Sync Now.
| Choice | What happens | Use it when |
|---|---|---|
| Force Full Sync off | A normal sync starts within about a minute. Areas that are refreshed daily are skipped if they are not due. | You changed something in Intune and want it in Eido sooner. |
| Force Full Sync on | Any sync already running is abandoned and a new one starts that reads the tenant again from the beginning, including areas that are normally refreshed only daily, and recalculates every device. It takes about as long as a first sync. | Something looks wrong or incomplete and a normal sync has not corrected it, or a sync appears stuck. |
Only an administrator who can open Intune Tenants can start a sync. Saving a change in tenant settings starts a full sync automatically, so you do not need to press Sync Now after changing a threshold or a scoping rule.
A sync cannot make Intune report sooner. If Intune has not caught up with a device yet, syncing again will read the same answer.
When devices and people disappear#
- A device removed from Intune is removed from Eido at the next sync.
- A device that falls outside your device scoping rules is removed at the next sync, and returns if the rules are widened.
- A user deleted from Entra is removed at the next sync.
- A policy or app deleted from Intune is removed at the next sync.
When a sync fails#
Eido retries by itself. A request to Microsoft that fails is tried again, and a tenant whose sync did not finish is picked up again automatically. Most failures are temporary, caused by Microsoft limiting requests or being briefly unavailable, and clear without anybody noticing.
What you see depends on what failed.
| What you see | What has happened | What to do |
|---|---|---|
| The tenant looks healthy, and one area of Eido has stopped updating or is empty | One part of the sync failed and the rest carried on. Areas are read independently, so a problem with one report does not stop the others. | Wait for the next sync. If the same area is still stale after a day, raise a ticket with Eido support, giving the tenant’s name and the area. |
| Sync in progress for many hours | A sync has stopped part way and not finished. Eido abandons a stuck sync and starts a new one automatically within 12 hours. | To restart it straight away, use Sync Now with Force Full Sync on. |
| Overdue by … growing for hours | Syncs are not starting for this tenant. | Raise a ticket with Eido support. |
| Nothing updates at all, on a tenant that used to work | Eido can no longer sign in to the tenant, or can no longer read users, groups or devices, which every sync depends on. | Check the causes below. |
Causes you can fix yourself#
| Cause | How to check | Fix |
|---|---|---|
| The Eido application was deleted or disabled in your Entra tenant | Microsoft Entra admin centre, Enterprise applications. | Link the tenant again from Link New Tenant with the same access level. Eido keeps the existing tenant and its data. |
| A permission was removed from the Eido application | The application’s Permissions page. | Link the tenant again to grant consent afresh. |
| A custom app registration’s client secret has expired | Secret Expiry in tenant settings, or the app registration in Entra. | Create a new secret in Entra and enter it in tenant settings. |
If none of these applies, raise a ticket with Eido support, giving the tenant’s name. Support can see which step of the sync failed and why.
Questions people ask#
Can Eido sync more often than hourly?#
The schedule is fixed. You can start an extra sync at any time with Sync Now.
I changed a policy in Intune. When will Eido show it?#
The policy’s new settings are read at the next sync, so within about an hour, or sooner with Sync Now. The results on each device take longer, because each device has to check in with Intune and apply the change first.
Why does a device show an old patch level when I know it has updated?#
The device has to report its new version to Intune, and Intune has to include it in its device report, before Eido can read it. Check Intune Last Sync on the device. If that is older than the update, Intune itself does not know yet.
Does syncing slow Intune down or affect devices?#
No. Eido reads from Microsoft’s service, within the request limits Microsoft sets. It does not contact devices and nothing runs on them as part of a sync.
Is a paused tenant still synced?#
No. A tenant showing Tenant paused is skipped until it is resumed. Demo tenants are always paused.