Complete guide for installing Microsoft Intune on Kali Linux (Debian-based rolling release).

Requirements:

• Kali Linux (amd64 only)
• A Microsoft 365 organizational account with Intune license
• Internet connection

Tested on:

• Kali Linux Rolling (2026)
• HP ProBook 440 G10 / 13th Gen Intel i7-1355U

sudo apt install curl gpg ca-certificates gnome-keyring

curl -sSL https://packages.microsoft.com/keys/microsoft.asc -o /tmp/microsoft.asc
gpg --dearmor < /tmp/microsoft.asc > /tmp/microsoft.gpg
sudo cp /tmp/microsoft.gpg /etc/apt/trusted.gpg.d/microsoft.gpg
sudo chmod 644 /etc/apt/trusted.gpg.d/microsoft.gpg
rm -f /tmp/microsoft.asc /tmp/microsoft.gpg

Important: Use the Ubuntu 22.04 (jammy) repo, NOT the 20.04 (focal) one. The jammy repo has the latest intune-portal builds with current certificate pins.

echo "deb [arch=amd64] https://packages.microsoft.com/ubuntu/22.04/prod jammy main" | sudo tee /etc/apt/sources.list.d/microsoft-prod.list

Intune depends on packages from Debian Bookworm. Check if you already have them:

grep -q "deb.debian.org/debian bookworm" /etc/apt/sources.list && echo "Already present" || echo "Need to add"

If not present, add them:

echo "deb http://deb.debian.org/debian bookworm main contrib non-free non-free-firmware" | sudo tee -a /etc/apt/sources.list
echo "deb http://deb.debian.org/debian-security/ bookworm-security main contrib non-free non-free-firmware" | sudo tee -a /etc/apt/sources.list

sudo apt update

The intune-portal package will pull in most dependencies automatically (including microsoft-identity-broker, openjdk-11-jre, libwebkit2gtk-4.0-37). Install the portal and the one WebView dependency that may need manual installation:

sudo apt install intune-portal libgtk-3-0t64 libwebkit2gtk-4.0-37

If apt reports broken dependencies, use:

sudo apt install -f

This allows the authentication flow to redirect back to the portal:

xdg-mime default intune-portal.desktop x-scheme-handler/oneauth

Enable the Intune daemon socket (auto-starts on boot):

sudo systemctl enable --now intune-daemon.socket
sudo systemctl start intune-daemon

Start the Microsoft identity brokers:

sudo systemctl start microsoft-identity-device-broker
systemctl --user start microsoft-identity-broker

Verify all services are running:

systemctl status intune-daemon
sudo systemctl status microsoft-identity-device-broker
systemctl --user status microsoft-identity-broker

sudo reboot

After reboot, launch the portal (do NOT use --interactive):

intune-portal

A WebKit login window will appear. Sign in with your organizational Microsoft account. After successful authentication, the portal will:

1. Acquire tokens silently
2. Contact your org's Intune management endpoint
3. Enroll the device

After enrollment completes, check the device status:

systemctl --user status intune-agent

This error comes from the OneAuth authentication library, not intune-portal itself. The flag is parsed correctly by the portal but passed through to oneauth which rejects it. Run without the flag:

intune-portal

Certificate verification failed: InvalidCertificate("Unrecognized public key at depth 1")

This means your intune-portal version has outdated certificate pins. Microsoft periodically rotates intermediate certificates. Fix by upgrading:

sudo apt update
sudo apt install --reinstall intune-portal

If still failing, ensure you have the jammy repo (not focal):

echo "deb [arch=amd64] https://packages.microsoft.com/ubuntu/22.04/prod jammy main" | sudo tee /etc/apt/sources.list.d/microsoft-prod.list
sudo apt update && sudo apt install intune-portal

sudo systemctl enable --now intune-daemon.socket
sudo systemctl restart intune-daemon

Ensure both identity brokers are running:

sudo systemctl start microsoft-identity-device-broker
systemctl --user start microsoft-identity-broker

This is harmless. It just means no profile photo is set on your Microsoft account.

Ensure WebKit and GTK are installed:

sudo apt install libgtk-3-0t64 libwebkit2gtk-4.0-37 glib-networking

Also ensure you have a running display server (Wayland or X11). The portal cannot run headless.

The portal stores credentials via gnome-keyring. Make sure it's running:

eval $(gnome-keyring-daemon --start --components=secrets 2>/dev/null)