openapi: 3.1.0
info:
title: Microsoft Graph Admin Admin.admin deviceManagement.deviceManagement API
description: 'Microsoft Graph API for managing administrative resources in Microsoft Entra ID.
This API enables administrators to manage Microsoft Edge browser settings, Internet Explorer mode configurations,
site lists, shared browser sites, Microsoft 365 Apps installation options, people insights, service announcements,
SharePoint settings, Copilot administration, directory administrative units, and admin consent policies.'
version: 1.0.0
contact:
name: Microsoft Graph API Support
url: https://developer.microsoft.com/graph
servers:
- url: https://graph.microsoft.com/v1.0
description: Microsoft Graph API v1.0 endpoint
tags:
- name: deviceManagement.deviceManagement
paths:
/deviceManagement:
description: Provides operations to manage the deviceManagement singleton.
get:
tags:
- deviceManagement.deviceManagement
summary: Microsoft Graph Get deviceManagement
operationId: deviceManagement.deviceManagement.GetDeviceManagement
parameters:
- name: $select
in: query
description: Select properties to be returned
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $expand
in: query
description: Expand related entities
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
responses:
2XX:
description: Retrieved entity
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.deviceManagement'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
patch:
tags:
- deviceManagement.deviceManagement
summary: Microsoft Graph Update deviceManagement
operationId: deviceManagement.deviceManagement.UpdateDeviceManagement
requestBody:
description: New property values
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.deviceManagement'
required: true
responses:
2XX:
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.deviceManagement'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
components:
schemas:
microsoft.graph.richLongRunningOperation:
allOf:
- $ref: '#/components/schemas/microsoft.graph.longRunningOperation'
- title: richLongRunningOperation
required:
- '@odata.type'
type: object
properties:
error:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.publicError'
- type: object
nullable: true
description: Error that caused the operation to fail.
percentageComplete:
maximum: 2147483647
minimum: -2147483648
type: number
description: A value between 0 and 100 that indicates the progress of the operation.
format: int32
nullable: true
resourceId:
type: string
description: The unique identifier for the result.
nullable: true
type:
type: string
description: The type of the operation.
nullable: true
'@odata.type':
type: string
description: The status of a long-running operation.
x-ms-discriminator-value: '#microsoft.graph.richLongRunningOperation'
microsoft.graph.workbookWorksheet:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: workbookWorksheet
required:
- '@odata.type'
type: object
properties:
name:
type: string
description: The display name of the worksheet.
nullable: true
position:
maximum: 2147483647
minimum: -2147483648
type: number
description: The zero-based position of the worksheet within the workbook.
format: int32
visibility:
type: string
description: 'The visibility of the worksheet. The possible values are: Visible, Hidden, VeryHidden.'
charts:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.workbookChart'
description: The list of charts that are part of the worksheet. Read-only.
x-ms-navigationProperty: true
names:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.workbookNamedItem'
description: The list of names that are associated with the worksheet. Read-only.
x-ms-navigationProperty: true
pivotTables:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.workbookPivotTable'
description: The list of piot tables that are part of the worksheet.
x-ms-navigationProperty: true
protection:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.workbookWorksheetProtection'
- type: object
nullable: true
description: The sheet protection object for a worksheet. Read-only.
x-ms-navigationProperty: true
tables:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.workbookTable'
description: The list of tables that are part of the worksheet. Read-only.
x-ms-navigationProperty: true
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.workbookWorksheet'
microsoft.graph.rgbColor:
title: rgbColor
required:
- '@odata.type'
type: object
properties:
b:
type: number
description: Blue value
format: uint8
g:
type: number
description: Green value
format: uint8
r:
type: number
description: Red value
format: uint8
'@odata.type':
type: string
description: Color in RGB.
microsoft.graph.phoneType:
title: phoneType
enum:
- home
- business
- mobile
- other
- assistant
- homeFax
- businessFax
- otherFax
- pager
- radio
type: string
microsoft.graph.profilePhoto:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: profilePhoto
required:
- '@odata.type'
type: object
properties:
height:
maximum: 2147483647
minimum: -2147483648
type: number
description: The height of the photo. Read-only.
format: int32
nullable: true
width:
maximum: 2147483647
minimum: -2147483648
type: number
description: The width of the photo. Read-only.
format: int32
nullable: true
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.profilePhoto'
microsoft.graph.teamworkHostedContent:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: teamworkHostedContent
required:
- '@odata.type'
type: object
properties:
contentBytes:
type: string
description: Write only. Bytes for the hosted content (such as images).
format: base64url
nullable: true
contentType:
type: string
description: Write only. Content type. such as image/png, image/jpg.
nullable: true
'@odata.type':
type: string
discriminator:
propertyName: '@odata.type'
mapping:
'#microsoft.graph.chatMessageHostedContent': '#/components/schemas/microsoft.graph.chatMessageHostedContent'
microsoft.graph.objectIdentity:
title: objectIdentity
required:
- '@odata.type'
type: object
properties:
issuer:
type: string
description: Specifies the issuer of the identity, for example facebook.com. 512 character limit. For local accounts (where signInType isn't federated), this property is the local default domain name for the tenant, for example contoso.com. For guests from other Microsoft Entra organizations, this is the domain of the federated organization, for example contoso.com. For more information about filtering behavior for this property, see Filtering on the identities property of a user.
nullable: true
issuerAssignedId:
type: string
description: 'Specifies the unique identifier assigned to the user by the issuer. 64 character limit. The combination of issuer and issuerAssignedId must be unique within the organization. Represents the sign-in name for the user, when signInType is set to emailAddress or userName (also known as local accounts).When signInType is set to: emailAddress (or a custom string that starts with emailAddress like emailAddress1), issuerAssignedId must be a valid email addressuserName, issuerAssignedId must begin with an alphabetical character or number, and can only contain alphanumeric characters and the following symbols: - or _ For more information about filtering behavior for this property, see Filtering on the identities property of a user.'
nullable: true
signInType:
type: string
description: Specifies the user sign-in types in your directory, such as emailAddress, userName, federated, or userPrincipalName. federated represents a unique identifier for a user from an issuer that can be in any format chosen by the issuer. Setting or updating a userPrincipalName identity updates the value of the userPrincipalName property on the user object. The validations performed on the userPrincipalName property on the user object, for example, verified domains and acceptable characters, are performed when setting or updating a userPrincipalName identity. Extra validation is enforced on issuerAssignedId when the sign-in type is set to emailAddress or userName. This property can also be set to any custom string. For more information about filtering behavior for this property, see Filtering on the identities property of a user.
nullable: true
'@odata.type':
type: string
microsoft.graph.managedAppRegistration:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: managedAppRegistration
required:
- '@odata.type'
type: object
properties:
appIdentifier:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.mobileAppIdentifier'
- type: object
nullable: true
description: The app package Identifier
applicationVersion:
type: string
description: App version
nullable: true
createdDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: Date and time of creation
format: date-time
deviceName:
type: string
description: Host device name
nullable: true
deviceTag:
type: string
description: App management SDK generated tag, which helps relate apps hosted on the same device. Not guaranteed to relate apps in all conditions.
nullable: true
deviceType:
type: string
description: Host device type
nullable: true
flaggedReasons:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.managedAppFlaggedReason'
description: Zero or more reasons an app registration is flagged. E.g. app running on rooted device
lastSyncDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: Date and time of last the app synced with management service.
format: date-time
managementSdkVersion:
type: string
description: App management SDK version
nullable: true
platformVersion:
type: string
description: Operating System version
nullable: true
userId:
type: string
description: The user Id to who this app registration belongs.
nullable: true
version:
type: string
description: Version of the entity.
nullable: true
appliedPolicies:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.managedAppPolicy'
description: Zero or more policys already applied on the registered app when it last synchronized with managment service.
x-ms-navigationProperty: true
intendedPolicies:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.managedAppPolicy'
description: Zero or more policies admin intended for the app as of now.
x-ms-navigationProperty: true
operations:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.managedAppOperation'
description: Zero or more long running operations triggered on the app registration.
x-ms-navigationProperty: true
'@odata.type':
type: string
description: The ManagedAppEntity is the base entity type for all other entity types under app management workflow.
discriminator:
propertyName: '@odata.type'
mapping:
'#microsoft.graph.androidManagedAppRegistration': '#/components/schemas/microsoft.graph.androidManagedAppRegistration'
'#microsoft.graph.iosManagedAppRegistration': '#/components/schemas/microsoft.graph.iosManagedAppRegistration'
microsoft.graph.termColumn:
title: termColumn
required:
- '@odata.type'
type: object
properties:
allowMultipleValues:
type: boolean
description: Specifies whether the column allows more than one value.
nullable: true
showFullyQualifiedName:
type: boolean
description: Specifies whether to display the entire term path or only the term label.
nullable: true
parentTerm:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.termStore.term'
- type: object
nullable: true
x-ms-navigationProperty: true
termSet:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.termStore.set'
- type: object
nullable: true
x-ms-navigationProperty: true
'@odata.type':
type: string
microsoft.graph.applePushNotificationCertificate:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: applePushNotificationCertificate
required:
- '@odata.type'
type: object
properties:
appleIdentifier:
type: string
description: Apple Id of the account used to create the MDM push certificate.
nullable: true
certificate:
type: string
nullable: true
certificateSerialNumber:
type: string
description: Certificate serial number. This property is read-only.
nullable: true
readOnly: true
certificateUploadFailureReason:
type: string
description: The reason the certificate upload failed.
nullable: true
certificateUploadStatus:
type: string
description: The certificate upload status.
nullable: true
expirationDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: The expiration date and time for Apple push notification certificate.
format: date-time
lastModifiedDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: Last modified date and time for Apple push notification certificate.
format: date-time
topicIdentifier:
type: string
description: Topic Id.
nullable: true
'@odata.type':
type: string
description: Apple push notification certificate.
x-ms-discriminator-value: '#microsoft.graph.applePushNotificationCertificate'
microsoft.graph.cloudPcDeviceImageOsStatus:
title: cloudPcDeviceImageOsStatus
enum:
- supported
- supportedWithWarning
- unknown
- unknownFutureValue
type: string
microsoft.graph.shared:
title: shared
required:
- '@odata.type'
type: object
properties:
owner:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.identitySet'
- type: object
nullable: true
description: The identity of the owner of the shared item. Read-only.
scope:
type: string
description: 'Indicates the scope of how the item is shared. The possible values are: anonymous, organization, or users. Read-only.'
nullable: true
sharedBy:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.identitySet'
- type: object
nullable: true
description: The identity of the user who shared the item. Read-only.
sharedDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: The UTC date and time when the item was shared. Read-only.
format: date-time
nullable: true
'@odata.type':
type: string
microsoft.graph.userExperienceAnalyticsAppHealthAppPerformanceByAppVersionDeviceId:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: userExperienceAnalyticsAppHealthAppPerformanceByAppVersionDeviceId
required:
- '@odata.type'
type: object
properties:
appCrashCount:
maximum: 2147483647
minimum: -2147483648
type: number
description: The number of crashes for the app. Valid values -2147483648 to 2147483647
format: int32
appDisplayName:
type: string
description: The friendly name of the application.
nullable: true
appName:
type: string
description: The name of the application.
nullable: true
appPublisher:
type: string
description: The publisher of the application.
nullable: true
appVersion:
type: string
description: The version of the application.
nullable: true
deviceDisplayName:
type: string
description: 'The name of the device. Supports: $select, $OrderBy. Read-only.'
nullable: true
deviceId:
type: string
description: 'The Intune device id of the device. Supports: $select, $OrderBy. Read-only.'
nullable: true
processedDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: 'The date and time when the statistics were last computed. The value cannot be modified and is automatically populated when the statistics are computed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2022 would look like this: ''2022-01-01T00:00:00Z''. Returned by default. Read-only.'
format: date-time
'@odata.type':
type: string
description: The user experience analytics application performance entity contains application performance by application version device id.
x-ms-discriminator-value: '#microsoft.graph.userExperienceAnalyticsAppHealthAppPerformanceByAppVersionDeviceId'
microsoft.graph.settingValue:
title: settingValue
required:
- '@odata.type'
type: object
properties:
name:
type: string
description: Name of the setting (as defined by the groupSettingTemplate).
nullable: true
value:
type: string
description: Value of the setting.
nullable: true
'@odata.type':
type: string
microsoft.graph.managementAgentType:
title: managementAgentType
enum:
- eas
- mdm
- easMdm
- intuneClient
- easIntuneClient
- configurationManagerClient
- configurationManagerClientMdm
- configurationManagerClientMdmEas
- unknown
- jamf
- googleCloudDevicePolicyController
- microsoft365ManagedMdm
- msSense
type: string
x-ms-enum:
name: managementAgentType
modelAsString: false
values:
- value: eas
description: The device is managed by Exchange server.
name: eas
- value: mdm
description: The device is managed by Intune MDM.
name: mdm
- value: easMdm
description: The device is managed by both Exchange server and Intune MDM.
name: easMdm
- value: intuneClient
description: Intune client managed.
name: intuneClient
- value: easIntuneClient
description: The device is EAS and Intune client dual managed.
name: easIntuneClient
- value: configurationManagerClient
description: The device is managed by Configuration Manager.
name: configurationManagerClient
- value: configurationManagerClientMdm
description: The device is managed by Configuration Manager and MDM.
name: configurationManagerClientMdm
- value: configurationManagerClientMdmEas
description: The device is managed by Configuration Manager, MDM and Eas.
name: configurationManagerClientMdmEas
- value: unknown
description: Unknown management agent type.
name: unknown
- value: jamf
description: The device attributes are fetched from Jamf.
name: jamf
- value: googleCloudDevicePolicyController
description: The device is managed by Google's CloudDPC.
name: googleCloudDevicePolicyController
- value: microsoft365ManagedMdm
description: This device is managed by Microsoft 365 through Intune.
name: microsoft365ManagedMdm
microsoft.graph.workbookCommentReply:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: workbookCommentReply
required:
- '@odata.type'
type: object
properties:
content:
type: string
description: The content of the reply.
nullable: true
contentType:
type: string
description: The content type for the reply.
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.workbookCommentReply'
microsoft.graph.cloudPcDeviceImageStatus:
title: cloudPcDeviceImageStatus
enum:
- pending
- ready
- failed
- unknownFutureValue
type: string
microsoft.graph.singleValueLegacyExtendedProperty:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: singleValueLegacyExtendedProperty
required:
- '@odata.type'
type: object
properties:
value:
type: string
description: A property value.
nullable: true
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.singleValueLegacyExtendedProperty'
microsoft.graph.onPremisesExtensionAttributes:
title: onPremisesExtensionAttributes
required:
- '@odata.type'
type: object
properties:
extensionAttribute1:
type: string
description: First customizable extension attribute.
nullable: true
extensionAttribute10:
type: string
description: Tenth customizable extension attribute.
nullable: true
extensionAttribute11:
type: string
description: Eleventh customizable extension attribute.
nullable: true
extensionAttribute12:
type: string
description: Twelfth customizable extension attribute.
nullable: true
extensionAttribute13:
type: string
description: Thirteenth customizable extension attribute.
nullable: true
extensionAttribute14:
type: string
description: Fourteenth customizable extension attribute.
nullable: true
extensionAttribute15:
type: string
description: Fifteenth customizable extension attribute.
nullable: true
extensionAttribute2:
type: string
description: Second customizable extension attribute.
nullable: true
extensionAttribute3:
type: string
description: Third customizable extension attribute.
nullable: true
extensionAttribute4:
type: string
description: Fourth customizable extension attribute.
nullable: true
extensionAttribute5:
type: string
description: Fifth customizable extension attribute.
nullable: true
extensionAttribute6:
type: string
description: Sixth customizable extension attribute.
nullable: true
extensionAttribute7:
type: string
description: Seventh customizable extension attribute.
nullable: true
extensionAttribute8:
type: string
description: Eighth customizable extension attribute.
nullable: true
extensionAttribute9:
type: string
description: Ninth customizable extension attribute.
nullable: true
'@odata.type':
type: string
microsoft.graph.workbookChartLegendFormat:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: workbookChartLegendFormat
required:
- '@odata.type'
type: object
properties:
fill:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.workbookChartFill'
- type: object
nullable: true
description: Represents the fill format of an object, which includes background formating information. Read-only.
x-ms-navigationProperty: true
font:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.workbookChartFont'
- type: object
nullable: true
description: Represents the font attributes such as font name, font size, color, etc. of a chart legend. Read-only.
x-ms-navigationProperty: true
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.workbookChartLegendFormat'
microsoft.graph.responseType:
title: responseType
enum:
- none
- organizer
- tentativelyAccepted
- accepted
- declined
- notResponded
type: string
microsoft.graph.mobileThreatDefenseConnector:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: mobileThreatDefenseConnector
required:
- '@odata.type'
type: object
properties:
allowPartnerToCollectIOSApplicationMetadata:
type: boolean
description: When TRUE, indicates the Mobile Threat Defense partner may collect metadata about installed applications from Intune for iOS devices. When FALSE, indicates the Mobile Threat Defense partner may not collect metadata about installed applications from Intune for iOS devices. Default value is FALSE.
allowPartnerToCollectIOSPersonalApplicationMetadata:
type: boolean
description: When TRUE, indicates the Mobile Threat Defense partner may collect metadata about personally installed applications from Intune for iOS devices. When FALSE, indicates the Mobile Threat Defense partner may not collect metadata about personally installed applications from Intune for iOS devices. Default value is FALSE.
androidDeviceBlockedOnMissingPartnerData:
type: boolean
description: When TRUE, indicates that Intune must receive data from the Mobile Threat Defense partner prior to marking an Android device compliant. When FALSE, indicates that Intune may mark an Android device compliant before receiving data from the Mobile Threat Defense partner.
androidEnabled:
type: boolean
description: When TRUE, indicates that data from the Mobile Threat Defense partner will be used during compliance evaluations for Android devices. When FALSE, indicates that data from the Mobile Threat Defense partner will not be used during compliance evaluations for Android devices. Default value is FALSE.
androidMobileApplicationManagementEnabled:
type: boolean
description: When TRUE, inidicates that data from the Mobile Threat Defense partner can be used during Mobile Application Management (MAM) evaluations for Android devices. When FALSE, inidicates that data from the Mobile Threat Defense partner should not be used during Mobile Application Management (MAM) evaluations for Android devices. Only one partner per platform may be enabled for Mobile Application Management (MAM) evaluation. Default value is FALSE.
iosDeviceBlockedOnMissingPartnerData:
type: boolean
description: When TRUE, indicates that Intune must receive data from the Mobile Threat Defense partner prior to marking a device compliant. When FALSE, indicates that Intune may not recieve data from Mobile Threat Defense partner prior to making device compliant. Default value is FALSE.
iosEnabled:
type: boolean
description: When TRUE, indicates that data from the Mobile Threat Defense partner will be used during compliance evaluations for iOS devices. When FALSE, indicates that data from the Mobile Threat Defense partner will not be used during compliance evaluations for iOS devices. Default value is FALSE.
iosMobileApplicationManagementEnabled:
type: boolean
description: When TRUE, inidicates that data from the Mobile Threat Defense partner can be used during Mobile Application Management (MAM) evaluations for iOS devices. When FALSE, inidicates that data from the Mobile Threat Defense partner should not be used during Mobile Application Management (MAM) evaluations for iOS devices. Only one partner per platform may be enabled for Mobile Application Management (MAM) evaluation. Default value is FALSE.
lastHeartbe
# --- truncated at 32 KB (1286 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-graph/refs/heads/main/openapi/microsoft-graph-devicemanagement-devicemanagement-api-openapi.yml