DeviceManagementEndpointSecurity.Read.All

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the DeviceManagementEndpointSecurity.Read.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	-	-
DisplayText	-	-
Description	-	-
AdminConsentRequired	Yes	No

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	GET /deviceManagement/configurationPolicies
	GET /deviceManagement/configurationPolicies/{deviceManagementConfigurationPolicyId}
	GET /deviceManagement/configurationPolicies/{deviceManagementConfigurationPolicyId}/retrieveLatestUpgradeDefaultBaselinePolicy
	GET /deviceManagement/configurationPolicyTemplates
	GET /deviceManagement/configurationPolicyTemplates/{deviceManagementConfigurationPolicyTemplateId}
	GET /deviceManagement/reusablePolicySettings
	GET /deviceManagement/reusablePolicySettings/{deviceManagementReusablePolicySettingId}
	GET /deviceManagement/reusablePolicySettings/{deviceManagementReusablePolicySettingId}/referencingConfigurationPolicies
	GET /deviceManagement/reusablePolicySettings/{deviceManagementReusablePolicySettingId}/referencingConfigurationPolicies/{deviceManagementConfigurationPolicyId}
	GET /deviceManagement/reusablePolicySettings/{deviceManagementReusablePolicySettingId}/referencingConfigurationPolicies/{deviceManagementConfigurationPolicyId}/retrieveLatestUpgradeDefaultBaselinePolicy

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgBetaDeviceManagementConfigurationPolicy
	Get-MgBetaDeviceManagementConfigurationPolicyLatestUpgradeDefaultBaselinePolicy
	Get-MgBetaDeviceManagementConfigurationPolicyTemplate

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: deviceManagementConfigurationPolicy

Property	Type	Description
id	String	Key of the policy document. Automatically generated.
name	String	Policy name
description	String	Policy description
platforms	deviceManagementConfigurationPlatforms	Platforms for this policy. The possible values are: `none`, `android`, `iOS`, `macOS`, `windows10X`, `windows10`, `linux`, `unknownFutureValue`, `androidEnterprise`, `aosp`, `visionOS`, `tvOS`.
technologies	deviceManagementConfigurationTechnologies	Technologies for this policy. The possible values are: `none`, `mdm`, `windows10XManagement`, `configManager`, `appleRemoteManagement`, `microsoftSense`, `exchangeOnline`, `mobileApplicationManagement`, `linuxMdm`, `extensibility`, `enrollment`, `endpointPrivilegeManagement`, `unknownFutureValue`, `windowsOsRecovery`, `android`.
createdDateTime	DateTimeOffset	Policy creation date and time
lastModifiedDateTime	DateTimeOffset	Policy last modification date and time
settingCount	Int32	Number of settings
creationSource	String	Policy creation source
roleScopeTagIds	String collection	List of Scope Tags for this Entity instance.
isAssigned	Boolean	Policy assignment status. This property is read-only.
templateReference	deviceManagementConfigurationPolicyTemplateReference	Template reference information
priorityMetaData	deviceManagementPriorityMetaData	Indicates the priority of each policies that are selected by the admin during enrollment process

Graph reference: deviceManagementConfigurationPolicyTemplate

Property	Type	Description
id	String	Key of the template document, composed of BaseId and Version. Automatically generated.
baseId	String	Template base identifier
version	Int32	Template version. Valid values 1 to 2147483647. This property is read-only.
displayName	String	Template display name
description	String	Template description
displayVersion	String	Description of template version
lifecycleState	deviceManagementTemplateLifecycleState	Indicate current lifecycle state of template. The possible values are: `invalid`, `draft`, `active`, `superseded`, `deprecated`, `retired`.
platforms	deviceManagementConfigurationPlatforms	Platforms for this template. The possible values are: `none`, `android`, `iOS`, `macOS`, `windows10X`, `windows10`, `linux`, `unknownFutureValue`, `androidEnterprise`, `aosp`, `visionOS`, `tvOS`.
technologies	deviceManagementConfigurationTechnologies	Technologies for this template. The possible values are: `none`, `mdm`, `windows10XManagement`, `configManager`, `appleRemoteManagement`, `microsoftSense`, `exchangeOnline`, `mobileApplicationManagement`, `linuxMdm`, `extensibility`, `enrollment`, `endpointPrivilegeManagement`, `unknownFutureValue`, `windowsOsRecovery`, `android`.
templateFamily	deviceManagementConfigurationTemplateFamily	TemplateFamily for this template. The possible values are: `none`, `endpointSecurityAntivirus`, `endpointSecurityDiskEncryption`, `endpointSecurityFirewall`, `endpointSecurityEndpointDetectionAndResponse`, `endpointSecurityAttackSurfaceReduction`, `endpointSecurityAccountProtection`, `endpointSecurityApplicationControl`, `endpointSecurityEndpointPrivilegeManagement`, `enrollmentConfiguration`, `appQuietTime`, `baseline`, `unknownFutureValue`, `deviceConfigurationScripts`, `deviceConfigurationPolicies`, `windowsOsRecoveryPolicies`, `companyPortal`.
allowUnmanagedSettings	Boolean	Allow unmanaged setting templates
settingTemplateCount	Int32	Number of setting templates. Valid values 0 to 2147483647. This property is read-only.
disableEntraGroupPolicyAssignment	Boolean	Indicates whether assignments to Entra security groups is disabled

Graph reference: deviceManagementReusablePolicySetting

Property	Type	Description
id	String	system generated reusable setting id.
displayName	String	reusable setting display name supplied by user.
description	String	reusable setting description supplied by user.
settingDefinitionId	String	setting definition id associated with this reusable setting.
settingInstance	deviceManagementConfigurationSettingInstance	reusable setting configuration instance
createdDateTime	DateTimeOffset	reusable setting creation date and time. This property is read-only.
lastModifiedDateTime	DateTimeOffset	date and time when reusable setting was last modified. This property is read-only.
version	Int32	version number for reusable setting. Valid values 0 to 2147483647. This property is read-only.
referencingConfigurationPolicyCount	Int32	count of configuration policies referencing the current reusable setting. Valid values 0 to 2147483647. This property is read-only.

Table of Contents

DeviceManagementEndpointSecurity.Read.All

Graph Methods

Resources