--- canonical_url: "https://docs.composio.dev/toolkits/microsoft_intune" markdown_url: "https://docs.composio.dev/toolkits/microsoft_intune.md" product: "platform" version: null last_updated: null --- # Microsoft Intune Manage Microsoft Intune devices, policies, applications, enrollment, assignments, and reports through Microsoft Graph. - **Category:** it operations - **Auth:** OAUTH2, S2S_OAUTH2 - **Composio-managed OAuth available?** No - **Tools:** 250 - **Triggers:** 0 - **Slug:** `MICROSOFT_INTUNE` - **Version:** 00000000_00 ## Tools ### Assign App **Slug:** `MICROSOFT_INTUNE_ASSIGN_APP` Replace every assignment for the named app. An empty list clears all assignments and requires confirm_clear_all_assignments=true. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | | `mobile_app_assignments` | array | Yes | Collection of mobileAppAssignment values supplied to this Microsoft Intune operation. | | `confirm_clear_all_assignments` | boolean | No | Set exactly true to confirm intentionally removing every app assignment when mobile_app_assignments is empty. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Assign App Config **Slug:** `MICROSOFT_INTUNE_ASSIGN_APP_CONFIG` Replace every assignment for the named app config. An empty list clears all assignments and requires confirm_clear_all_assignments=true. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `assignments` | array | Yes | Collection of managedDeviceMobileAppConfigurationAssignment values supplied to this Microsoft Intune operation. | | `confirm_clear_all_assignments` | boolean | No | Set exactly true to confirm intentionally removing every app-configuration assignment when assignments is empty. | | `managed_device_mobile_app_configuration_id` | string | Yes | Intune mobile-app configuration ID returned by LIST_APP_CONFIGS or GET_APP_CONFIG. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Assign Compliance Policy **Slug:** `MICROSOFT_INTUNE_ASSIGN_COMPLIANCE_POLICY` Replace the complete assignment target set for one compliance policy; use assignment CRUD tools to manage a single assignment relationship. Clearing all targets requires `confirm_clear_all_assignments=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `assignments` | array | Yes | Complete assignment collection that replaces the policy's current targets. An empty list clears every assignment and requires confirm_clear_all_assignments=true. | | `device_compliance_policy_id` | string | Yes | Intune compliance policy ID returned by LIST_COMPLIANCE_POLICIES. | | `confirm_clear_all_assignments` | boolean | No | Must be true when assignments is empty to confirm removal of every policy assignment. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Assign Device Config **Slug:** `MICROSOFT_INTUNE_ASSIGN_DEVICE_CONFIG` Replace all group, user, device, collection, exclusion, or scope-tag assignments for an Intune device configuration. Sending an empty collection removes every assignment and requires `confirm_clear_all_assignments=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `assignments` | array | Yes | Complete assignment collection that will replace the configuration's current targeting. | | `device_configuration_id` | string | Yes | ID of the Intune device configuration to assign. Obtain it from LIST_DEVICE_CONFIGS. | | `confirm_clear_all_assignments` | boolean | No | Must be exactly true when assignments is empty, acknowledging that all current assignments will be removed. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Assign Enrollment Config **Slug:** `MICROSOFT_INTUNE_ASSIGN_ENROLLMENT_CONFIG` Replace the complete assignment set for one device enrollment configuration with the supplied assignment targets. Sending an empty collection removes every assignment and requires `confirm_clear_all_assignments=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `confirm_clear_all_assignments` | boolean | No | Must be exactly true when enrollment_configuration_assignments is empty, acknowledging that all current assignments will be removed. | | `device_enrollment_configuration_id` | string | Yes | Microsoft Graph ID of the device enrollment configuration whose complete assignment set will be replaced. Obtain it from LIST_ENROLLMENT_CONFIGS. | | `enrollment_configuration_assignments` | array | Yes | Complete replacement set of assignment IDs and targets for the device enrollment configuration. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Assign User To Device Autopilot Device **Slug:** `MICROSOFT_INTUNE_ASSIGN_USER_TO_DEVICE_AUTOPILOT_DEVICE` Associate one user, identified by the supplied user names, with one Windows Autopilot device identity; no other device identity is changed. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_principal_name` | string | No | Microsoft Entra user principal name to associate with this single Autopilot device identity. | | `addressable_user_name` | string | No | Addressable user name to store on this single Autopilot device identity. | | `windows_autopilot_device_identity_id` | string | Yes | Microsoft Graph ID of the Windows Autopilot device identity to associate with a user. Obtain it from LIST_AUTOPILOT_DEVICES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Bulk Delete Autopilot Device Identities **Slug:** `MICROSOFT_INTUNE_BULK_DELETE_AUTOPILOT_DEVICE_IDENTITIES` Permanently unregister the Windows Autopilot device identities matching the supplied serial numbers. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `serial_numbers` | array | Yes | Serial numbers of the Windows Autopilot device identities to permanently unregister. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: Permanently unregisters the Windows Autopilot device identities supplied in the request. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Clean Windows Device Detected App Device **Slug:** `MICROSOFT_INTUNE_CLEAN_WINDOWS_DEVICE_DETECTED_APP_DEVICE` Clean a Windows device addressed as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`, removing user-installed Win32 apps and restoring policy-managed apps and settings. Select only while traversing from a detected app; prefer `MICROSOFT_INTUNE_CLEAN_WINDOWS_DEVICE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `keep_user_data` | boolean | No | When true, preserve user accounts and data during the Windows clean; when false, remove them. Omit to use the device's default behavior. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: Cleans the Windows device by removing user-installed Win32 apps and restoring policy-managed apps and settings. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Clean Windows Device Detected App User Device **Slug:** `MICROSOFT_INTUNE_CLEAN_WINDOWS_DEVICE_DETECTED_APP_USER_DEVICE` Clean a Windows device addressed through its detected-app membership and associated user, removing user-installed Win32 apps and restoring policy-managed apps and settings. Select only while traversing from that app and user; prefer `MICROSOFT_INTUNE_CLEAN_WINDOWS_DEVICE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `keep_user_data` | boolean | No | When true, preserve user accounts and data during the Windows clean; when false, remove them. Omit to use the device's default behavior. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Outer Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reuses it before and after the user segment. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: Cleans the Windows device by removing user-installed Win32 apps and restoring policy-managed apps and settings. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Clean Windows Device Managed Device **Slug:** `MICROSOFT_INTUNE_CLEAN_WINDOWS_DEVICE_MANAGED_DEVICE` Clean a Windows device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, removing user-installed Win32 apps and restoring policy-managed apps and settings. Prefer this route whenever the device ID is known. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `keep_user_data` | boolean | No | When true, preserve user accounts and data during the Windows clean; when false, remove them. Omit to use the device's default behavior. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: Cleans the Windows device by removing user-installed Win32 apps and restoring policy-managed apps and settings. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Commit Apps Content Versions Content File **Slug:** `MICROSOFT_INTUNE_COMMIT_APPS_CONTENT_VERSIONS_CONTENT_FILE` Commit an uploaded content file to a specific Intune mobile-app content version using its encryption metadata. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | | `file_encryption_info` | object | No | The file encryption info parameter key. A PowerShell script example of the file upload process using the ProfileVersion1 encryption scheme can be found at https://aka.ms/fileencryptioninfo. | | `mobile_app_content_id` | string | Yes | Intune content-version ID returned by LIST_APPS_CONTENT_VERSIONS or GET_APPS_CONTENT_VERSION. | | `mobile_app_content_file_id` | string | Yes | Content-file ID returned by Microsoft Graph's file-upload response for this version; resolve the parent with LIST_APPS_CONTENT_VERSIONS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create App **Slug:** `MICROSOFT_INTUNE_CREATE_APP` Create an Intune Android line-of-business app record for deploying an uploaded APK package. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `notes` | string | Yes | Notes for the app. Inherited from mobileApp | | `owner` | string | Yes | The owner of the app. Inherited from mobileApp | | `developer` | string | Yes | The developer of the app. Inherited from mobileApp | | `file_name` | string | Yes | The name of the main Lob application file. Inherited from mobileLobApp | | `publisher` | string | Yes | The publisher of the app. Inherited from mobileApp | | `large_icon` | object | Yes | The large icon, to be displayed in the app details and used for upload of the icon. Inherited from mobileApp | | `package_id` | string | Yes | The package identifier. | | `description` | string | Yes | The description of the app. Inherited from mobileApp | | `is_featured` | boolean | Yes | The value indicating whether the app is marked as featured by the admin. Inherited from mobileApp | | `display_name` | string | Yes | The admin provided or imported title of the app. Inherited from mobileApp | | `version_code` | string | Yes | The version code of Android Line of Business (LoB) app. | | `version_name` | string | Yes | The version name of Android Line of Business (LoB) app. | | `information_url` | string | Yes | The more information Url. Inherited from mobileApp | | `privacy_information_url` | string | Yes | The privacy statement Url. Inherited from mobileApp | | `committed_content_version` | string | Yes | The internal committed content version. Inherited from mobileLobApp | | `minimum_supported_operating_system` | object | Yes | The value for the minimum applicable operating system. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create App Category **Slug:** `MICROSOFT_INTUNE_CREATE_APP_CATEGORY` Create a tenant-wide Intune app category that can be attached to mobile apps. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `display_name` | string | Yes | The name of the app category. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create App Config **Slug:** `MICROSOFT_INTUNE_CREATE_APP_CONFIG` Create an Intune iOS managed-app configuration that delivers app settings to targeted devices. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | string | No | Key of the entity. Inherited from managedDeviceMobileAppConfiguration | | `version` | integer | Yes | Version of the device configuration. Inherited from managedDeviceMobileAppConfiguration | | `settings` | array | Yes | app configuration setting items. | | `description` | string | Yes | Admin provided description of the Device Configuration. Inherited from managedDeviceMobileAppConfiguration | | `display_name` | string | Yes | Admin provided name of the device configuration. Inherited from managedDeviceMobileAppConfiguration | | `created_date_time` | string | No | DateTime the object was created. Inherited from managedDeviceMobileAppConfiguration | | `encoded_setting_xml` | string | Yes | mdm app configuration Base64 binary. | | `targeted_mobile_apps` | array | Yes | the associated app. Inherited from managedDeviceMobileAppConfiguration | | `last_modified_date_time` | string | No | DateTime the object was last modified. Inherited from managedDeviceMobileAppConfiguration | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Apps Assignment **Slug:** `MICROSOFT_INTUNE_CREATE_APPS_ASSIGNMENT` Create one Intune app deployment assignment with an install intent and target, without replacing sibling assignments. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `intent` | string ("available" | "required" | "uninstall" | "availableWithoutEnrollment") | Yes | The install intent defined by the admin. The possible values are: `available`, `required`, `uninstall`, `availableWithoutEnrollment`. | | `target` | object | Yes | The target group assignment defined by the admin. | | `settings` | object | No | The settings for target assignment defined by the admin. | | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Apps Categories **Slug:** `MICROSOFT_INTUNE_CREATE_APPS_CATEGORIES` Attach an existing tenant-wide Intune category to a specific mobile app. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | | `mobile_app_category_id` | string | Yes | Tenant-wide Intune app-category ID returned by LIST_APP_CATEGORIES or CREATE_APP_CATEGORY. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Apps Content Version **Slug:** `MICROSOFT_INTUNE_CREATE_APPS_CONTENT_VERSION` Create mobileAppContent through the provider-required microsoft.graph.mobileLobApp cast. This generic-call-surface variant is retained separately from the mobile-LOB and managed-LOB endpoint-fidelity variants. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Apps Content Versions Contained App **Slug:** `MICROSOFT_INTUNE_CREATE_APPS_CONTENT_VERSIONS_CONTAINED_APP` Create a Windows Universal AppX contained-app entry under a specific generic content version; use the committed-contained-app create tool for the app-level committed route. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune Windows Universal AppX ID returned by LIST_APPS or GET_APP. | | `app_user_model_id` | string | Yes | The app user model ID of the contained app of a WindowsUniversalAppX app. | | `mobile_app_content_id` | string | Yes | Generic content-version ID returned by LIST_APPS_CONTENT_VERSIONS or GET_APPS_CONTENT_VERSION. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Apps Windows Universal App X Committed Contained Apps **Slug:** `MICROSOFT_INTUNE_CREATE_COMMITTED_CONTAINED_APP` Create a contained-app entry on a Windows Universal AppX app's committedContainedApps route, independent of a specific content-version route. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune Windows Universal AppX ID returned by LIST_APPS or GET_APP. | | `app_user_model_id` | string | Yes | The app user model ID of the contained app of a WindowsUniversalAppX app. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Compliance Policy **Slug:** `MICROSOFT_INTUNE_CREATE_COMPLIANCE_POLICY` Create a legacy Android compliance policy with its required scheduled block action embedded in the initial request. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `version` | integer | No | Version of the device configuration. Inherited from deviceCompliancePolicy | | `description` | string | No | Admin provided description of the Device Configuration. Inherited from deviceCompliancePolicy | | `display_name` | string | Yes | Admin provided name of the device configuration. Inherited from deviceCompliancePolicy | | `password_required` | boolean | No | Require a password to unlock device. | | `os_maximum_version` | string | No | Maximum Android version. | | `os_minimum_version` | string | No | Minimum Android version. | | `password_required_type` | string ("deviceDefault" | "alphabetic" | "alphanumeric" | "alphanumericWithSymbols" | "lowSecurityBiometric" | "numeric" | "numericComplex" | "any") | No | Type of characters in password. The possible values are: `deviceDefault`, `alphabetic`, `alphanumeric`, `alphanumericWithSymbols`, `lowSecurityBiometric`, `numeric`, `numericComplex`, `any`. | | `password_minimum_length` | integer | No | Minimum password length. Valid values 4 to 16 | | `password_expiration_days` | integer | No | Number of days before the password expires. Valid values 1 to 365 | | `scheduled_actions_for_rule` | array | No | Required compliance schedule. Each rule must contain exactly one block action; the default blocks immediately when PasswordRequired fails. | | `storage_require_encryption` | boolean | No | Require encryption on Android devices. | | `security_require_verify_apps` | boolean | No | Require the Android Verify apps feature is turned on. | | `security_disable_usb_debugging` | boolean | No | Disable USB debugging on Android devices. | | `device_threat_protection_enabled` | boolean | No | Require that devices have enabled device threat protection. | | `min_android_security_patch_level` | string | No | Minimum Android security patch level. | | `security_block_jailbroken_devices` | boolean | No | Indicates the device should not be rooted. When TRUE, if the device is detected as rooted it will be reported non-compliant. When FALSE, the device is not reported as non-compliant regardless of device rooted state. Default is FALSE. | | `security_require_google_play_services` | boolean | No | Require Google Play Services to be installed and enabled on the device. | | `password_previous_password_block_count` | integer | No | Number of previous passwords to block. Valid values 1 to 24 | | `password_minutes_of_inactivity_before_lock` | integer | No | Minutes of inactivity before a password is required. | | `security_require_company_portal_app_integrity` | boolean | No | Require the device to pass the Company Portal client app runtime integrity check. | | `security_require_up_to_date_security_providers` | boolean | No | Require the device to have up to date security providers. The device will require Google Play Services to be enabled and up to date. | | `device_threat_protection_required_security_level` | string ("unavailable" | "secured" | "low" | "medium" | "high" | "notSet") | No | Require Mobile Threat Protection minimum risk level to report noncompliance. The possible values are: `unavailable`, `secured`, `low`, `medium`, `high`, `notSet`. | | `security_prevent_install_apps_from_unknown_sources` | boolean | No | Require that devices disallow installation of apps from unknown sources. | | `security_require_safety_net_attestation_basic_integrity` | boolean | No | Require the device to pass the SafetyNet basic integrity check. | | `security_require_safety_net_attestation_certified_device` | boolean | No | Require the device to pass the SafetyNet certified device check. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Compliance Setting State **Slug:** `MICROSOFT_INTUNE_CREATE_COMPLIANCE_SETTING_STATE` Create one device-and-user compliance observation under a setting summary, not aggregate setting counts. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `state` | string ("unknown" | "notApplicable" | "compliant" | "remediated" | "nonCompliant" | "error" | "conflict" | "notAssigned") | No | The compliance state of the setting. | | `setting` | string | No | The setting class name and property name. | | `user_id` | string | No | The user Id that is being reported | | `device_id` | string | No | The Device Id that is being reported | | `user_name` | string | No | The User Name that is being reported | | `user_email` | string | No | The User email address that is being reported | | `device_name` | string | No | The Device Name that is being reported | | `device_model` | string | No | The device model that is being reported | | `setting_name` | string | No | The Setting Name that is being reported | | `user_principal_name` | string | No | The User PrincipalName that is being reported | | `compliance_grace_period_expiration_date_time` | string | No | The DateTime when device compliance grace period expires | | `device_compliance_policy_setting_state_summary_id` | string | Yes | Intune compliance setting summary ID returned by LIST_COMPLIANCE_SETTING_SUMMARIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Detected App Device **Slug:** `MICROSOFT_INTUNE_CREATE_DETECTED_APP_DEVICE` Create a managed-device record under a specific detected app's managed-devices relationship. Select this route only when the detected app owns the creation context; Microsoft Graph does not serve direct creation on the tenant-wide managed-devices collection. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `notes` | string | No | Notes on the device created by IT Admin. Default is null. To retrieve actual values GET call needs to be made, with device id and included in select parameter. Supports: $select. $Search is not supported. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; the new device relationship is created under this app. | | `managed_device_name` | string | No | Automatically generated name to identify a device. Can be overwritten to a user friendly name. | | `managed_device_owner_type` | string ("unknown" | "company" | "personal") | No | Ownership of the device. Can be 'company' or 'personal'. The possible values are: `unknown`, `company`, `personal`. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Detected App Device Malware State **Slug:** `MICROSOFT_INTUNE_CREATE_DETECTED_APP_DEVICE_MALWARE_STATE` Record a Windows malware detection and its severity, execution, remediation, and threat state beneath a device reached from a detected app. Returns the created malware-state record. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | string | No | The unique Identifier. This is malware id. | | `state` | string ("unknown" | "detected" | "cleaned" | "quarantined" | "removed" | "allowed" | "blocked" | "cleanFailed" | "quarantineFailed" | "removeFailed" | "allowFailed" | "abandoned" | "blockFailed") | No | Current status of the malware like cleaned/quarantined/allowed etc. The possible values are: `unknown`, `detected`, `cleaned`, `quarantined`, `removed`, `allowed`, `blocked`, `cleanFailed`, `quarantineFailed`, `removeFailed`, `allowFailed`, `abandoned`, `blockFailed`. | | `category` | string ("invalid" | "adware" | "spyware" | "passwordStealer" | "trojanDownloader" | "worm" | "backdoor" | "remoteAccessTrojan" | "trojan" | "emailFlooder" | "keylogger" | "dialer" | "monitoringSoftware" | "browserModifier" | "cookie" | "browserPlugin" | "aolExploit" | "nuker" | "securityDisabler" | "jokeProgram" | "hostileActiveXControl" | "softwareBundler" | "stealthNotifier" | "settingsModifier" | "toolBar" | "remoteControlSoftware" | "trojanFtp" | "potentialUnwantedSoftware" | "icqExploit" | "trojanTelnet" | "exploit" | "filesharingProgram" | "malwareCreationTool" | "remote_Control_Software" | "tool" | "trojanDenialOfService" | "trojanDropper" | "trojanMassMailer" | "trojanMonitoringSoftware" | "trojanProxyServer" | "virus" | "known" | "unknown" | "spp" | "behavior" | "vulnerability" | "policy" | "enterpriseUnwantedSoftware" | "ransom" | "hipsRule") | No | Category of the malware. The possible values are: `invalid`, `adware`, `spyware`, `passwordStealer`, `trojanDownloader`, `worm`, `backdoor`, `remoteAccessTrojan`, `trojan`, `emailFlooder`, `keylogger`, `dialer`, `monitoringSoftware`, `browserModifier`, `cookie`, `browserPlugin`, `aolExploit`, `nuker`, `securityDisabler`, `jokeProgram`, `hostileActiveXControl`, `softwareBundler`, `stealthNotifier`, `settingsModifier`, `toolBar`, `remoteControlSoftware`, `trojanFtp`, `potentialUnwantedSoftware`, `icqExploit`, `trojanTelnet`, `exploit`, `filesharingProgram`, `malwareCreationTool`, `remote_Control_Software`, `tool`, `trojanDenialOfService`, `trojanDropper`, `trojanMassMailer`, `trojanMonitoringSoftware`, `trojanProxyServer`, `virus`, `known`, `unknown`, `spp`, `behavior`, `vulnerability`, `policy`, `enterpriseUnwantedSoftware`, `ransom`, `hipsRule`. | | `severity` | string ("unknown" | "low" | "moderate" | "high" | "severe") | No | Severity of the malware. The possible values are: `unknown`, `low`, `moderate`, `high`, `severe`. | | `display_name` | string | No | Malware name | | `threat_state` | string ("active" | "actionFailed" | "manualStepsRequired" | "fullScanRequired" | "rebootRequired" | "remediatedWithNonCriticalFailures" | "quarantined" | "removed" | "cleaned" | "allowed" | "noStatusCleared") | No | Current status of the malware like cleaned/quarantined/allowed etc. The possible values are: `active`, `actionFailed`, `manualStepsRequired`, `fullScanRequired`, `rebootRequired`, `remediatedWithNonCriticalFailures`, `quarantined`, `removed`, `cleaned`, `allowed`, `noStatusCleared`. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `detection_count` | integer | No | Number of times the malware is detected | | `execution_state` | string ("unknown" | "blocked" | "allowed" | "running" | "notRunning") | No | Execution status of the malware like blocked/executing etc. The possible values are: `unknown`, `blocked`, `allowed`, `running`, `notRunning`. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; the malware state is created under this relationship. | | `additional_information_url` | string | No | Information URL to learn more about the malware | | `initial_detection_date_time` | string | No | Initial detection datetime of the malware | | `last_state_change_date_time` | string | No | The last time this particular threat was changed | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Detected App Devices Log Request **Slug:** `MICROSOFT_INTUNE_CREATE_DETECTED_APP_DEVICES_LOG_REQUEST` Create a device log-collection request under the managed device reached from a detected app. Returns the request record and its status; use this route only in that relationship context. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | string | No | The unique identifier in the form of tenantId_deviceId_requestId. | | `status` | string ("pending" | "completed" | "failed" | "unknownFutureValue") | No | Indicates the status for the app log collection request if it is pending, completed or failed, Default is pending. The possible values are: `pending`, `completed`, `failed`, `unknownFutureValue`. | | `size_in_kb` | number | No | The size of the logs in KB. Valid values -1.79769313486232E+308 to 1.79769313486232E+308 | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `enrolled_by_user` | string | No | The User Principal Name (UPN) of the user that enrolled the device. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; the log request is created under this relationship. | | `log_managed_device_id` | string | No | Indicates Intune device unique identifier. | | `received_date_time_utc` | string | No | The DateTime the request was received. | | `requested_date_time_utc` | string | No | The DateTime of the request. | | `expiration_date_time_utc` | string | No | The DateTime of the expiration of the logs. | | `initiated_by_user_principal_name` | string | No | The UPN for who initiated the request. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Detected App Devices User **Slug:** `MICROSOFT_INTUNE_CREATE_DETECTED_APP_DEVICES_USER` Submit Microsoft Graph's documented discriminator-only request to create a user relationship beneath the managed device reached from a detected app. The route accepts no caller-specified user properties and does not create a Microsoft Entra user. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; the user relationship is created under this device. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Detected App User Device **Slug:** `MICROSOFT_INTUNE_CREATE_DETECTED_APP_USER_DEVICE` Create a managed-device record under a user reached through a detected app and one of its devices. Select this deeply nested route only when continuing that detected-app/user traversal; Microsoft Graph does not serve direct creation on the tenant-wide managed-devices collection. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `notes` | string | No | Notes on the device created by IT Admin. Default is null. To retrieve actual values GET call needs to be made, with device id and included in select parameter. Supports: $select. $Search is not supported. | | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device; the new device relationship is created under this user. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `managed_device_name` | string | No | Automatically generated name to identify a device. Can be overwritten to a user friendly name. | | `managed_device_owner_type` | string ("unknown" | "company" | "personal") | No | Ownership of the device. Can be 'company' or 'personal'. The possible values are: `unknown`, `company`, `personal`. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Device Config **Slug:** `MICROSOFT_INTUNE_CREATE_DEVICE_CONFIG` Create an Android custom device configuration with OMA settings in Intune. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `version` | integer | No | Version of the device configuration. Inherited from deviceConfiguration | | `description` | string | No | Admin provided description of the Device Configuration. Inherited from deviceConfiguration | | `display_name` | string | No | Admin provided name of the device configuration. Inherited from deviceConfiguration | | `oma_settings` | array | No | OMA settings. This collection can contain a maximum of 1000 elements. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Device Configs Assignment **Slug:** `MICROSOFT_INTUNE_CREATE_DEVICE_CONFIGS_ASSIGNMENT` Create one group, user, device, collection, exclusion, or scope-tag assignment for an Intune device configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `target` | object | Yes | The assignment target for the device configuration. | | `device_configuration_id` | string | Yes | ID of the Intune device configuration that will own the assignment. Obtain it from LIST_DEVICE_CONFIGS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Enrollment Configs Assignment **Slug:** `MICROSOFT_INTUNE_CREATE_ENROLLMENT_CONFIGS_ASSIGNMENT` Create one target assignment on a device enrollment configuration for a group, collection, all devices, or all licensed users. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `target` | object | Yes | Target that determines which tenant users or devices receive the device enrollment configuration. | | `device_enrollment_configuration_id` | string | Yes | Microsoft Graph ID of the device enrollment configuration that will receive the assignment. Obtain it from LIST_ENROLLMENT_CONFIGS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Enrollment Limit Config **Slug:** `MICROSOFT_INTUNE_CREATE_ENROLLMENT_LIMIT_CONFIG` Create one enrollment limit configuration that caps how many devices targeted users may enroll. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `limit` | integer | No | Maximum number of devices each targeted user may enroll. | | `version` | integer | No | Version number to store on the enrollment limit configuration. | | `priority` | integer | No | Precedence among configurations assigned to the same user; the lowest numeric value applies. | | `description` | string | No | Administrative description for the enrollment limit configuration. | | `display_name` | string | No | Human-readable name for the enrollment limit configuration. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Export Job **Slug:** `MICROSOFT_INTUNE_CREATE_EXPORT_JOB` Create a persisted Microsoft Intune report export job. Graph returns the new job with HTTP 201; poll the job until completion before using its temporary download URL. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `url` | string | No | Temporary location of the exported report. | | `filter` | string | No | Filters applied on the report. The maximum length allowed for this property is 2000 characters. | | `format` | string ("csv" | "json" | "pdf" | "unknownFutureValue") | No | Exported report format. The possible values are: `csv`, `pdf`, `json`, `unknownFutureValue`. | | `select` | array | No | Columns selected from the report. The maximum number of allowed columns names is 256. The maximum length allowed for each column name in this property is 1000 characters. | | `status` | string ("unknown" | "notStarted" | "inProgress" | "completed" | "failed") | No | Status of the export job. Possible values are `unknown`, `notStarted`, `inProgress`, `completed` and `failed`. The possible values are: `unknown`, `notStarted`, `inProgress`, `completed`, `failed`. | | `report_name` | string | Yes | Name of the report. The maximum length allowed for this property is 2000 characters. | | `snapshot_id` | string | No | A snapshot is an identifiable subset of the dataset represented by the ReportName. A sessionId or CachedReportConfiguration id can be used here. If a sessionId is specified, Filter, Select, and OrderBy are applied to the data represented by the sessionId. Filter, Select, and OrderBy cannot be specified together with a CachedReportConfiguration id. The maximum length allowed for this property is 128 characters. | | `localization_type` | string ("replaceLocalizableValues" | "localizedValuesAsAdditionalColumn") | No | Configures how the requested export job is localized. Possible values are `replaceLocalizableValues` and `localizedValuesAsAdditionalColumn`. The possible values are: `localizedValuesAsAdditionalColumn`, `replaceLocalizableValues`. | | `request_date_time` | string | No | Time that the exported report was requested. | | `expiration_date_time` | string | No | Time that the exported report expires. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Imported Autopilot Device **Slug:** `MICROSOFT_INTUNE_CREATE_IMPORTED_AUTOPILOT_DEVICE` Stage one imported Windows Autopilot device identity in Intune from its serial number, hardware identifier, and optional assignment metadata. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `state` | object | No | Current provider processing state for this staged device identity. | | `group_tag` | string | No | Windows Autopilot group tag used for dynamic device grouping and profile assignment. | | `import_id` | string | No | Caller-supplied import ID used to correlate this staged device identity. | | `product_key` | string | No | Windows product key associated with the imported device identity. | | `serial_number` | string | No | Serial number of the Windows autopilot device. | | `hardware_identifier` | string | No | Base64-encoded hardware identifier used to register the Windows Autopilot device. | | `assigned_user_principal_name` | string | No | Microsoft Entra user principal name to assign when the device is imported. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Log Request Detected App Device **Slug:** `MICROSOFT_INTUNE_CREATE_LOG_REQUEST_DETECTED_APP_DEVICE` Create a diagnostic log-collection request for a device addressed as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`. Select only while traversing from a detected app; prefer `MICROSOFT_INTUNE_CREATE_LOG_REQUEST_MANAGED_DEVICE` otherwise. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `template_type` | object | Yes | Required device log-collection request object, including its request ID and template selection. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Log Request Detected App User Device **Slug:** `MICROSOFT_INTUNE_CREATE_LOG_REQUEST_DETECTED_APP_USER_DEVICE` Create a diagnostic log-collection request for a device addressed through its detected-app membership and associated user. Select only while traversing from that app and user; prefer `MICROSOFT_INTUNE_CREATE_LOG_REQUEST_MANAGED_DEVICE` otherwise. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `template_type` | object | Yes | Required device log-collection request object, including its request ID and template selection. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Outer Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reuses it before and after the user segment. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Log Request Managed Device **Slug:** `MICROSOFT_INTUNE_CREATE_LOG_REQUEST_MANAGED_DEVICE` Create a diagnostic log-collection request through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this direct route whenever the managed-device ID is known. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `template_type` | object | Yes | Required device log-collection request object, including its request ID and template selection. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Apps Managed Mobile Lob App Content Version **Slug:** `MICROSOFT_INTUNE_CREATE_MANAGED_LOB_CONTENT_VERSION` Create mobileAppContent in a managed mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This managed-LOB endpoint-fidelity variant is retained separately from the generic and mobile-LOB variants. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune managed mobile LOB app ID returned by LIST_APPS or GET_APP. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Apps Mobile Lob App Content Version **Slug:** `MICROSOFT_INTUNE_CREATE_MOBILE_LOB_CONTENT_VERSION` Create mobileAppContent in a mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This mobile-LOB endpoint-fidelity variant is retained separately from the generic and managed-LOB variants. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune mobile LOB app ID returned by LIST_APPS or GET_APP. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete App **Slug:** `MICROSOFT_INTUNE_DELETE_APP` Delete an Intune Android line-of-business app record used for APK deployment. This permanently destroys only the app record; it does not imply a device wipe. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete App Category **Slug:** `MICROSOFT_INTUNE_DELETE_APP_CATEGORY` Delete a tenant-wide Intune app category, not merely one app's category relationship. This permanently destroys only the category; it does not imply a device wipe. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_category_id` | string | Yes | Tenant-wide Intune app-category ID returned by LIST_APP_CATEGORIES or GET_APP_CATEGORY. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete App Config **Slug:** `MICROSOFT_INTUNE_DELETE_APP_CONFIG` Delete an Intune iOS managed-app configuration used to deliver app settings. This permanently destroys only the configuration; it does not imply a device wipe. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | | `managed_device_mobile_app_configuration_id` | string | Yes | Intune mobile-app configuration ID returned by LIST_APP_CONFIGS or GET_APP_CONFIG. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete App Configs Assignment **Slug:** `MICROSOFT_INTUNE_DELETE_APP_CONFIGS_ASSIGNMENT` Delete one target assignment from an Intune mobile-app configuration. This permanently destroys only the assignment; it does not imply a device wipe. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | | `managed_device_mobile_app_configuration_id` | string | Yes | Intune mobile-app configuration ID returned by LIST_APP_CONFIGS or GET_APP_CONFIG. | | `managed_device_mobile_app_configuration_assignment_id` | string | Yes | Intune app-configuration assignment ID returned by LIST_APP_CONFIGS_ASSIGNMENTS or GET_APP_CONFIGS_ASSIGNMENT. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete App Configs Device Status **Slug:** `MICROSOFT_INTUNE_DELETE_APP_CONFIGS_DEVICE_STATUS` Delete one device deployment-status record from an Intune mobile-app configuration. This permanently destroys only the status record; it does not imply a device wipe. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | | `managed_device_mobile_app_configuration_id` | string | Yes | Intune mobile-app configuration ID returned by LIST_APP_CONFIGS or GET_APP_CONFIG. | | `managed_device_mobile_app_configuration_device_status_id` | string | Yes | Intune app-configuration device-status ID returned by LIST_APP_CONFIGS_DEVICE_STATUSES or GET_APP_CONFIGS_DEVICE_STATUS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete App Configs User Status **Slug:** `MICROSOFT_INTUNE_DELETE_APP_CONFIGS_USER_STATUS` Delete one user deployment-status record from an Intune mobile-app configuration. This permanently destroys only the status record; it does not imply a device wipe. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | | `managed_device_mobile_app_configuration_id` | string | Yes | Intune mobile-app configuration ID returned by LIST_APP_CONFIGS or GET_APP_CONFIG. | | `managed_device_mobile_app_configuration_user_status_id` | string | Yes | Intune app-configuration user-status ID returned by LIST_APP_CONFIGS_USER_STATUSES or GET_APP_CONFIGS_USER_STATUS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Apps Assignment **Slug:** `MICROSOFT_INTUNE_DELETE_APPS_ASSIGNMENT` Delete one install-intent target assignment from an Intune mobile app. This permanently destroys only the assignment; it does not imply a device wipe. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | | `mobile_app_assignment_id` | string | Yes | Intune mobile-app assignment ID returned by LIST_APPS_ASSIGNMENTS or GET_APPS_ASSIGNMENT. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Apps Categories **Slug:** `MICROSOFT_INTUNE_DELETE_APPS_CATEGORIES` Detach an Intune category from a specific mobile app without deleting the tenant-wide category. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | | `mobile_app_category_id` | string | Yes | Tenant-wide Intune app-category ID attached to this app and returned by LIST_APPS_CATEGORIES. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Apps Content Version **Slug:** `MICROSOFT_INTUNE_DELETE_APPS_CONTENT_VERSION` Delete mobileAppContent through the provider-required microsoft.graph.mobileLobApp cast. This generic-call-surface variant is retained separately from the mobile-LOB and managed-LOB endpoint-fidelity variants. This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | | `mobile_app_content_id` | string | Yes | Intune content-version ID returned by LIST_APPS_CONTENT_VERSIONS or GET_APPS_CONTENT_VERSION. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Apps Content Versions Contained App **Slug:** `MICROSOFT_INTUNE_DELETE_APPS_CONTENT_VERSIONS_CONTAINED_APP` Delete a Windows Universal AppX contained-app entry from a specific generic content version, not the app-level committed route. This permanently destroys only that entry; it does not imply a device wipe. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune Windows Universal AppX ID returned by LIST_APPS or GET_APP. | | `mobile_app_content_id` | string | Yes | Generic content-version ID returned by LIST_APPS_CONTENT_VERSIONS or GET_APPS_CONTENT_VERSION. | | `mobile_contained_app_id` | string | Yes | Contained-app ID returned by LIST_APPS_CONTENT_VERSIONS_CONTAINED_APPS or GET_APPS_CONTENT_VERSIONS_CONTAINED_APP. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Apps Content Versions Content File **Slug:** `MICROSOFT_INTUNE_DELETE_APPS_CONTENT_VERSIONS_CONTENT_FILE` Delete an uploaded content file from a specific Intune mobile-app content version. This permanently destroys only the file record; it does not imply a device wipe. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | | `mobile_app_content_id` | string | Yes | Intune content-version ID returned by LIST_APPS_CONTENT_VERSIONS or GET_APPS_CONTENT_VERSION. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | | `mobile_app_content_file_id` | string | Yes | Content-file ID returned by Microsoft Graph's file-upload response for this version; resolve the parent with LIST_APPS_CONTENT_VERSIONS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Autopilot Device **Slug:** `MICROSOFT_INTUNE_DELETE_AUTOPILOT_DEVICE` Permanently unregister one Windows Autopilot device identity without wiping the physical device. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge permanent removal of this Windows Autopilot identity without wiping the physical device. | | `windows_autopilot_device_identity_id` | string | Yes | Microsoft Graph ID of the Windows Autopilot device identity to permanently unregister. Obtain it from LIST_AUTOPILOT_DEVICES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Apps Windows Universal App X Committed Contained Apps **Slug:** `MICROSOFT_INTUNE_DELETE_COMMITTED_CONTAINED_APP` Delete a contained-app entry from a Windows Universal AppX app's committedContainedApps route, not a specific content version. This permanently destroys only that entry; it does not imply a device wipe. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune Windows Universal AppX ID returned by LIST_APPS or GET_APP. | | `mobile_contained_app_id` | string | Yes | Committed contained-app ID returned by LIST_COMMITTED_CONTAINED_APPS or GET_COMMITTED_CONTAINED_APP. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Compliance Policy **Slug:** `MICROSOFT_INTUNE_DELETE_COMPLIANCE_POLICY` Delete one legacy Android compliance policy and its device requirements. This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | | `device_compliance_policy_id` | string | Yes | Intune compliance policy ID returned by LIST_COMPLIANCE_POLICIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Compliance Setting State **Slug:** `MICROSOFT_INTUNE_DELETE_COMPLIANCE_SETTING_STATE` Delete one device-and-user compliance observation under a setting summary. This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | | `device_compliance_setting_state_id` | string | Yes | Individual compliance setting state ID returned by LIST_COMPLIANCE_SETTING_STATES. | | `device_compliance_policy_setting_state_summary_id` | string | Yes | Intune compliance setting summary ID returned by LIST_COMPLIANCE_SETTING_SUMMARIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Compliance Setting Summary **Slug:** `MICROSOFT_INTUNE_DELETE_COMPLIANCE_SETTING_SUMMARY` Delete one setting-and-platform compliance count summary. This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | | `device_compliance_policy_setting_state_summary_id` | string | Yes | Intune compliance setting summary ID returned by LIST_COMPLIANCE_SETTING_SUMMARIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Detected App **Slug:** `MICROSOFT_INTUNE_DELETE_DETECTED_APP` Delete a detected application record. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Identifier of the detected application. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge permanent deletion of the detected application record. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Detected App Device **Slug:** `MICROSOFT_INTUNE_DELETE_DETECTED_APP_DEVICE` Delete a device addressed as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`; this removes its Intune record and can trigger Retire or Wipe. Select only while traversing from a detected app; prefer `MICROSOFT_INTUNE_DELETE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: Immediately removes the named Intune managed-device record and can trigger a platform-dependent Retire or Wipe command. The client-side command may finish later when the device checks in, and related external registrations are not necessarily removed. The tenant-wide limit is 1,000 delete actions per day. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Detected App Device Malware State **Slug:** `MICROSOFT_INTUNE_DELETE_DETECTED_APP_DEVICE_MALWARE_STATE` Deletes a windowsDeviceMalwareState. This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | | `windows_device_malware_state_id` | string | Yes | Intune malware-state ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICE_MALWARE_STATES` for the specified detected app and managed device. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Detected App Devices Log Request **Slug:** `MICROSOFT_INTUNE_DELETE_DETECTED_APP_DEVICES_LOG_REQUEST` Deletes a deviceLogCollectionResponse. This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | | `device_log_collection_response_id` | string | Yes | Intune log-request ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_LOG_REQUESTS` for the specified detected app and managed device. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Detected App Devices User **Slug:** `MICROSOFT_INTUNE_DELETE_DETECTED_APP_DEVICES_USER` Remove the user relationship record under the specified detected-app managed-device route. This does not delete the user's Microsoft Entra account or wipe the device. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge that this removes only the user relationship record under the specified detected-app managed-device route; the Microsoft Entra user account remains intact. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Detected App User Device **Slug:** `MICROSOFT_INTUNE_DELETE_DETECTED_APP_USER_DEVICE` Delete a device addressed through its detected-app membership and associated user; this removes its Intune record and can trigger Retire or Wipe. Select only while traversing from that app and user; prefer `MICROSOFT_INTUNE_DELETE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Outer Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reuses it before and after the user segment. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: Immediately removes the named Intune managed-device record and can trigger a platform-dependent Retire or Wipe command. The client-side command may finish later when the device checks in, and related external registrations are not necessarily removed. The tenant-wide limit is 1,000 delete actions per day. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Device Config **Slug:** `MICROSOFT_INTUNE_DELETE_DEVICE_CONFIG` Permanently delete an Android custom device configuration from Intune; this does not wipe devices. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `device_configuration_id` | string | Yes | ID of the Android custom device configuration to delete. Obtain it from LIST_DEVICE_CONFIGS and select an item whose `@odata.type` is `#microsoft.graph.androidCustomConfiguration`; this action cannot verify the subtype before mutation. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Device Configs Assignment **Slug:** `MICROSOFT_INTUNE_DELETE_DEVICE_CONFIGS_ASSIGNMENT` Permanently delete one assignment from an Intune device configuration; this does not delete or wipe devices. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `device_configuration_id` | string | Yes | ID of the Intune device configuration that owns the assignment. Obtain it from LIST_DEVICE_CONFIGS. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | | `device_configuration_assignment_id` | string | Yes | ID of the assignment to delete. Obtain it from LIST_DEVICE_CONFIGS_ASSIGNMENTS for the same device configuration. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Enrollment Configs Assignment **Slug:** `MICROSOFT_INTUNE_DELETE_ENROLLMENT_CONFIGS_ASSIGNMENT` Permanently remove one target assignment from a device enrollment configuration without deleting the configuration or wiping devices. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge permanent removal of this target assignment without deleting the device enrollment configuration. | | `device_enrollment_configuration_id` | string | Yes | Microsoft Graph ID of the device enrollment configuration that owns the assignment. Obtain it from LIST_ENROLLMENT_CONFIGS. | | `enrollment_configuration_assignment_id` | string | Yes | Microsoft Graph ID of the assignment to permanently remove. Obtain it from LIST_ENROLLMENT_CONFIGS_ASSIGNMENTS for the owning configuration. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Enrollment Limit Config **Slug:** `MICROSOFT_INTUNE_DELETE_ENROLLMENT_LIMIT_CONFIG` Permanently delete one enrollment limit configuration without wiping or unenrolling any device. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge permanent deletion of this enrollment limit configuration without wiping or unenrolling devices. | | `device_enrollment_configuration_id` | string | Yes | Microsoft Graph ID of the enrollment limit configuration to permanently delete. Obtain it from LIST_ENROLLMENT_CONFIGS and select a deviceEnrollmentLimitConfiguration row. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Export Job **Slug:** `MICROSOFT_INTUNE_DELETE_EXPORT_JOB` Permanently delete one Intune report export-job resource selected by ID; this does not delete or wipe devices. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | | `device_management_export_job_id` | string | Yes | Intune report export-job ID returned by `MICROSOFT_INTUNE_CREATE_EXPORT_JOB` or `MICROSOFT_INTUNE_LIST_EXPORT_JOBS`. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Imported Autopilot Device **Slug:** `MICROSOFT_INTUNE_DELETE_IMPORTED_AUTOPILOT_DEVICE` Permanently delete one staged imported Windows Autopilot device identity without wiping the physical device. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge permanent deletion of this staged imported identity without wiping the physical device. | | `imported_windows_autopilot_device_identity_id` | string | Yes | Microsoft Graph ID of the staged imported Windows Autopilot device identity to delete. Obtain it from LIST_IMPORTED_AUTOPILOT_DEVICES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Managed Device **Slug:** `MICROSOFT_INTUNE_DELETE_MANAGED_DEVICE` Delete a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Immediately removes its Intune record and can trigger a platform-dependent Retire or Wipe command. Prefer this direct route whenever the device ID is known. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: Immediately removes the named Intune managed-device record and can trigger a platform-dependent Retire or Wipe command. The client-side command may finish later when the device checks in, and related external registrations are not necessarily removed. The tenant-wide limit is 1,000 delete actions per day. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Apps Managed Mobile Lob App Content Version **Slug:** `MICROSOFT_INTUNE_DELETE_MANAGED_LOB_CONTENT_VERSION` Delete mobileAppContent in a managed mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This managed-LOB endpoint-fidelity variant is retained separately from the generic and mobile-LOB variants. This destroys only this content version and requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune managed mobile LOB app ID returned by LIST_APPS or GET_APP. | | `mobile_app_content_id` | string | Yes | Managed mobile LOB content-version ID returned by LIST_MANAGED_LOB_CONTENT_VERSIONS or GET_MANAGED_LOB_CONTENT_VERSION. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Apps Mobile Lob App Content Version **Slug:** `MICROSOFT_INTUNE_DELETE_MOBILE_LOB_CONTENT_VERSION` Delete mobileAppContent in a mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This mobile-LOB endpoint-fidelity variant is retained separately from the generic and managed-LOB variants. This destroys only this content version and requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune mobile LOB app ID returned by LIST_APPS or GET_APP. | | `mobile_app_content_id` | string | Yes | Mobile LOB content-version ID returned by LIST_MOBILE_LOB_CONTENT_VERSIONS or GET_MOBILE_LOB_CONTENT_VERSION. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Shared Apple User Detected App Device **Slug:** `MICROSOFT_INTUNE_DELETE_SHARED_APPLE_USER_DETECTED_APP_DEVICE` Delete a user and that user's data from a shared Apple device addressed as a detected app's managed-device member. Select only while traversing from that detected app; prefer `MICROSOFT_INTUNE_DELETE_SHARED_APPLE_USER_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `user_principal_name` | string | No | User principal name of the shared Apple device user to remove, in name@domain form. Omit only when Intune can infer the current shared user. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: Deletes the named user and that user's data from the shared Apple device. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Shared Apple User Detected App User Device **Slug:** `MICROSOFT_INTUNE_DELETE_SHARED_APPLE_USER_DETECTED_APP_USER_DEVICE` Delete a user and that user's data from a shared Apple device addressed through a detected app and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_DELETE_SHARED_APPLE_USER_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Outer Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reuses it before and after the user segment. | | `user_principal_name` | string | No | User principal name of the shared Apple device user to remove, in name@domain form. Omit only when Intune can infer the current shared user. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: Deletes the named user and that user's data from the shared Apple device. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Shared Apple User Managed Device **Slug:** `MICROSOFT_INTUNE_DELETE_SHARED_APPLE_USER_MANAGED_DEVICE` Delete a user and that user's data from a shared Apple device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the device ID is known. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. | | `user_principal_name` | string | No | User principal name of the shared Apple device user to remove, in name@domain form. Omit only when Intune can infer the current shared user. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: Deletes the named user and that user's data from the shared Apple device. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Disable Lost Mode Detected App Device **Slug:** `MICROSOFT_INTUNE_DISABLE_LOST_MODE_DETECTED_APP_DEVICE` Disable Lost Mode for a device addressed as a detected app's managed-device member, removing the recovery lock-screen details. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_DISABLE_LOST_MODE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge that disabling Lost Mode removes the administrative recovery lock-screen message and contact information and may expose a lost or stolen device. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Disable Lost Mode Detected App User Device **Slug:** `MICROSOFT_INTUNE_DISABLE_LOST_MODE_DETECTED_APP_USER_DEVICE` Disable Lost Mode for a device addressed through its detected-app membership and associated user, removing the recovery lock-screen details. Select only while traversing that context; prefer `MICROSOFT_INTUNE_DISABLE_LOST_MODE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Outer Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reuses it before and after the user segment. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge that disabling Lost Mode removes the administrative recovery lock-screen message and contact information and may expose a lost or stolen device. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Disable Lost Mode Managed Device **Slug:** `MICROSOFT_INTUNE_DISABLE_LOST_MODE_MANAGED_DEVICE` Disable Lost Mode through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, removing the recovery lock-screen message and contact information. Prefer this route whenever the device ID is known. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge that disabling Lost Mode removes the administrative recovery lock-screen message and contact information and may expose a lost or stolen device. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Enable App Architectures **Slug:** `MICROSOFT_INTUNE_ENABLE_APP_ARCHITECTURES` Enable applicable processor architectures for the named Win32 app. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune Win32 mobile-app ID returned by LIST_APPS or GET_APP. | | `applicable_architectures` | string ("none" | "x86" | "x64" | "x86,x64") | Yes | The applicable architectures for Win32LobApp. Valid values are 'none' or a combination of 'x86' and 'x64'. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get App **Slug:** `MICROSOFT_INTUNE_GET_APP` Get one Intune Android line-of-business app and its deployment metadata by app ID. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get App Category **Slug:** `MICROSOFT_INTUNE_GET_APP_CATEGORY` Get one tenant-wide Intune app category; use GET_APPS_CATEGORIES for a category through a specific app's categories route. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_category_id` | string | Yes | Tenant-wide Intune app-category ID returned by LIST_APP_CATEGORIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get App Config **Slug:** `MICROSOFT_INTUNE_GET_APP_CONFIG` Get one Intune iOS managed-app configuration and its delivered settings by configuration ID. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `managed_device_mobile_app_configuration_id` | string | Yes | Intune mobile-app configuration ID returned by LIST_APP_CONFIGS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get App Configs Assignment **Slug:** `MICROSOFT_INTUNE_GET_APP_CONFIGS_ASSIGNMENT` Get one target assignment for a specific Intune mobile-app configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `managed_device_mobile_app_configuration_id` | string | Yes | Intune mobile-app configuration ID returned by LIST_APP_CONFIGS or GET_APP_CONFIG. | | `managed_device_mobile_app_configuration_assignment_id` | string | Yes | Intune app-configuration assignment ID returned by LIST_APP_CONFIGS_ASSIGNMENTS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get App Configs Device Status **Slug:** `MICROSOFT_INTUNE_GET_APP_CONFIGS_DEVICE_STATUS` Get one device's deployment status for a specific Intune mobile-app configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `managed_device_mobile_app_configuration_id` | string | Yes | Intune mobile-app configuration ID returned by LIST_APP_CONFIGS or GET_APP_CONFIG. | | `managed_device_mobile_app_configuration_device_status_id` | string | Yes | Intune app-configuration device-status ID returned by LIST_APP_CONFIGS_DEVICE_STATUSES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get App Configs Device Status Summary **Slug:** `MICROSOFT_INTUNE_GET_APP_CONFIGS_DEVICE_STATUS_SUMMARY` Get aggregate per-device deployment outcome counts for a specific Intune mobile-app configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `managed_device_mobile_app_configuration_id` | string | Yes | Intune mobile-app configuration ID returned by LIST_APP_CONFIGS or GET_APP_CONFIG. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get App Configs User Status **Slug:** `MICROSOFT_INTUNE_GET_APP_CONFIGS_USER_STATUS` Get one user's deployment status for a specific Intune mobile-app configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `managed_device_mobile_app_configuration_id` | string | Yes | Intune mobile-app configuration ID returned by LIST_APP_CONFIGS or GET_APP_CONFIG. | | `managed_device_mobile_app_configuration_user_status_id` | string | Yes | Intune app-configuration user-status ID returned by LIST_APP_CONFIGS_USER_STATUSES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get App Configs User Status Summary **Slug:** `MICROSOFT_INTUNE_GET_APP_CONFIGS_USER_STATUS_SUMMARY` Get aggregate per-user deployment outcome counts for a specific Intune mobile-app configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `managed_device_mobile_app_configuration_id` | string | Yes | Intune mobile-app configuration ID returned by LIST_APP_CONFIGS or GET_APP_CONFIG. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Apps Assignment **Slug:** `MICROSOFT_INTUNE_GET_APPS_ASSIGNMENT` Get one Intune mobile-app assignment, including its install intent, target, and settings. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | | `mobile_app_assignment_id` | string | Yes | Intune mobile-app assignment ID returned by LIST_APPS_ASSIGNMENTS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Apps Categories **Slug:** `MICROSOFT_INTUNE_GET_APPS_CATEGORIES` Get one category through a specific mobile app's categories route; use GET_APP_CATEGORY for the tenant-wide category route. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | | `mobile_app_category_id` | string | Yes | Intune app-category ID returned for this app by LIST_APPS_CATEGORIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Apps Content Version **Slug:** `MICROSOFT_INTUNE_GET_APPS_CONTENT_VERSION` Read mobileAppContent through the provider-required microsoft.graph.mobileLobApp cast. This generic-call-surface variant is retained separately from the mobile-LOB and managed-LOB endpoint-fidelity variants. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | | `mobile_app_content_id` | string | Yes | Intune content-version ID returned by LIST_APPS_CONTENT_VERSIONS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Apps Content Versions Contained App **Slug:** `MICROSOFT_INTUNE_GET_APPS_CONTENT_VERSIONS_CONTAINED_APP` Get one Windows Universal AppX contained app from a specific generic content version; use the committed-contained-app get tool for the app-level committed route. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune Windows Universal AppX ID returned by LIST_APPS or GET_APP. | | `mobile_app_content_id` | string | Yes | Generic content-version ID returned by LIST_APPS_CONTENT_VERSIONS or GET_APPS_CONTENT_VERSION. | | `mobile_contained_app_id` | string | Yes | Contained-app ID returned by LIST_APPS_CONTENT_VERSIONS_CONTAINED_APPS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Autopilot Device **Slug:** `MICROSOFT_INTUNE_GET_AUTOPILOT_DEVICE` Retrieve one Windows Autopilot device identity, including its hardware, enrollment, and assigned-user properties. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `windows_autopilot_device_identity_id` | string | Yes | Microsoft Graph ID of the Windows Autopilot device identity to retrieve. Obtain it from LIST_AUTOPILOT_DEVICES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Cached Report **Slug:** `MICROSOFT_INTUNE_GET_CACHED_REPORT` Query cached Intune report data by ID, with optional column selection, grouping, ordering, search, and paging. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | string | Yes | Identifier of the cached Intune report data to query. | | `top` | integer | No | Maximum number of report rows to return. | | `skip` | integer | No | Number of report rows to skip. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Apps Windows Universal App X Committed Contained Apps **Slug:** `MICROSOFT_INTUNE_GET_COMMITTED_CONTAINED_APP` Get one contained app from a Windows Universal AppX app's committedContainedApps route; use the content-version contained-app get tool for a specific version. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune Windows Universal AppX ID returned by LIST_APPS or GET_APP. | | `mobile_contained_app_id` | string | Yes | Committed contained-app ID returned by LIST_COMMITTED_CONTAINED_APPS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Compliance Device Summary **Slug:** `MICROSOFT_INTUNE_GET_COMPLIANCE_DEVICE_SUMMARY` Get tenant-wide device counts by compliance-policy state; use a policy device status overview for one policy. #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Compliance Policies Device Status Overview **Slug:** `MICROSOFT_INTUNE_GET_COMPLIANCE_POLICIES_DEVICE_STATUS_OVERVIEW` Get aggregate compliant, noncompliant, error, and conflict device counts for one policy; use device statuses for individual records. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `device_compliance_policy_id` | string | Yes | Intune compliance policy ID returned by LIST_COMPLIANCE_POLICIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Compliance Policies User Status Overview **Slug:** `MICROSOFT_INTUNE_GET_COMPLIANCE_POLICIES_USER_STATUS_OVERVIEW` Get aggregate compliant, noncompliant, error, and conflict user counts for one policy; use user statuses for individual rollups. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `device_compliance_policy_id` | string | Yes | Intune compliance policy ID returned by LIST_COMPLIANCE_POLICIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Compliance Policy **Slug:** `MICROSOFT_INTUNE_GET_COMPLIANCE_POLICY` Get one legacy Android compliance policy and its device requirement settings; use LIST_COMPLIANCE_POLICIES to find its ID. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `device_compliance_policy_id` | string | Yes | Intune compliance policy ID returned by LIST_COMPLIANCE_POLICIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Compliance Policy Non Compliance Report **Slug:** `MICROSOFT_INTUNE_GET_COMPLIANCE_POLICY_NON_COMPLIANCE_REPORT` Query noncompliance details organized by Intune compliance policy; use the summary sibling for aggregated policy results. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `name` | string | Yes | Microsoft Graph requires this Intune report name to select the report variant. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Compliance Policy Non Compliance Summary Report **Slug:** `MICROSOFT_INTUNE_GET_COMPLIANCE_POLICY_NONCOMPLIANCE_SUMMARY` Query summarized noncompliance results organized by Intune compliance policy; use the detail sibling for non-summary results. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `name` | string | Yes | Microsoft Graph requires this Intune report name to select the report variant. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Compliance Setting Non Compliance Report **Slug:** `MICROSOFT_INTUNE_GET_COMPLIANCE_SETTING_NON_COMPLIANCE_REPORT` Query noncompliance results organized by compliance setting rather than by compliance policy. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `name` | string | Yes | Microsoft Graph requires this Intune report name to select the report variant. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Compliance Setting State **Slug:** `MICROSOFT_INTUNE_GET_COMPLIANCE_SETTING_STATE` Get one device-and-user compliance observation under a setting summary; use LIST_COMPLIANCE_SETTING_STATES to find its ID. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `device_compliance_setting_state_id` | string | Yes | Individual compliance setting state ID returned by LIST_COMPLIANCE_SETTING_STATES. | | `device_compliance_policy_setting_state_summary_id` | string | Yes | Intune compliance setting summary ID returned by LIST_COMPLIANCE_SETTING_SUMMARIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Compliance Setting Summary **Slug:** `MICROSOFT_INTUNE_GET_COMPLIANCE_SETTING_SUMMARY` Get one setting-and-platform compliance count summary; use LIST_COMPLIANCE_SETTING_SUMMARIES to find its ID. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `device_compliance_policy_setting_state_summary_id` | string | Yes | Intune compliance setting summary ID returned by LIST_COMPLIANCE_SETTING_SUMMARIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Configuration Policy Non Compliance Report **Slug:** `MICROSOFT_INTUNE_GET_CONFIGURATION_POLICY_NON_COMPLIANCE_REPORT` Query noncompliance details organized by Intune configuration policy; use the summary sibling for aggregated policy results. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `name` | string | Yes | Microsoft Graph requires this Intune report name to select the report variant. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Configuration Policy Non Compliance Summary Report **Slug:** `MICROSOFT_INTUNE_GET_CONFIGURATION_POLICY_NONCOMPLIANCE_SUMMARY` Query summarized noncompliance results organized by Intune configuration policy; use the detail sibling for non-summary results. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `name` | string | Yes | Microsoft Graph requires this Intune report name to select the report variant. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Configuration Setting Non Compliance Report **Slug:** `MICROSOFT_INTUNE_GET_CONFIGURATION_SETTING_NON_COMPLIANCE_REPORT` Query noncompliance results organized by configuration setting rather than by configuration policy. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `name` | string | Yes | Microsoft Graph requires this Intune report name to select the report variant. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Detected App **Slug:** `MICROSOFT_INTUNE_GET_DETECTED_APP` Retrieve one Intune detected-app inventory record by ID, including its platform, publisher, version, size, and device-count metadata. Use its ID to traverse the app's managed-device relationships. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Identifier of the detected application. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Detected App Device **Slug:** `MICROSOFT_INTUNE_GET_DETECTED_APP_DEVICE` Get one device as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`, returning exactly id, deviceName, operatingSystem, osVersion, complianceState, managementState, and lastSyncDateTime. Select only while traversing from a detected app; prefer `MICROSOFT_INTUNE_GET_MANAGED_DEVICE` otherwise. activationLockBypassCode and remoteAssistanceSessionUrl are omitted. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Detected App Device Malware State **Slug:** `MICROSOFT_INTUNE_GET_DETECTED_APP_DEVICE_MALWARE_STATE` Retrieve one malware-state record under a detected app's managed device, including threat identity, severity, execution state, remediation state, detection count, and timestamps. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `windows_device_malware_state_id` | string | Yes | Intune malware-state ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICE_MALWARE_STATES` for the specified detected app and managed device. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Detected App Devices Device Category **Slug:** `MICROSOFT_INTUNE_GET_DETECTED_APP_DEVICES_DEVICE_CATEGORY` Retrieve the category assigned to a managed device reached through a detected app, including the category ID and display metadata. Use only when preserving that detected-app relationship context. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reads that relationship's device category. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Detected App Devices Log Request **Slug:** `MICROSOFT_INTUNE_GET_DETECTED_APP_DEVICES_LOG_REQUEST` Retrieve one device log-collection request reached through a detected app and managed device, including status, timestamps, initiator, expiration, and log size. Use it to monitor a known request ID. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `device_log_collection_response_id` | string | Yes | Intune log-request ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_LOG_REQUESTS` for the specified detected app and managed device. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Detected App Devices User **Slug:** `MICROSOFT_INTUNE_GET_DETECTED_APP_DEVICES_USER` Retrieve one user relationship attached to a managed device reached through a detected app. Use this route only when the detected-app, device, and user IDs define the current traversal context. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Detected App Devices Windows Protection **Slug:** `MICROSOFT_INTUNE_GET_DETECTED_APP_DEVICES_WINDOWS_PROTECTION` Retrieve Windows protection health for a managed device reached through a detected app, including malware protection, scan, signature, reboot, engine, and tamper-protection status. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reads that relationship's Windows protection state. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Detected App User Device **Slug:** `MICROSOFT_INTUNE_GET_DETECTED_APP_USER_DEVICE` Get one device through its detected-app membership and associated user, returning exactly id, deviceName, operatingSystem, osVersion, complianceState, managementState, and lastSyncDateTime. Select only while traversing that context; prefer `MICROSOFT_INTUNE_GET_MANAGED_DEVICE` otherwise. activationLockBypassCode and remoteAssistanceSessionUrl are omitted. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Outer Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reuses it before and after the user segment. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Device Config **Slug:** `MICROSOFT_INTUNE_GET_DEVICE_CONFIG` Get one Android custom device configuration and its OMA settings by ID. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `device_configuration_id` | string | Yes | ID of the Intune device configuration to retrieve. Obtain it from LIST_DEVICE_CONFIGS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Device Configs Device Status Overview **Slug:** `MICROSOFT_INTUNE_GET_DEVICE_CONFIGS_DEVICE_STATUS_OVERVIEW` Get aggregate pending, successful, failed, and not-applicable device counts for an Intune device configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `device_configuration_id` | string | Yes | ID of the Intune device configuration whose aggregate device status to retrieve. Obtain it from LIST_DEVICE_CONFIGS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Device Configs User Status Overview **Slug:** `MICROSOFT_INTUNE_GET_DEVICE_CONFIGS_USER_STATUS_OVERVIEW` Get aggregate pending, successful, failed, and not-applicable user counts for an Intune device configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `device_configuration_id` | string | Yes | ID of the Intune device configuration whose aggregate user status to retrieve. Obtain it from LIST_DEVICE_CONFIGS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Device Configuration Device Activity **Slug:** `MICROSOFT_INTUNE_GET_DEVICE_CONFIGURATION_DEVICE_ACTIVITY` Retrieve the Intune device configuration activity report for device-scoped activity, returned as report content. Select this when activity must be viewed by device; use `MICROSOFT_INTUNE_GET_DEVICE_CONFIGURATION_USER_ACTIVITY` for user-scoped activity. #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Device Configuration State Summary **Slug:** `MICROSOFT_INTUNE_GET_DEVICE_CONFIGURATION_STATE_SUMMARY` Get tenant-wide device counts by deployment state across Intune device configurations. #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Device Configuration User Activity **Slug:** `MICROSOFT_INTUNE_GET_DEVICE_CONFIGURATION_USER_ACTIVITY` Retrieve the Intune device configuration activity report for user-scoped activity, returned as report content. Select this when activity must be viewed by user; use `MICROSOFT_INTUNE_GET_DEVICE_CONFIGURATION_DEVICE_ACTIVITY` for device-scoped activity. #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Device Management Intent Settings Report **Slug:** `MICROSOFT_INTUNE_GET_DEVICE_MANAGEMENT_INTENT_SETTINGS_REPORT` Query settings associated with Intune device-management intents; use the contributing-profiles sibling to identify profiles per setting. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `name` | string | Yes | Microsoft Graph requires this Intune report name to select the report variant. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Device Management Reports **Slug:** `MICROSOFT_INTUNE_GET_DEVICE_MANAGEMENT_REPORTS` Retrieve only the tenant's Microsoft Graph reports-root container metadata, such as its root ID and OData type. Use this to inspect the reports container itself; use a specialized report action when report rows, summaries, filters, or export jobs are needed. #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Device Non Compliance Report **Slug:** `MICROSOFT_INTUNE_GET_DEVICE_NON_COMPLIANCE_REPORT` Query Intune noncompliance results organized by device rather than by policy or setting. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `name` | string | Yes | Microsoft Graph requires this Intune report name to select the report variant. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Device Policies Compliance Report **Slug:** `MICROSOFT_INTUNE_GET_DEVICE_POLICIES_COMPLIANCE_REPORT` Query device compliance status organized by policy; use the policy-settings sibling for setting-level status. This operation is available only on Microsoft Graph beta and may change before general availability. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Device Policy Settings Compliance Report **Slug:** `MICROSOFT_INTUNE_GET_DEVICE_POLICY_SETTINGS_COMPLIANCE_REPORT` Query device compliance status organized by policy setting; use the policies sibling for policy-level status. This operation is available only on Microsoft Graph beta and may change before general availability. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Devices Status By Setting Report **Slug:** `MICROSOFT_INTUNE_GET_DEVICES_STATUS_BY_SETTING_REPORT` Query device compliance status organized by setting without selecting a specific compliance-policy hierarchy. This operation is available only on Microsoft Graph beta and may change before general availability. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Device Status By Compliance Policy Report **Slug:** `MICROSOFT_INTUNE_GET_DEVICE_STATUS_BY_COMPLIANCE_POLICY_REPORT` Query detailed device status organized by compliance policy; use the policy summary sibling for summarized status. This operation is available only on Microsoft Graph beta and may change before general availability. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Devices Without Compliance Policy Report **Slug:** `MICROSOFT_INTUNE_GET_DEVICES_WITHOUT_COMPLIANCE_POLICY_REPORT` Query devices that have no compliance policy, for identifying gaps in policy coverage. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `name` | string | Yes | Microsoft Graph requires this Intune report name to select the report variant. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Enrollment Config **Slug:** `MICROSOFT_INTUNE_GET_ENROLLMENT_CONFIG` Retrieve one device enrollment configuration of any subtype by its Microsoft Graph ID. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `device_enrollment_configuration_id` | string | Yes | Microsoft Graph ID of the device enrollment configuration to retrieve. Obtain it from LIST_ENROLLMENT_CONFIGS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Export Job **Slug:** `MICROSOFT_INTUNE_GET_EXPORT_JOB` Retrieve one Intune report export job by ID to inspect its current properties and relationships. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `device_management_export_job_id` | string | Yes | Intune report export-job ID returned by `MICROSOFT_INTUNE_CREATE_EXPORT_JOB` or `MICROSOFT_INTUNE_LIST_EXPORT_JOBS`. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Historical Report **Slug:** `MICROSOFT_INTUNE_GET_HISTORICAL_REPORT` Query the named Intune historical report with optional projection, grouping, ordering, search, paging, and filtering. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `name` | string | Yes | Microsoft Graph requires this Intune report name to select the report variant. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Imported Autopilot Device **Slug:** `MICROSOFT_INTUNE_GET_IMPORTED_AUTOPILOT_DEVICE` Retrieve one staged imported Windows Autopilot device identity, including its hardware identifier, assignment, and import state. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `imported_windows_autopilot_device_identity_id` | string | Yes | Microsoft Graph ID of the staged imported Windows Autopilot device identity to retrieve. Obtain it from LIST_IMPORTED_AUTOPILOT_DEVICES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Device Management Intent Per Setting Contributing Profiles **Slug:** `MICROSOFT_INTUNE_GET_INTENT_SETTING_CONTRIBUTING_PROFILES` Query the Intune profiles contributing to each device-management intent setting; use the intent-settings sibling for settings rather than profiles. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `name` | string | Yes | Microsoft Graph requires this Intune report name to select the report variant. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Managed Device **Slug:** `MICROSOFT_INTUNE_GET_MANAGED_DEVICE` Get one managed device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, returning exactly id, deviceName, operatingSystem, osVersion, complianceState, managementState, and lastSyncDateTime. Prefer this route whenever the device ID is known. activationLockBypassCode and remoteAssistanceSessionUrl are omitted. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Managed Device Enrollment Failure Details **Slug:** `MICROSOFT_INTUNE_GET_MANAGED_DEVICE_ENROLLMENT_FAILURE_DETAILS` Return detailed managed-device enrollment failures, with optional row offset, limit, filter, and continuation token. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of enrollment-failure detail rows to return. | | `skip` | integer | No | Number of enrollment-failure detail rows to skip before returning the report. | | `filter` | string | No | Microsoft Graph filter expression applied to the enrollment-failure detail report. | | `skip_token` | string | No | Continuation token from Microsoft Graph for the next enrollment-failure detail page. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Managed Device Enrollment Top Failures **Slug:** `MICROSOFT_INTUNE_GET_MANAGED_DEVICE_ENROLLMENT_TOP_FAILURES` Return the most frequent managed-device enrollment failures for the optional reporting period. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `period` | string | No | Reporting-period string passed to Microsoft Graph to constrain the top enrollment failures. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Managed Device Overview **Slug:** `MICROSOFT_INTUNE_GET_MANAGED_DEVICE_OVERVIEW` Retrieve the tenant-wide Intune managed-device overview: enrollment totals plus operating-system and Exchange access-state distributions. Use this for fleet summary counts, not individual devices. #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Apps Managed Mobile Lob App Content Version **Slug:** `MICROSOFT_INTUNE_GET_MANAGED_LOB_CONTENT_VERSION` Read mobileAppContent in a managed mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This managed-LOB endpoint-fidelity variant is retained separately from the generic and mobile-LOB variants. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune managed mobile LOB app ID returned by LIST_APPS or GET_APP. | | `mobile_app_content_id` | string | Yes | Managed mobile LOB content-version ID returned by LIST_MANAGED_LOB_CONTENT_VERSIONS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Apps Mobile Lob App Content Version **Slug:** `MICROSOFT_INTUNE_GET_MOBILE_LOB_CONTENT_VERSION` Read mobileAppContent in a mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This mobile-LOB endpoint-fidelity variant is retained separately from the generic and managed-LOB variants. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune mobile LOB app ID returned by LIST_APPS or GET_APP. | | `mobile_app_content_id` | string | Yes | Mobile LOB content-version ID returned by LIST_MOBILE_LOB_CONTENT_VERSIONS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Noncompliant Devices And Settings Report **Slug:** `MICROSOFT_INTUNE_GET_NONCOMPLIANT_DEVICES_AND_SETTINGS_REPORT` Query noncompliance results across both device and setting dimensions in one report. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `name` | string | Yes | Microsoft Graph requires this Intune report name to select the report variant. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Device Status Summary By Compliance Policy Report **Slug:** `MICROSOFT_INTUNE_GET_POLICY_DEVICE_STATUS_SUMMARY` Query summarized device status organized by compliance policy; use the policy detail sibling for detailed status. This operation is available only on Microsoft Graph beta and may change before general availability. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Policy Non Compliance Metadata **Slug:** `MICROSOFT_INTUNE_GET_POLICY_NON_COMPLIANCE_METADATA` Query metadata for Intune policy noncompliance reporting; use report siblings when row or summary data is needed. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `name` | string | Yes | Microsoft Graph requires this Intune report name to select the report variant. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Policy Non Compliance Report **Slug:** `MICROSOFT_INTUNE_GET_POLICY_NON_COMPLIANCE_REPORT` Query policy noncompliance details; use the policy summary sibling for aggregated results or metadata sibling for report metadata. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `name` | string | Yes | Microsoft Graph requires this Intune report name to select the report variant. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Policy Non Compliance Summary Report **Slug:** `MICROSOFT_INTUNE_GET_POLICY_NON_COMPLIANCE_SUMMARY_REPORT` Query summarized policy noncompliance results; use the policy detail sibling for non-summary results. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `name` | string | Yes | Microsoft Graph requires this Intune report name to select the report variant. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Devices Status By Policy Platform Compliance Report **Slug:** `MICROSOFT_INTUNE_GET_POLICY_PLATFORM_DEVICE_STATUS` Query device compliance status organized by both policy and platform; use policy-only siblings when platform is not a needed dimension. This operation is available only on Microsoft Graph beta and may change before general availability. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Device Status By Compliance Policy Setting Report **Slug:** `MICROSOFT_INTUNE_GET_POLICY_SETTING_DEVICE_STATUS` Query detailed device status organized by compliance-policy setting; use the setting summary sibling for summarized status. This operation is available only on Microsoft Graph beta and may change before general availability. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Device Status Summary By Compliance Policy Settings Report **Slug:** `MICROSOFT_INTUNE_GET_POLICY_SETTING_DEVICE_STATUS_SUMMARY` Query summarized device status organized by compliance-policy setting; use the setting detail sibling for detailed status. This operation is available only on Microsoft Graph beta and may change before general availability. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Report Filters **Slug:** `MICROSOFT_INTUNE_GET_REPORT_FILTERS` Query filter metadata for an Intune report before constructing a filtered report request. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `name` | string | Yes | Microsoft Graph requires this Intune report name to select the report variant. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Setting Non Compliance Report **Slug:** `MICROSOFT_INTUNE_GET_SETTING_NON_COMPLIANCE_REPORT` Query setting-level noncompliance results when no compliance- or configuration-specific setting family is required. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `top` | integer | No | Maximum number of report rows to return. | | `name` | string | Yes | Microsoft Graph requires this Intune report name to select the report variant. | | `skip` | integer | No | Number of report rows to skip. | | `filter` | string | No | Expression used to filter report rows. | | `search` | string | No | Text to search for in the report. | | `select` | array | No | Report columns to return. | | `group_by` | array | No | Report columns to group by. | | `order_by` | array | No | Report columns to order by. | | `session_id` | string | No | Identifier for the report session. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Import Autopilot Device Identities **Slug:** `MICROSOFT_INTUNE_IMPORT_AUTOPILOT_DEVICE_IDENTITIES` Submit the supplied Windows Autopilot device identities together for import processing in Intune. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `imported_windows_autopilot_device_identities` | array | Yes | Windows Autopilot device identities to submit together for import processing. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List App Categories **Slug:** `MICROSOFT_INTUNE_LIST_APP_CATEGORIES` List tenant-wide Intune app categories available for organizing mobile apps. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List App Configs **Slug:** `MICROSOFT_INTUNE_LIST_APP_CONFIGS` List Intune iOS managed-app configurations that deliver settings to targeted apps and devices. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List App Configs Assignments **Slug:** `MICROSOFT_INTUNE_LIST_APP_CONFIGS_ASSIGNMENTS` List the group or device targets assigned to a specific Intune mobile-app configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `managed_device_mobile_app_configuration_id` | string | Yes | Intune mobile-app configuration ID returned by LIST_APP_CONFIGS or GET_APP_CONFIG. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List App Configs Device Statuses **Slug:** `MICROSOFT_INTUNE_LIST_APP_CONFIGS_DEVICE_STATUSES` List per-device deployment statuses for a specific Intune mobile-app configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `managed_device_mobile_app_configuration_id` | string | Yes | Intune mobile-app configuration ID returned by LIST_APP_CONFIGS or GET_APP_CONFIG. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List App Configs User Statuses **Slug:** `MICROSOFT_INTUNE_LIST_APP_CONFIGS_USER_STATUSES` List per-user deployment statuses for a specific Intune mobile-app configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `managed_device_mobile_app_configuration_id` | string | Yes | Intune mobile-app configuration ID returned by LIST_APP_CONFIGS or GET_APP_CONFIG. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List App Relationships **Slug:** `MICROSOFT_INTUNE_LIST_APP_RELATIONSHIPS` List dependency and supersedence relationships between Intune mobile apps. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Apps **Slug:** `MICROSOFT_INTUNE_LIST_APPS` List Intune Android line-of-business apps used to deploy uploaded APK packages. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Apps Assignments **Slug:** `MICROSOFT_INTUNE_LIST_APPS_ASSIGNMENTS` List install-intent target assignments for a specific Intune mobile app. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Apps Categories **Slug:** `MICROSOFT_INTUNE_LIST_APPS_CATEGORIES` List categories attached to a specific Intune mobile app; use LIST_APP_CATEGORIES for the tenant-wide category collection. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Apps Content Versions **Slug:** `MICROSOFT_INTUNE_LIST_APPS_CONTENT_VERSIONS` List mobileAppContent versions through the provider-required microsoft.graph.mobileLobApp cast. This is the generic-call-surface variant; do not use an uncast generic route unless Microsoft Graph requires it, and use the separate managedMobileLobApp subtype action only for that app context. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Apps Content Versions Contained Apps **Slug:** `MICROSOFT_INTUNE_LIST_APPS_CONTENT_VERSIONS_CONTAINED_APPS` List Windows Universal AppX contained apps under a specific generic content version; use the committed-contained-app list tool for the app-level committed route. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `mobile_app_id` | string | Yes | Intune Windows Universal AppX ID returned by LIST_APPS or GET_APP. | | `mobile_app_content_id` | string | Yes | Generic content-version ID returned by LIST_APPS_CONTENT_VERSIONS or GET_APPS_CONTENT_VERSION. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Autopilot Devices **Slug:** `MICROSOFT_INTUNE_LIST_AUTOPILOT_DEVICES` List Windows Autopilot device identities one page at a time, including their hardware, enrollment, and assigned-user properties. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Apps Windows Universal App X Committed Contained Apps **Slug:** `MICROSOFT_INTUNE_LIST_COMMITTED_CONTAINED_APPS` List contained apps on a Windows Universal AppX app's committedContainedApps route; use the content-version contained-app list tool for a specific version. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `mobile_app_id` | string | Yes | Intune Windows Universal AppX ID returned by LIST_APPS or GET_APP. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Compliance Policies **Slug:** `MICROSOFT_INTUNE_LIST_COMPLIANCE_POLICIES` List legacy Android compliance policies that define device security and password requirements. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Compliance Policies Assignments **Slug:** `MICROSOFT_INTUNE_LIST_COMPLIANCE_POLICIES_ASSIGNMENTS` List individual target assignment relationships under one compliance policy; use ASSIGN_COMPLIANCE_POLICY to replace the complete target set. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `device_compliance_policy_id` | string | Yes | Intune compliance policy ID returned by LIST_COMPLIANCE_POLICIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Compliance Policies Device Setting Summaries **Slug:** `MICROSOFT_INTUNE_LIST_COMPLIANCE_POLICIES_DEVICE_SETTING_SUMMARIES` List per-setting device-count rollups under one compliance policy, distinct from individual device statuses. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `device_compliance_policy_id` | string | Yes | Intune compliance policy ID returned by LIST_COMPLIANCE_POLICIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Compliance Policies Device Statuses **Slug:** `MICROSOFT_INTUNE_LIST_COMPLIANCE_POLICIES_DEVICE_STATUSES` List individual device evaluation statuses under one compliance policy; use the device status overview for aggregate counts. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `device_compliance_policy_id` | string | Yes | Intune compliance policy ID returned by LIST_COMPLIANCE_POLICIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Compliance Policies User Statuses **Slug:** `MICROSOFT_INTUNE_LIST_COMPLIANCE_POLICIES_USER_STATUSES` List individual user compliance rollups under one policy; use the user status overview for aggregate counts. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `device_compliance_policy_id` | string | Yes | Intune compliance policy ID returned by LIST_COMPLIANCE_POLICIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Compliance Setting States **Slug:** `MICROSOFT_INTUNE_LIST_COMPLIANCE_SETTING_STATES` List individual device-and-user compliance observations under one setting summary, not aggregate setting counts. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `device_compliance_policy_setting_state_summary_id` | string | Yes | Intune compliance setting summary ID returned by LIST_COMPLIANCE_SETTING_SUMMARIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Compliance Setting Summaries **Slug:** `MICROSOFT_INTUNE_LIST_COMPLIANCE_SETTING_SUMMARIES` List setting-and-platform summaries of device compliance counts; use compliance setting states for individual device and user observations. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Detected App Device Malware States **Slug:** `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICE_MALWARE_STATES` List paginated malware-state records beneath a detected app's managed device, including threat severity, execution and remediation states, detection counts, and timestamps. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; malware states are listed under this relationship. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Detected App Devices **Slug:** `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` List managed devices associated with the named detected app. The sensitive fields activationLockBypassCode and remoteAssistanceSessionUrl are omitted from every returned record. Use only when intentionally traversing the detected-app relationship and its ID is available; for the ordinary device collection, use `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; this lists managed devices related to that app. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Detected App Devices Log Requests **Slug:** `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_LOG_REQUESTS` List paginated log-collection requests for a managed device reached through a detected app, returning request statuses, timestamps, initiators, expiration, and sizes for monitoring or ID lookup. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; log requests are listed under this relationship. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Detected App Devices Users **Slug:** `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` List paginated user relationships for a managed device reached through a detected app. Use the returned user IDs to continue the detected-app/device/user traversal; this does not list all tenant users. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; users are listed under this relationship. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Detected Apps **Slug:** `MICROSOFT_INTUNE_LIST_DETECTED_APPS` List applications detected on managed devices in Microsoft Intune. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Detected App User Devices **Slug:** `MICROSOFT_INTUNE_LIST_DETECTED_APP_USER_DEVICES` List managed devices through the named detected-app and user relationships. The sensitive fields activationLockBypassCode and remoteAssistanceSessionUrl are omitted from every returned record. Use only when intentionally traversing those relationships and all IDs are available; for the ordinary device collection, use `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device; related devices are listed under this user. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Device Configs **Slug:** `MICROSOFT_INTUNE_LIST_DEVICE_CONFIGS` List all Intune device configurations across configuration subtypes. Inspect each item's `@odata.type` before passing its ID to a subtype-specific action. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Device Configs Assignments **Slug:** `MICROSOFT_INTUNE_LIST_DEVICE_CONFIGS_ASSIGNMENTS` List the group, user, device, collection, exclusion, and scope-tag assignments for an Intune device configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `device_configuration_id` | string | Yes | ID of the Intune device configuration whose assignments to list. Obtain it from LIST_DEVICE_CONFIGS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Device Configs Device Setting Summaries **Slug:** `MICROSOFT_INTUNE_LIST_DEVICE_CONFIGS_DEVICE_SETTING_SUMMARIES` List per-setting deployment-state counts for an Intune device configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `device_configuration_id` | string | Yes | ID of the Intune device configuration whose setting summaries to list. Obtain it from LIST_DEVICE_CONFIGS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Device Configs Device Statuses **Slug:** `MICROSOFT_INTUNE_LIST_DEVICE_CONFIGS_DEVICE_STATUSES` List per-device deployment statuses for an Intune device configuration. Microsoft is deprecating support for this entity starting May 2026 and has not named a replacement: https://learn.microsoft.com/en-us/graph/api/resources/intune-deviceconfig-deviceconfigurationdevicestatus #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `device_configuration_id` | string | Yes | ID of the Intune device configuration whose per-device statuses to list. Obtain it from LIST_DEVICE_CONFIGS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Device Configs User Statuses **Slug:** `MICROSOFT_INTUNE_LIST_DEVICE_CONFIGS_USER_STATUSES` List per-user deployment statuses for an Intune device configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `device_configuration_id` | string | Yes | ID of the Intune device configuration whose per-user statuses to list. Obtain it from LIST_DEVICE_CONFIGS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Enrollment Configs **Slug:** `MICROSOFT_INTUNE_LIST_ENROLLMENT_CONFIGS` List device enrollment configurations of every subtype one page at a time, including limit, enrollment-status-page, Windows Hello, and platform-restriction configurations. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Enrollment Configs Assignments **Slug:** `MICROSOFT_INTUNE_LIST_ENROLLMENT_CONFIGS_ASSIGNMENTS` List one device enrollment configuration's target assignments one page at a time. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `device_enrollment_configuration_id` | string | Yes | Microsoft Graph ID of the device enrollment configuration whose assignments to list. Obtain it from LIST_ENROLLMENT_CONFIGS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Export Jobs **Slug:** `MICROSOFT_INTUNE_LIST_EXPORT_JOBS` List Intune report export jobs so an agent can select a job to inspect, update, or delete. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Imported Autopilot Devices **Slug:** `MICROSOFT_INTUNE_LIST_IMPORTED_AUTOPILOT_DEVICES` List staged imported Windows Autopilot device identities one page at a time, including each identity's import state. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Managed Devices **Slug:** `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES` List managed-device records. The sensitive fields activationLockBypassCode and remoteAssistanceSessionUrl are omitted from every returned record. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Apps Managed Mobile Lob App Content Versions **Slug:** `MICROSOFT_INTUNE_LIST_MANAGED_LOB_CONTENT_VERSIONS` List mobileAppContent through the documented microsoft.graph.managedMobileLobApp cast in a managed mobile line-of-business app context. Use only when Microsoft Graph requires that subtype cast; otherwise use the generic content-version action. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `mobile_app_id` | string | Yes | Intune managed mobile LOB app ID returned by LIST_APPS or GET_APP. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Apps Mobile Lob App Content Versions **Slug:** `MICROSOFT_INTUNE_LIST_MOBILE_LOB_CONTENT_VERSIONS` List mobileAppContent through the concrete microsoft.graph.androidLobApp cast in a mobile line-of-business app context. Use only when Microsoft Graph requires that subtype cast; otherwise use the generic content-version action. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque continuation cursor returned by the preceding page of this same action. | | `mobile_app_id` | string | Yes | Intune mobile LOB app ID returned by LIST_APPS or GET_APP. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Locate Device Detected App Device **Slug:** `MICROSOFT_INTUNE_LOCATE_DEVICE_DETECTED_APP_DEVICE` Asynchronously request location for a device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_LOCATE_DEVICE_MANAGED_DEVICE` otherwise. An empty response only acknowledges the request; observe the result with `MICROSOFT_INTUNE_GET_MANAGED_DEVICE`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Locate Device Detected App User Device **Slug:** `MICROSOFT_INTUNE_LOCATE_DEVICE_DETECTED_APP_USER_DEVICE` Asynchronously request location for a device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_LOCATE_DEVICE_MANAGED_DEVICE` otherwise. An empty response only acknowledges the request; observe the result with `MICROSOFT_INTUNE_GET_MANAGED_DEVICE`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Outer Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reuses it before and after the user segment. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Locate Device Managed Device **Slug:** `MICROSOFT_INTUNE_LOCATE_DEVICE_MANAGED_DEVICE` Asynchronously request device location through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the device ID is known. An empty response only acknowledges the request; observe the result with `MICROSOFT_INTUNE_GET_MANAGED_DEVICE`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Logout Shared Apple User Detected App Device **Slug:** `MICROSOFT_INTUNE_LOGOUT_SHARED_APPLE_USER_DETECTED_APP_DEVICE` Log out the active user from a shared Apple device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_LOGOUT_SHARED_APPLE_USER_MANAGED_DEVICE` otherwise. Unsaved work can be lost. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge that logging out the active shared Apple user can discard unsaved work. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Logout Shared Apple User Detected App User Device **Slug:** `MICROSOFT_INTUNE_LOGOUT_SHARED_APPLE_USER_DETECTED_APP_USER_DEVICE` Log out the active user from a shared Apple device addressed through a detected app and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_LOGOUT_SHARED_APPLE_USER_MANAGED_DEVICE` otherwise. Unsaved work can be lost. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Outer Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reuses it before and after the user segment. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge that logging out the active shared Apple user can discard unsaved work. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Logout Shared Apple User Managed Device **Slug:** `MICROSOFT_INTUNE_LOGOUT_SHARED_APPLE_USER_MANAGED_DEVICE` Log out the active user from a shared Apple device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the device ID is known; unsaved work can be lost. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge that logging out the active shared Apple user can discard unsaved work. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Reboot Now Detected App Device **Slug:** `MICROSOFT_INTUNE_REBOOT_NOW_DETECTED_APP_DEVICE` Reboot a device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_REBOOT_NOW_MANAGED_DEVICE` otherwise. The active user may lose unsaved work. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge that rebooting interrupts the active user and can discard unsaved work. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Reboot Now Detected App User Device **Slug:** `MICROSOFT_INTUNE_REBOOT_NOW_DETECTED_APP_USER_DEVICE` Reboot a device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_REBOOT_NOW_MANAGED_DEVICE` otherwise. The active user may lose unsaved work. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Outer Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reuses it before and after the user segment. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge that rebooting interrupts the active user and can discard unsaved work. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Reboot Now Managed Device **Slug:** `MICROSOFT_INTUNE_REBOOT_NOW_MANAGED_DEVICE` Reboot a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the device ID is known; the active user is interrupted and may lose unsaved work. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge that rebooting interrupts the active user and can discard unsaved work. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remote Lock Detected App Device **Slug:** `MICROSOFT_INTUNE_REMOTE_LOCK_DETECTED_APP_DEVICE` Remotely lock a device addressed as a detected app's managed-device member, blocking the active user. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_REMOTE_LOCK_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge that remotely locking the device immediately blocks the active user until unlock. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remote Lock Detected App User Device **Slug:** `MICROSOFT_INTUNE_REMOTE_LOCK_DETECTED_APP_USER_DEVICE` Remotely lock a device addressed through its detected-app membership and associated user, blocking the active user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_REMOTE_LOCK_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Outer Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reuses it before and after the user segment. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge that remotely locking the device immediately blocks the active user until unlock. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remote Lock Managed Device **Slug:** `MICROSOFT_INTUNE_REMOTE_LOCK_MANAGED_DEVICE` Remotely lock a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, blocking the active user until unlock. Prefer this route whenever the device ID is known. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge that remotely locking the device immediately blocks the active user until unlock. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remove User Devices Detected App Devices User **Slug:** `MICROSOFT_INTUNE_REMOVE_USER_DEVICES_DETECTED_APP_DEVICES_USER` Retire all devices from management for this user. Removes all devices associated with the named user from Intune management. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: Removes all devices associated with the named user from Intune management. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Request Defender Scan Detected App Device **Slug:** `MICROSOFT_INTUNE_REQUEST_DEFENDER_SCAN_DETECTED_APP_DEVICE` Request a Microsoft Defender scan for a Windows device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_REQUEST_DEFENDER_SCAN_MANAGED_DEVICE` otherwise. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `quick_scan` | boolean | No | Set true for a quick Defender scan or false for a full scan. Omit to let Intune use the device's default scan mode. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Request Defender Scan Detected App User Device **Slug:** `MICROSOFT_INTUNE_REQUEST_DEFENDER_SCAN_DETECTED_APP_USER_DEVICE` Request a Microsoft Defender scan for a Windows device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_REQUEST_DEFENDER_SCAN_MANAGED_DEVICE` otherwise. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `quick_scan` | boolean | No | Set true for a quick Defender scan or false for a full scan. Omit to let Intune use the device's default scan mode. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Outer Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reuses it before and after the user segment. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Request Defender Scan Managed Device **Slug:** `MICROSOFT_INTUNE_REQUEST_DEFENDER_SCAN_MANAGED_DEVICE` Request a Microsoft Defender scan through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the managed Windows device ID is known. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `quick_scan` | boolean | No | Set true for a quick Defender scan or false for a full scan. Omit to let Intune use the device's default scan mode. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Retire Detected App Device **Slug:** `MICROSOFT_INTUNE_RETIRE_DETECTED_APP_DEVICE` Retire a device addressed as a detected app's managed-device member, unenrolling it and removing company-managed data while preserving personal data. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_RETIRE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: Unenrolls the device and removes company-managed apps, settings, profiles, and organizational data while preserving personal data. Graph acceptance is not completion: delivery waits for the device's next check-in. The tenant-wide limit is 1,000 retire actions per day. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Retire Detected App User Device **Slug:** `MICROSOFT_INTUNE_RETIRE_DETECTED_APP_USER_DEVICE` Retire a device addressed through its detected-app membership and associated user, unenrolling it and removing company-managed data while preserving personal data. Select only while traversing that context; prefer `MICROSOFT_INTUNE_RETIRE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Outer Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reuses it before and after the user segment. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: Unenrolls the device and removes company-managed apps, settings, profiles, and organizational data while preserving personal data. Graph acceptance is not completion: delivery waits for the device's next check-in. The tenant-wide limit is 1,000 retire actions per day. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Retire Managed Device **Slug:** `MICROSOFT_INTUNE_RETIRE_MANAGED_DEVICE` Retire a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, unenrolling it and removing company-managed data while preserving personal data. Prefer this route whenever the device ID is known. Delivery waits for check-in. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: Unenrolls the device and removes company-managed apps, settings, profiles, and organizational data while preserving personal data. Graph acceptance is not completion: delivery waits for the device's next check-in. The tenant-wide limit is 1,000 retire actions per day. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Schedule Rule Actions Compliance Policy **Slug:** `MICROSOFT_INTUNE_SCHEDULE_RULE_ACTIONS_COMPLIANCE_POLICY` Apply the supplied complete rule-action schedule to one compliance policy; use scheduled-rule-action tools to manage one schedule resource. Clearing the schedule requires `confirm_clear_all_rule_actions=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `device_compliance_policy_id` | string | Yes | Intune compliance policy ID returned by LIST_COMPLIANCE_POLICIES. | | `confirm_clear_all_rule_actions` | boolean | No | Must be true when the scheduled-rule-action list is empty to confirm clearing the complete schedule. | | `device_compliance_scheduled_action_for_rules` | array | Yes | Complete scheduled-rule-action collection. Each rule requires exactly one block action. An empty list clears the schedule and requires confirm_clear_all_rule_actions=true. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Set Priority Enrollment Config **Slug:** `MICROSOFT_INTUNE_SET_PRIORITY_ENROLLMENT_CONFIG` Set one enrollment limit configuration's precedence position for users targeted by multiple configurations. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `priority` | integer | Yes | New precedence position for the configuration; lower numeric values take precedence for users targeted by multiple configurations. | | `device_enrollment_configuration_id` | string | Yes | Microsoft Graph ID of the enrollment limit configuration whose priority to set. Obtain it from LIST_ENROLLMENT_CONFIGS and select a deviceEnrollmentLimitConfiguration row. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Shut Down Detected App Device **Slug:** `MICROSOFT_INTUNE_SHUT_DOWN_DETECTED_APP_DEVICE` Shut down a device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_SHUT_DOWN_MANAGED_DEVICE` otherwise. The active user may lose unsaved work. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge that shutdown interrupts the active user and can discard unsaved work. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Shut Down Detected App User Device **Slug:** `MICROSOFT_INTUNE_SHUT_DOWN_DETECTED_APP_USER_DEVICE` Shut down a device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_SHUT_DOWN_MANAGED_DEVICE` otherwise. The active user may lose unsaved work. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Outer Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reuses it before and after the user segment. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge that shutdown interrupts the active user and can discard unsaved work. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Shut Down Managed Device **Slug:** `MICROSOFT_INTUNE_SHUT_DOWN_MANAGED_DEVICE` Shut down a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the device ID is known; the active user may lose unsaved work. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge that shutdown interrupts the active user and can discard unsaved work. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Sync Device Detected App Device **Slug:** `MICROSOFT_INTUNE_SYNC_DEVICE_DETECTED_APP_DEVICE` Request an immediate policy sync for a device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_SYNC_DEVICE_MANAGED_DEVICE` otherwise. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Sync Device Detected App User Device **Slug:** `MICROSOFT_INTUNE_SYNC_DEVICE_DETECTED_APP_USER_DEVICE` Request an immediate policy sync for a device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_SYNC_DEVICE_MANAGED_DEVICE` otherwise. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Outer Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reuses it before and after the user segment. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Sync Device Managed Device **Slug:** `MICROSOFT_INTUNE_SYNC_DEVICE_MANAGED_DEVICE` Request an immediate Intune policy sync through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the managed-device ID is known. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Unassign User From Device Autopilot Device **Slug:** `MICROSOFT_INTUNE_UNASSIGN_USER_FROM_DEVICE_AUTOPILOT_DEVICE` Removes the assigned user from the Autopilot device identity, disrupting its user-targeted provisioning association. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge that the assigned Autopilot user is removed from the device identity. | | `windows_autopilot_device_identity_id` | string | Yes | Microsoft Graph ID of the Windows Autopilot device identity whose assigned user to remove. Obtain it from LIST_AUTOPILOT_DEVICES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update App **Slug:** `MICROSOFT_INTUNE_UPDATE_APP` Update deployment metadata for an Intune Android line-of-business app. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `notes` | string | No | Notes for the app. Inherited from mobileApp | | `owner` | string | No | The owner of the app. Inherited from mobileApp | | `developer` | string | No | The developer of the app. Inherited from mobileApp | | `file_name` | string | No | The name of the main Lob application file. Inherited from mobileLobApp | | `publisher` | string | No | The publisher of the app. Inherited from mobileApp | | `large_icon` | object | No | The large icon, to be displayed in the app details and used for upload of the icon. Inherited from mobileApp | | `package_id` | string | No | The package identifier. | | `description` | string | No | The description of the app. Inherited from mobileApp | | `is_featured` | boolean | No | The value indicating whether the app is marked as featured by the admin. Inherited from mobileApp | | `display_name` | string | No | The admin provided or imported title of the app. Inherited from mobileApp | | `version_code` | string | No | The version code of Android Line of Business (LoB) app. | | `version_name` | string | No | The version name of Android Line of Business (LoB) app. | | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | | `information_url` | string | No | The more information Url. Inherited from mobileApp | | `privacy_information_url` | string | No | The privacy statement Url. Inherited from mobileApp | | `committed_content_version` | string | No | The internal committed content version. Inherited from mobileLobApp | | `minimum_supported_operating_system` | object | No | The value for the minimum applicable operating system. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update App Category **Slug:** `MICROSOFT_INTUNE_UPDATE_APP_CATEGORY` Update a tenant-wide Intune app category's properties, independent of any one app relationship. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `display_name` | string | No | The name of the app category. | | `mobile_app_category_id` | string | Yes | Tenant-wide Intune app-category ID returned by LIST_APP_CATEGORIES or GET_APP_CATEGORY. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update App Config **Slug:** `MICROSOFT_INTUNE_UPDATE_APP_CONFIG` Update the settings or metadata of an Intune iOS managed-app configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | string | No | Key of the entity. Inherited from managedDeviceMobileAppConfiguration | | `version` | integer | No | Version of the device configuration. Inherited from managedDeviceMobileAppConfiguration | | `settings` | array | No | app configuration setting items. | | `description` | string | No | Admin provided description of the Device Configuration. Inherited from managedDeviceMobileAppConfiguration | | `display_name` | string | No | Admin provided name of the device configuration. Inherited from managedDeviceMobileAppConfiguration | | `created_date_time` | string | No | DateTime the object was created. Inherited from managedDeviceMobileAppConfiguration | | `encoded_setting_xml` | string | No | mdm app configuration Base64 binary. | | `targeted_mobile_apps` | array | No | the associated app. Inherited from managedDeviceMobileAppConfiguration | | `last_modified_date_time` | string | No | DateTime the object was last modified. Inherited from managedDeviceMobileAppConfiguration | | `managed_device_mobile_app_configuration_id` | string | Yes | Intune mobile-app configuration ID returned by LIST_APP_CONFIGS or GET_APP_CONFIG. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update App Configs Assignment **Slug:** `MICROSOFT_INTUNE_UPDATE_APP_CONFIGS_ASSIGNMENT` Update one target assignment for a specific Intune mobile-app configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | string | No | Unique identifier of the entity. | | `target` | object | No | Replacement group, user, device, or collection target for this mobile-app configuration assignment. | | `managed_device_mobile_app_configuration_id` | string | Yes | Intune mobile-app configuration ID returned by LIST_APP_CONFIGS or GET_APP_CONFIG. | | `managed_device_mobile_app_configuration_assignment_id` | string | Yes | Intune app-configuration assignment ID returned by LIST_APP_CONFIGS_ASSIGNMENTS or GET_APP_CONFIGS_ASSIGNMENT. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update App Configs Device Status **Slug:** `MICROSOFT_INTUNE_UPDATE_APP_CONFIGS_DEVICE_STATUS` Update one device's deployment-status record for a specific Intune mobile-app configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | string | No | Key of the entity. | | `status` | string ("unknown" | "notApplicable" | "compliant" | "remediated" | "nonCompliant" | "error" | "conflict" | "notAssigned") | No | Compliance status of the policy report. The possible values are: `unknown`, `notApplicable`, `compliant`, `remediated`, `nonCompliant`, `error`, `conflict`, `notAssigned`. | | `user_name` | string | No | The User Name that is being reported | | `device_model` | string | No | The device model that is being reported | | `device_display_name` | string | No | Device name of the DevicePolicyStatus. | | `user_principal_name` | string | No | UserPrincipalName. | | `last_reported_date_time` | string | No | Last modified date time of the policy report. | | `managed_device_mobile_app_configuration_id` | string | Yes | Intune mobile-app configuration ID returned by LIST_APP_CONFIGS or GET_APP_CONFIG. | | `compliance_grace_period_expiration_date_time` | string | No | The DateTime when device compliance grace period expires | | `managed_device_mobile_app_configuration_device_status_id` | string | Yes | Intune app-configuration device-status ID returned by LIST_APP_CONFIGS_DEVICE_STATUSES or GET_APP_CONFIGS_DEVICE_STATUS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update App Configs User Status **Slug:** `MICROSOFT_INTUNE_UPDATE_APP_CONFIGS_USER_STATUS` Update one user's deployment-status record for a specific Intune mobile-app configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | string | No | Key of the entity. | | `status` | string ("unknown" | "notApplicable" | "compliant" | "remediated" | "nonCompliant" | "error" | "conflict" | "notAssigned") | No | Compliance status of the policy report. The possible values are: `unknown`, `notApplicable`, `compliant`, `remediated`, `nonCompliant`, `error`, `conflict`, `notAssigned`. | | `devices_count` | integer | No | Devices count for that user. | | `user_display_name` | string | No | User name of the DevicePolicyStatus. | | `user_principal_name` | string | No | UserPrincipalName. | | `last_reported_date_time` | string | No | Last modified date time of the policy report. | | `managed_device_mobile_app_configuration_id` | string | Yes | Intune mobile-app configuration ID returned by LIST_APP_CONFIGS or GET_APP_CONFIG. | | `managed_device_mobile_app_configuration_user_status_id` | string | Yes | Intune app-configuration user-status ID returned by LIST_APP_CONFIGS_USER_STATUSES or GET_APP_CONFIGS_USER_STATUS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Apps Assignment **Slug:** `MICROSOFT_INTUNE_UPDATE_APPS_ASSIGNMENT` Update one Intune mobile-app assignment's target or settings. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `target` | object | No | The target group assignment defined by the admin. | | `settings` | object | No | The settings for target assignment defined by the admin. | | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | | `mobile_app_assignment_id` | string | Yes | Intune mobile-app assignment ID returned by LIST_APPS_ASSIGNMENTS or GET_APPS_ASSIGNMENT. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Apps Categories **Slug:** `MICROSOFT_INTUNE_UPDATE_APPS_CATEGORIES` Update a category through a specific mobile app's categories route; use UPDATE_APP_CATEGORY for the tenant-wide route. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `display_name` | string | No | The name of the app category. | | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | | `mobile_app_category_id` | string | Yes | Intune app-category ID returned for this app by LIST_APPS_CATEGORIES or GET_APPS_CATEGORIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Apps Content Version **Slug:** `MICROSOFT_INTUNE_UPDATE_APPS_CONTENT_VERSION` Update mobileAppContent through the provider-required microsoft.graph.mobileLobApp cast. This generic-call-surface variant is retained separately from the mobile-LOB and managed-LOB endpoint-fidelity variants. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune mobile-app ID returned by LIST_APPS or GET_APP. | | `mobile_app_content_id` | string | Yes | Intune content-version ID returned by LIST_APPS_CONTENT_VERSIONS or GET_APPS_CONTENT_VERSION. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Apps Content Versions Contained App **Slug:** `MICROSOFT_INTUNE_UPDATE_APPS_CONTENT_VERSIONS_CONTAINED_APP` Update a Windows Universal AppX contained-app entry under a specific generic content version; use the committed-contained-app update tool for the app-level committed route. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune Windows Universal AppX ID returned by LIST_APPS or GET_APP. | | `app_user_model_id` | string | No | The app user model ID of the contained app of a WindowsUniversalAppX app. | | `mobile_app_content_id` | string | Yes | Generic content-version ID returned by LIST_APPS_CONTENT_VERSIONS or GET_APPS_CONTENT_VERSION. | | `mobile_contained_app_id` | string | Yes | Contained-app ID returned by LIST_APPS_CONTENT_VERSIONS_CONTAINED_APPS or GET_APPS_CONTENT_VERSIONS_CONTAINED_APP. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Apps Windows Universal App X Committed Contained Apps **Slug:** `MICROSOFT_INTUNE_UPDATE_COMMITTED_CONTAINED_APP` Update a contained-app entry on a Windows Universal AppX app's committedContainedApps route; use the content-version update tool for an entry owned by a specific version. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune Windows Universal AppX ID returned by LIST_APPS or GET_APP. | | `app_user_model_id` | string | No | The app user model ID of the contained app of a WindowsUniversalAppX app. | | `mobile_contained_app_id` | string | Yes | Committed contained-app ID returned by LIST_COMMITTED_CONTAINED_APPS or GET_COMMITTED_CONTAINED_APP. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Compliance Policy **Slug:** `MICROSOFT_INTUNE_UPDATE_COMPLIANCE_POLICY` Update device security or password requirements on one legacy Android compliance policy. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `version` | integer | No | Version of the device configuration. Inherited from deviceCompliancePolicy | | `description` | string | No | Admin provided description of the Device Configuration. Inherited from deviceCompliancePolicy | | `display_name` | string | No | Admin provided name of the device configuration. Inherited from deviceCompliancePolicy | | `password_required` | boolean | No | Require a password to unlock device. | | `os_maximum_version` | string | No | Maximum Android version. | | `os_minimum_version` | string | No | Minimum Android version. | | `password_required_type` | string ("deviceDefault" | "alphabetic" | "alphanumeric" | "alphanumericWithSymbols" | "lowSecurityBiometric" | "numeric" | "numericComplex" | "any") | No | Type of characters in password. The possible values are: `deviceDefault`, `alphabetic`, `alphanumeric`, `alphanumericWithSymbols`, `lowSecurityBiometric`, `numeric`, `numericComplex`, `any`. | | `password_minimum_length` | integer | No | Minimum password length. Valid values 4 to 16 | | `password_expiration_days` | integer | No | Number of days before the password expires. Valid values 1 to 365 | | `storage_require_encryption` | boolean | No | Require encryption on Android devices. | | `device_compliance_policy_id` | string | Yes | Intune compliance policy ID returned by LIST_COMPLIANCE_POLICIES. | | `security_require_verify_apps` | boolean | No | Require the Android Verify apps feature is turned on. | | `security_disable_usb_debugging` | boolean | No | Disable USB debugging on Android devices. | | `device_threat_protection_enabled` | boolean | No | Require that devices have enabled device threat protection. | | `min_android_security_patch_level` | string | No | Minimum Android security patch level. | | `security_block_jailbroken_devices` | boolean | No | Indicates the device should not be rooted. When TRUE, if the device is detected as rooted it will be reported non-compliant. When FALSE, the device is not reported as non-compliant regardless of device rooted state. Default is FALSE. | | `security_require_google_play_services` | boolean | No | Require Google Play Services to be installed and enabled on the device. | | `password_previous_password_block_count` | integer | No | Number of previous passwords to block. Valid values 1 to 24 | | `password_minutes_of_inactivity_before_lock` | integer | No | Minutes of inactivity before a password is required. | | `security_require_company_portal_app_integrity` | boolean | No | Require the device to pass the Company Portal client app runtime integrity check. | | `security_require_up_to_date_security_providers` | boolean | No | Require the device to have up to date security providers. The device will require Google Play Services to be enabled and up to date. | | `device_threat_protection_required_security_level` | string ("unavailable" | "secured" | "low" | "medium" | "high" | "notSet") | No | Require Mobile Threat Protection minimum risk level to report noncompliance. The possible values are: `unavailable`, `secured`, `low`, `medium`, `high`, `notSet`. | | `security_prevent_install_apps_from_unknown_sources` | boolean | No | Require that devices disallow installation of apps from unknown sources. | | `security_require_safety_net_attestation_basic_integrity` | boolean | No | Require the device to pass the SafetyNet basic integrity check. | | `security_require_safety_net_attestation_certified_device` | boolean | No | Require the device to pass the SafetyNet certified device check. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Compliance Policy Rule Action Config **Slug:** `MICROSOFT_INTUNE_UPDATE_COMPLIANCE_POLICY_RULE_ACTION_CONFIG` Update one enforcement action or delay within a scheduled compliance rule-action container. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `action_type` | string ("noAction" | "notification" | "block" | "retire" | "wipe" | "removeResourceAccessProfiles" | "pushNotification") | No | What action to take. | | `grace_period_hours` | integer | No | Number of hours to wait till the action will be enforced. Valid values 0 to 8760 | | `notification_template_id` | string | No | What notification Message template to use | | `device_compliance_policy_id` | string | Yes | Intune compliance policy ID returned by LIST_COMPLIANCE_POLICIES. | | `notification_message_cc_list` | array | No | A list of group IDs to speicify who to CC this notification message to. | | `device_compliance_action_item_id` | string | Yes | Rule action config ID returned by LIST_COMPLIANCE_POLICY_RULE_ACTION_CONFIGS. | | `device_compliance_scheduled_action_for_rule_id` | string | Yes | Scheduled rule action ID returned by LIST_COMPLIANCE_POLICIES_SCHEDULED_RULE_ACTIONS. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Compliance Setting State **Slug:** `MICROSOFT_INTUNE_UPDATE_COMPLIANCE_SETTING_STATE` Update one device-and-user compliance observation under a setting summary, not its aggregate counts. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `state` | string ("unknown" | "notApplicable" | "compliant" | "remediated" | "nonCompliant" | "error" | "conflict" | "notAssigned") | No | The compliance state of the setting. | | `setting` | string | No | The setting class name and property name. | | `user_id` | string | No | The user Id that is being reported | | `device_id` | string | No | The Device Id that is being reported | | `user_name` | string | No | The User Name that is being reported | | `user_email` | string | No | The User email address that is being reported | | `device_name` | string | No | The Device Name that is being reported | | `device_model` | string | No | The device model that is being reported | | `setting_name` | string | No | The Setting Name that is being reported | | `user_principal_name` | string | No | The User PrincipalName that is being reported | | `device_compliance_setting_state_id` | string | Yes | Individual compliance setting state ID returned by LIST_COMPLIANCE_SETTING_STATES. | | `compliance_grace_period_expiration_date_time` | string | No | The DateTime when device compliance grace period expires | | `device_compliance_policy_setting_state_summary_id` | string | Yes | Intune compliance setting summary ID returned by LIST_COMPLIANCE_SETTING_SUMMARIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Compliance Setting Summary **Slug:** `MICROSOFT_INTUNE_UPDATE_COMPLIANCE_SETTING_SUMMARY` Update aggregate device compliance counts for one setting and platform, not an individual device setting state. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `setting` | string | No | The setting class name and property name. | | `setting_name` | string | No | Name of the setting. | | `platform_type` | string ("android" | "iOS" | "macOS" | "windowsPhone81" | "windows81AndLater" | "windows10AndLater" | "androidWorkProfile" | "linux" | "all") | No | Setting platform. | | `error_device_count` | integer | No | Number of error devices | | `unknown_device_count` | integer | No | Number of unknown devices | | `conflict_device_count` | integer | No | Number of conflict devices | | `compliant_device_count` | integer | No | Number of compliant devices | | `remediated_device_count` | integer | No | Number of remediated devices | | `non_compliant_device_count` | integer | No | Number of NonCompliant devices | | `not_applicable_device_count` | integer | No | Number of not applicable devices | | `device_compliance_policy_setting_state_summary_id` | string | Yes | Intune compliance setting summary ID returned by LIST_COMPLIANCE_SETTING_SUMMARIES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Defender Signatures Detected App Device **Slug:** `MICROSOFT_INTUNE_UPDATE_DEFENDER_SIGNATURES_DETECTED_APP_DEVICE` Request a Defender security-intelligence update for a Windows device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_UPDATE_DEFENDER_SIGNATURES_MANAGED_DEVICE` otherwise. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Defender Signatures Detected App User Device **Slug:** `MICROSOFT_INTUNE_UPDATE_DEFENDER_SIGNATURES_DETECTED_APP_USER_DEVICE` Request a Defender security-intelligence update for a Windows device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_UPDATE_DEFENDER_SIGNATURES_MANAGED_DEVICE` otherwise. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Outer Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reuses it before and after the user segment. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Defender Signatures Managed Device **Slug:** `MICROSOFT_INTUNE_UPDATE_DEFENDER_SIGNATURES_MANAGED_DEVICE` Request a Microsoft Defender security-intelligence update through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the managed Windows device ID is known. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Detected App **Slug:** `MICROSOFT_INTUNE_UPDATE_DETECTED_APP` Update a detected application's properties. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `platform` | string ("unknown" | "windows" | "windowsMobile" | "windowsHolographic" | "ios" | "macOS" | "chromeOS" | "androidOSP" | "androidDeviceAdministrator" | "androidWorkProfile" | "androidDedicatedAndFullyManaged" | "unknownFutureValue") | No | Operating system or platform of the discovered application. | | `publisher` | string | No | Publisher of the discovered application. | | `device_count` | integer | No | Number of devices that have installed this application. | | `detected_app_id` | string | Yes | Identifier of the detected application. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Detected App Device **Slug:** `MICROSOFT_INTUNE_UPDATE_DETECTED_APP_DEVICE` Update ownership classification, administrator-friendly name, or notes for a device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_UPDATE_MANAGED_DEVICE` otherwise. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `notes` | string | No | Notes on the device created by IT Admin. Default is null. To retrieve actual values GET call needs to be made, with device id and included in select parameter. Supports: $select. $Search is not supported. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `managed_device_name` | string | No | Automatically generated name to identify a device. Can be overwritten to a user friendly name. | | `managed_device_owner_type` | string ("unknown" | "company" | "personal") | No | Ownership of the device. Can be 'company' or 'personal'. The possible values are: `unknown`, `company`, `personal`. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Detected App Device Malware State **Slug:** `MICROSOFT_INTUNE_UPDATE_DETECTED_APP_DEVICE_MALWARE_STATE` Update supplied threat identity, severity, execution, remediation, detection-count, category, URL, or timestamp fields on a known malware-state record beneath a detected app's managed device. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | string | No | The unique Identifier. This is malware id. | | `state` | string ("unknown" | "detected" | "cleaned" | "quarantined" | "removed" | "allowed" | "blocked" | "cleanFailed" | "quarantineFailed" | "removeFailed" | "allowFailed" | "abandoned" | "blockFailed") | No | Current status of the malware like cleaned/quarantined/allowed etc. The possible values are: `unknown`, `detected`, `cleaned`, `quarantined`, `removed`, `allowed`, `blocked`, `cleanFailed`, `quarantineFailed`, `removeFailed`, `allowFailed`, `abandoned`, `blockFailed`. | | `category` | string ("invalid" | "adware" | "spyware" | "passwordStealer" | "trojanDownloader" | "worm" | "backdoor" | "remoteAccessTrojan" | "trojan" | "emailFlooder" | "keylogger" | "dialer" | "monitoringSoftware" | "browserModifier" | "cookie" | "browserPlugin" | "aolExploit" | "nuker" | "securityDisabler" | "jokeProgram" | "hostileActiveXControl" | "softwareBundler" | "stealthNotifier" | "settingsModifier" | "toolBar" | "remoteControlSoftware" | "trojanFtp" | "potentialUnwantedSoftware" | "icqExploit" | "trojanTelnet" | "exploit" | "filesharingProgram" | "malwareCreationTool" | "remote_Control_Software" | "tool" | "trojanDenialOfService" | "trojanDropper" | "trojanMassMailer" | "trojanMonitoringSoftware" | "trojanProxyServer" | "virus" | "known" | "unknown" | "spp" | "behavior" | "vulnerability" | "policy" | "enterpriseUnwantedSoftware" | "ransom" | "hipsRule") | No | Category of the malware. The possible values are: `invalid`, `adware`, `spyware`, `passwordStealer`, `trojanDownloader`, `worm`, `backdoor`, `remoteAccessTrojan`, `trojan`, `emailFlooder`, `keylogger`, `dialer`, `monitoringSoftware`, `browserModifier`, `cookie`, `browserPlugin`, `aolExploit`, `nuker`, `securityDisabler`, `jokeProgram`, `hostileActiveXControl`, `softwareBundler`, `stealthNotifier`, `settingsModifier`, `toolBar`, `remoteControlSoftware`, `trojanFtp`, `potentialUnwantedSoftware`, `icqExploit`, `trojanTelnet`, `exploit`, `filesharingProgram`, `malwareCreationTool`, `remote_Control_Software`, `tool`, `trojanDenialOfService`, `trojanDropper`, `trojanMassMailer`, `trojanMonitoringSoftware`, `trojanProxyServer`, `virus`, `known`, `unknown`, `spp`, `behavior`, `vulnerability`, `policy`, `enterpriseUnwantedSoftware`, `ransom`, `hipsRule`. | | `severity` | string ("unknown" | "low" | "moderate" | "high" | "severe") | No | Severity of the malware. The possible values are: `unknown`, `low`, `moderate`, `high`, `severe`. | | `display_name` | string | No | Malware name | | `threat_state` | string ("active" | "actionFailed" | "manualStepsRequired" | "fullScanRequired" | "rebootRequired" | "remediatedWithNonCriticalFailures" | "quarantined" | "removed" | "cleaned" | "allowed" | "noStatusCleared") | No | Current status of the malware like cleaned/quarantined/allowed etc. The possible values are: `active`, `actionFailed`, `manualStepsRequired`, `fullScanRequired`, `rebootRequired`, `remediatedWithNonCriticalFailures`, `quarantined`, `removed`, `cleaned`, `allowed`, `noStatusCleared`. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `detection_count` | integer | No | Number of times the malware is detected | | `execution_state` | string ("unknown" | "blocked" | "allowed" | "running" | "notRunning") | No | Execution status of the malware like blocked/executing etc. The possible values are: `unknown`, `blocked`, `allowed`, `running`, `notRunning`. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `additional_information_url` | string | No | Information URL to learn more about the malware | | `initial_detection_date_time` | string | No | Initial detection datetime of the malware | | `last_state_change_date_time` | string | No | The last time this particular threat was changed | | `windows_device_malware_state_id` | string | Yes | Intune malware-state ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICE_MALWARE_STATES` for the specified detected app and managed device. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Detected App Devices Device Category **Slug:** `MICROSOFT_INTUNE_UPDATE_DETECTED_APP_DEVICES_DEVICE_CATEGORY` Submit Microsoft Graph's documented discriminator-only device-category PATCH for a managed device reached through a detected app. This update route accepts no caller-specified category or other writable state, so it cannot assign or change a category; use `MICROSOFT_INTUNE_GET_DETECTED_APP_DEVICES_DEVICE_CATEGORY` to retrieve the same relationship without issuing a PATCH. Select this action only when the provider's exact discriminator-only PATCH operation is explicitly required. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this selects the discriminator-only category relationship route. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Detected App Devices Log Request **Slug:** `MICROSOFT_INTUNE_UPDATE_DETECTED_APP_DEVICES_LOG_REQUEST` Update supplied status, identity, timing, initiator, expiration, size, or enrollment metadata on a known log-collection request reached through a detected app and managed device; returns the updated request. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | string | No | The unique identifier in the form of tenantId_deviceId_requestId. | | `status` | string ("pending" | "completed" | "failed" | "unknownFutureValue") | No | Indicates the status for the app log collection request if it is pending, completed or failed, Default is pending. The possible values are: `pending`, `completed`, `failed`, `unknownFutureValue`. | | `size_in_kb` | number | No | The size of the logs in KB. Valid values -1.79769313486232E+308 to 1.79769313486232E+308 | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `enrolled_by_user` | string | No | The User Principal Name (UPN) of the user that enrolled the device. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `log_managed_device_id` | string | No | Indicates Intune device unique identifier. | | `received_date_time_utc` | string | No | The DateTime the request was received. | | `requested_date_time_utc` | string | No | The DateTime of the request. | | `expiration_date_time_utc` | string | No | The DateTime of the expiration of the logs. | | `initiated_by_user_principal_name` | string | No | The UPN for who initiated the request. | | `device_log_collection_response_id` | string | Yes | Intune log-request ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_LOG_REQUESTS` for the specified detected app and managed device. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Detected App Devices User **Slug:** `MICROSOFT_INTUNE_UPDATE_DETECTED_APP_DEVICES_USER` Submit Microsoft Graph's documented discriminator-only PATCH for the existing user relationship reached through a detected app and managed device. The route accepts no caller-specified user properties and does not edit the user's Microsoft Entra profile. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Detected App Devices Windows Protection **Slug:** `MICROSOFT_INTUNE_UPDATE_DETECTED_APP_DEVICES_WINDOWS_PROTECTION` Update supplied Windows protection health fields for a managed device reached through a detected app, such as malware protection, scan, signature, reboot, engine, product, or tamper status. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | string | No | The unique Identifier for the device protection status object. This is device id of the device | | `device_state` | string ("clean" | "fullScanPending" | "rebootPending" | "manualStepsPending" | "offlineScanPending" | "critical") | No | Indicates device's health state. The possible values are: clean, fullScanPending, rebootPending, manualStepsPending, offlineScanPending, critical. The possible values are: `clean`, `fullScanPending`, `rebootPending`, `manualStepsPending`, `offlineScanPending`, `critical`. | | `engine_version` | string | No | Current endpoint protection engine's version | | `product_status` | string ("noStatus" | "serviceNotRunning" | "serviceStartedWithoutMalwareProtection" | "pendingFullScanDueToThreatAction" | "pendingRebootDueToThreatAction" | "pendingManualStepsDueToThreatAction" | "avSignaturesOutOfDate" | "asSignaturesOutOfDate" | "noQuickScanHappenedForSpecifiedPeriod" | "noFullScanHappenedForSpecifiedPeriod" | "systemInitiatedScanInProgress" | "systemInitiatedCleanInProgress" | "samplesPendingSubmission" | "productRunningInEvaluationMode" | "productRunningInNonGenuineMode" | "productExpired" | "offlineScanRequired" | "serviceShutdownAsPartOfSystemShutdown" | "threatRemediationFailedCritically" | "threatRemediationFailedNonCritically" | "noStatusFlagsSet" | "platformOutOfDate" | "platformUpdateInProgress" | "platformAboutToBeOutdated" | "signatureOrPlatformEndOfLifeIsPastOrIsImpending" | "windowsSModeSignaturesInUseOnNonWin10SInstall") | No | Windows Defender Antivirus product status. Use one of the documented enum values exposed by this field's schema. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `reboot_required` | boolean | No | When true, a reboot is required; when false, no reboot is required. Omit to preserve the client-reported state. | | `full_scan_overdue` | boolean | No | When TRUE indicates full scan is overdue, when FALSE indicates full scan is not overdue. Defaults to setting on client device. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route updates that relationship's Windows protection state. | | `signature_version` | string | No | Current malware definitions version | | `full_scan_required` | boolean | No | When TRUE indicates full scan is required, when FALSE indicates full scan is not required. Defaults to setting on client device. | | `is_virtual_machine` | boolean | No | When TRUE indicates the device is a virtual machine, when FALSE indicates the device is not a virtual machine. Defaults to setting on client device. | | `quick_scan_overdue` | boolean | No | When TRUE indicates quick scan is overdue, when FALSE indicates quick scan is not overdue. Defaults to setting on client device. | | `anti_malware_version` | string | No | Current anti malware version | | `last_reported_date_time` | string | No | Last device health status reported time | | `last_full_scan_date_time` | string | No | Date and time of the most recent full Defender scan. | | `signature_update_overdue` | boolean | No | When TRUE indicates signature is out of date, when FALSE indicates signature is not out of date. Defaults to setting on client device. | | `last_quick_scan_date_time` | string | No | Date and time of the most recent quick Defender scan. | | `tamper_protection_enabled` | boolean | No | When TRUE indicates the Windows Defender tamper protection feature is enabled, when FALSE indicates the Windows Defender tamper protection feature is not enabled. Defaults to setting on client device. | | `malware_protection_enabled` | boolean | No | When TRUE indicates anti malware is enabled when FALSE indicates anti malware is not enabled. | | `real_time_protection_enabled` | boolean | No | When TRUE indicates real time protection is enabled, when FALSE indicates real time protection is not enabled. Defaults to setting on client device. | | `last_full_scan_signature_version` | string | No | Last full scan signature version | | `last_quick_scan_signature_version` | string | No | Last quick scan signature version | | `network_inspection_system_enabled` | boolean | No | When TRUE indicates network inspection system enabled, when FALSE indicates network inspection system is not enabled. Defaults to setting on client device. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Detected App User Device **Slug:** `MICROSOFT_INTUNE_UPDATE_DETECTED_APP_USER_DEVICE` Update ownership classification, administrator-friendly name, or notes for a device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_UPDATE_MANAGED_DEVICE` otherwise. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `notes` | string | No | Notes on the device created by IT Admin. Default is null. To retrieve actual values GET call needs to be made, with device id and included in select parameter. Supports: $select. $Search is not supported. | | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Outer Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reuses it before and after the user segment. | | `managed_device_name` | string | No | Automatically generated name to identify a device. Can be overwritten to a user friendly name. | | `managed_device_owner_type` | string ("unknown" | "company" | "personal") | No | Ownership of the device. Can be 'company' or 'personal'. The possible values are: `unknown`, `company`, `personal`. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Device Config **Slug:** `MICROSOFT_INTUNE_UPDATE_DEVICE_CONFIG` Update the name, description, version, or OMA settings of an Android custom device configuration in Intune. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `version` | integer | No | Version of the device configuration. Inherited from deviceConfiguration | | `description` | string | No | Admin provided description of the Device Configuration. Inherited from deviceConfiguration | | `display_name` | string | No | Admin provided name of the device configuration. Inherited from deviceConfiguration | | `oma_settings` | array | No | OMA settings. This collection can contain a maximum of 1000 elements. | | `device_configuration_id` | string | Yes | ID of the Android custom device configuration to update. Obtain it from LIST_DEVICE_CONFIGS and select an item whose `@odata.type` is `#microsoft.graph.androidCustomConfiguration`; this action cannot verify the subtype before mutation. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Device Properties Autopilot Device **Slug:** `MICROSOFT_INTUNE_UPDATE_DEVICE_PROPERTIES_AUTOPILOT_DEVICE` Update only the supplied user principal name, addressable user name, group tag, or display name on one Windows Autopilot device identity. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `group_tag` | string | No | Replacement Windows Autopilot group tag for this device identity. | | `display_name` | string | No | Replacement display name for this device identity. | | `user_principal_name` | string | No | Replacement Microsoft Entra user principal name for this device identity. | | `addressable_user_name` | string | No | Replacement addressable user name for this device identity. | | `windows_autopilot_device_identity_id` | string | Yes | Microsoft Graph ID of the single Windows Autopilot device identity to update. Obtain it from LIST_AUTOPILOT_DEVICES. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Enrollment Configs Assignment **Slug:** `MICROSOFT_INTUNE_UPDATE_ENROLLMENT_CONFIGS_ASSIGNMENT` Replace the target of one assignment on a device enrollment configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `target` | object | Yes | Replacement target that determines which tenant users or devices receive the device enrollment configuration. | | `device_enrollment_configuration_id` | string | Yes | Microsoft Graph ID of the device enrollment configuration that owns the assignment. Obtain it from LIST_ENROLLMENT_CONFIGS. | | `enrollment_configuration_assignment_id` | string | Yes | Microsoft Graph ID of the assignment to update. Obtain it from LIST_ENROLLMENT_CONFIGS_ASSIGNMENTS for the owning configuration. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Enrollment Limit Config **Slug:** `MICROSOFT_INTUNE_UPDATE_ENROLLMENT_LIMIT_CONFIG` Update only the supplied limit, priority, version, name, or description on one enrollment limit configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `limit` | integer | No | Replacement maximum number of devices each targeted user may enroll. | | `version` | integer | No | Replacement version number for the enrollment limit configuration. | | `priority` | integer | No | Replacement precedence; the lowest numeric value applies when a user is targeted by multiple configurations. | | `description` | string | No | Replacement administrative description for the enrollment limit configuration. | | `display_name` | string | No | Replacement human-readable name for the enrollment limit configuration. | | `device_enrollment_configuration_id` | string | Yes | Microsoft Graph ID of the enrollment limit configuration to update. Obtain it from LIST_ENROLLMENT_CONFIGS and select a deviceEnrollmentLimitConfiguration row. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Export Job **Slug:** `MICROSOFT_INTUNE_UPDATE_EXPORT_JOB` Update the supplied properties of one Intune report export job selected by ID. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `url` | string | No | Temporary location of the exported report. | | `filter` | string | No | Filters applied on the report. The maximum length allowed for this property is 2000 characters. | | `format` | string ("csv" | "json" | "pdf" | "unknownFutureValue") | No | Exported report format. The possible values are: `csv`, `pdf`, `json`, `unknownFutureValue`. | | `select` | array | No | Columns selected from the report. The maximum number of allowed columns names is 256. The maximum length allowed for each column name in this property is 1000 characters. | | `status` | string ("unknown" | "notStarted" | "inProgress" | "completed" | "failed") | No | Status of the export job. Possible values are `unknown`, `notStarted`, `inProgress`, `completed` and `failed`. The possible values are: `unknown`, `notStarted`, `inProgress`, `completed`, `failed`. | | `report_name` | string | No | Name of the report. The maximum length allowed for this property is 2000 characters. | | `snapshot_id` | string | No | A snapshot is an identifiable subset of the dataset represented by the ReportName. A sessionId or CachedReportConfiguration id can be used here. If a sessionId is specified, Filter, Select, and OrderBy are applied to the data represented by the sessionId. Filter, Select, and OrderBy cannot be specified together with a CachedReportConfiguration id. The maximum length allowed for this property is 128 characters. | | `localization_type` | string ("replaceLocalizableValues" | "localizedValuesAsAdditionalColumn") | No | Configures how the requested export job is localized. Possible values are `replaceLocalizableValues` and `localizedValuesAsAdditionalColumn`. The possible values are: `localizedValuesAsAdditionalColumn`, `replaceLocalizableValues`. | | `request_date_time` | string | No | Time that the exported report was requested. | | `expiration_date_time` | string | No | Time that the exported report expires. | | `device_management_export_job_id` | string | Yes | Intune report export-job ID returned by `MICROSOFT_INTUNE_CREATE_EXPORT_JOB` or `MICROSOFT_INTUNE_LIST_EXPORT_JOBS`. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Managed Device **Slug:** `MICROSOFT_INTUNE_UPDATE_MANAGED_DEVICE` Update a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, changing its ownership classification, administrator-friendly name, or notes. Prefer this direct route for ordinary device maintenance over detected-app relationship variants. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `notes` | string | No | Notes on the device created by IT Admin. Default is null. To retrieve actual values GET call needs to be made, with device id and included in select parameter. Supports: $select. $Search is not supported. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. | | `managed_device_name` | string | No | Automatically generated name to identify a device. Can be overwritten to a user friendly name. | | `managed_device_owner_type` | string ("unknown" | "company" | "personal") | No | Ownership of the device. Can be 'company' or 'personal'. The possible values are: `unknown`, `company`, `personal`. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Apps Managed Mobile Lob App Content Version **Slug:** `MICROSOFT_INTUNE_UPDATE_MANAGED_LOB_CONTENT_VERSION` Update mobileAppContent in a managed mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This managed-LOB endpoint-fidelity variant is retained separately from the generic and mobile-LOB variants. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune managed mobile LOB app ID returned by LIST_APPS or GET_APP. | | `mobile_app_content_id` | string | Yes | Managed mobile LOB content-version ID returned by LIST_MANAGED_LOB_CONTENT_VERSIONS or GET_MANAGED_LOB_CONTENT_VERSION. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Apps Mobile Lob App Content Version **Slug:** `MICROSOFT_INTUNE_UPDATE_MOBILE_LOB_CONTENT_VERSION` Update mobileAppContent in a mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This mobile-LOB endpoint-fidelity variant is retained separately from the generic and managed-LOB variants. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mobile_app_id` | string | Yes | Intune mobile LOB app ID returned by LIST_APPS or GET_APP. | | `mobile_app_content_id` | string | Yes | Mobile LOB content-version ID returned by LIST_MOBILE_LOB_CONTENT_VERSIONS or GET_MOBILE_LOB_CONTENT_VERSION. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Verify Enrollment Autodiscovery **Slug:** `MICROSOFT_INTUNE_VERIFY_ENROLLMENT_AUTODISCOVERY` Check whether Windows enrollment auto-discovery is configured for one domain and return Microsoft Graph's Boolean result. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `domain_name` | string | Yes | Domain name for which to verify Windows enrollment auto-discovery. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Wipe Detected App Device **Slug:** `MICROSOFT_INTUNE_WIPE_DETECTED_APP_DEVICE` Wipe a device addressed as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`. Select this relationship route only while traversing from a detected app; prefer `MICROSOFT_INTUNE_WIPE_MANAGED_DEVICE` for ordinary device operations. Factory-resets by default, with platform-dependent retention options. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `keep_user_data` | boolean | No | When true on supported Windows devices, retain user accounts and data while removing managed apps and settings. This option is independent of enrollment-data retention; platform support varies. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app. | | `mac_os_unlock_code` | string | No | A six-digit recovery PIN used when remotely wiping a Mac via MDM. | | `keep_enrollment_data` | boolean | No | When true on supported Windows devices, retain enrollment and provisioning data so the device can remain provisioned after the wipe. Platform support and behavior vary. | | `obliteration_behavior` | string ("default" | "doNotObliterate" | "obliterateWithWarning" | "always") | No | This setting controls the fallback wipe method on modern Macs during a remote wipe. | | `persist_esim_data_plan` | boolean | No | This setting controls whether an eSIM cellular data plan is retained or wiped during a device wipe. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: Factory-resets the managed device by default, removing personal and organizational data, apps, and configurations; retention options vary by platform. Graph acceptance is not completion: an offline device acts after its next check-in. The tenant-wide limit is 500 wipe actions per day. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Wipe Detected App User Device **Slug:** `MICROSOFT_INTUNE_WIPE_DETECTED_APP_USER_DEVICE` Wipe a device addressed through its detected-app membership and associated user. Select this nested relationship route only while traversing from that detected app and user; prefer `MICROSOFT_INTUNE_WIPE_MANAGED_DEVICE` for ordinary device operations. Factory-resets by default, with platform-dependent retention options. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id` | string | Yes | Intune user ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES_USERS` for the specified detected app and managed device. | | `keep_user_data` | boolean | No | When true on supported Windows devices, retain user accounts and data while removing managed apps and settings. This option is independent of enrollment-data retention; platform support varies. | | `detected_app_id` | string | Yes | Intune detected-app ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APPS`; it selects the detected-app relationship traversed by this route. | | `managed_device_id` | string | Yes | Outer Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_DETECTED_APP_DEVICES` for the specified detected app; this route reuses it before and after the user segment. | | `mac_os_unlock_code` | string | No | A six-digit recovery PIN used when remotely wiping a Mac via MDM. | | `keep_enrollment_data` | boolean | No | When true on supported Windows devices, retain enrollment and provisioning data so the device can remain provisioned after the wipe. Platform support and behavior vary. | | `obliteration_behavior` | string ("default" | "doNotObliterate" | "obliterateWithWarning" | "always") | No | This setting controls the fallback wipe method on modern Macs during a remote wipe. | | `persist_esim_data_plan` | boolean | No | This setting controls whether an eSIM cellular data plan is retained or wiped during a device wipe. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: Factory-resets the managed device by default, removing personal and organizational data, apps, and configurations; retention options vary by platform. Graph acceptance is not completion: an offline device acts after its next check-in. The tenant-wide limit is 500 wipe actions per day. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Wipe Managed Device **Slug:** `MICROSOFT_INTUNE_WIPE_MANAGED_DEVICE` Wipe a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Factory-resets it by default, removing personal and organizational data, apps, and configurations; retention options vary by platform. Prefer this direct route whenever the managed-device ID is known. Graph acceptance is not completion. Requires `confirm_destructive_action=true`. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `keep_user_data` | boolean | No | When true on supported Windows devices, retain user accounts and data while removing managed apps and settings. This option is independent of enrollment-data retention; platform support varies. | | `managed_device_id` | string | Yes | Intune managed-device ID returned by `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`. | | `mac_os_unlock_code` | string | No | A six-digit recovery PIN used when remotely wiping a Mac via MDM. | | `keep_enrollment_data` | boolean | No | When true on supported Windows devices, retain enrollment and provisioning data so the device can remain provisioned after the wipe. Platform support and behavior vary. | | `obliteration_behavior` | string ("default" | "doNotObliterate" | "obliterateWithWarning" | "always") | No | This setting controls the fallback wipe method on modern Macs during a remote wipe. | | `persist_esim_data_plan` | boolean | No | This setting controls whether an eSIM cellular data plan is retained or wiped during a device wipe. | | `confirm_destructive_action` | boolean | Yes | Must be true to acknowledge: Factory-resets the managed device by default, removing personal and organizational data, apps, and configurations; retention options vary by platform. Graph acceptance is not completion: an offline device acts after its next check-in. The tenant-wide limit is 500 wipe actions per day. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not |