Intune Graph API – Complete Management

---
name: Intune Graph API – Complete Management
description: "A comprehensive skill enabling OpenClaw agents to fully manage Microsoft Intune via the Graph API. Covers devices, apps, policies, compliance, users, groups, reporting, Autopilot, scripts, and remote actions."
version: "1.0.1"
author: "Mattia Cirillo"
homepage: "https://kaffeeundcode.com"
requires:
  env:
    - INTUNE_TENANT_ID
    - INTUNE_CLIENT_ID
    - INTUNE_CLIENT_SECRET
---

# Microsoft Intune – Complete Management Skill

This skill gives the agent **full control over Microsoft Intune** via the Microsoft Graph API. It covers device management, application deployment, compliance & configuration policies, user & group management, Autopilot, PowerShell scripts, reporting, and all remote device actions.

---

## 🔑 Authentication

Before ANY Intune operation, the agent MUST obtain an OAuth 2.0 access token.

The following environment variables must be configured:
- `INTUNE_TENANT_ID` – Microsoft 365 Tenant ID
- `INTUNE_CLIENT_ID` – Entra ID App Registration Client ID
- `INTUNE_CLIENT_SECRET` – Entra ID App Registration Secret

### Token Request
**POST** `https://login.microsoftonline.com/{INTUNE_TENANT_ID}/oauth2/v2.0/token`

**Body (x-www-form-urlencoded):**
```
client_id={INTUNE_CLIENT_ID}
&scope=https://graph.microsoft.com/.default
&client_secret={INTUNE_CLIENT_SECRET}
&grant_type=client_credentials
```

Extract `access_token` from the JSON response. Use it as:
```
Authorization: Bearer <access_token>
```

### Required API Permissions (App Registration)
The Entra ID App Registration needs the following Microsoft Graph **Application** permissions:
- `DeviceManagementManagedDevices.ReadWrite.All`
- `DeviceManagementConfiguration.ReadWrite.All`
- `DeviceManagementApps.ReadWrite.All`
- `DeviceManagementServiceConfig.ReadWrite.All`
- `DeviceManagementRBAC.ReadWrite.All`
- `Directory.Read.All`
- `User.Read.All`
- `Group.ReadWrite.All`
- `GroupMember.ReadWrite.All`

---

## 🛡️ Safety Rules (CRITICAL)

1. **Read operations (GET):** Always safe. Execute without confirmation.
2. **Sync/Restart operations:** Ask for confirmation: *"Soll ich Gerät X wirklich syncen/neustarten?"*
3. **Destructive operations (Wipe, Retire, Delete):** ALWAYS require explicit confirmation. Say: *"⚠️ Achtung: Das löscht alle Daten auf dem Gerät. Bist du sicher?"*
4. **Policy creation/modification:** Confirm before applying: *"Soll ich diese Policy wirklich erstellen/ändern?"*
5. **Never dump raw JSON** to the user. Always format output as readable Markdown tables or summaries.
6. **Error handling:** If an API call returns an error, explain the error in simple German and suggest a fix.

---

## 📱 1. Device Management

### 1.1 List All Managed Devices
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices`

Use `$select` to limit fields: `?$select=deviceName,operatingSystem,complianceState,lastSyncDateTime,userPrincipalName`

Present results as a table: | Gerätename | OS | Compliance | Letzter Sync | Benutzer |

### 1.2 Search for a Specific Device
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?$filter=deviceName eq '{deviceName}'`

Alternative search by user: `?$filter=userPrincipalName eq '{user@domain.com}'`

### 1.3 Get Device Details
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{managedDeviceId}`

Show: Device name, Serial number, OS version, Compliance state, Encryption status, Last sync, Enrolled date, Primary user.

### 1.4 Remote Actions on a Device

#### Sync Device
**POST** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{managedDeviceId}/syncDevice`

#### Reboot Device
**POST** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{managedDeviceId}/rebootNow`

#### Lock Device (Remote Lock)
**POST** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{managedDeviceId}/remoteLock`

#### Reset Passcode
**POST** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{managedDeviceId}/resetPasscode`

#### Locate Device (Lost Mode – iOS/Android)
**POST** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{managedDeviceId}/locateDevice`

#### Retire Device (Remove Company Data Only)
**POST** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{managedDeviceId}/retire`
⚠️ SAFETY: Requires explicit user confirmation!

#### Wipe Device (Factory Reset)
**POST** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{managedDeviceId}/wipe`
⚠️ SAFETY: ALWAYS ask twice! This deletes ALL data!

#### Delete Device from Intune
**DELETE** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{managedDeviceId}`
⚠️ SAFETY: Requires explicit user confirmation!

#### Rename Device
**POST** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{managedDeviceId}/setDeviceName`
Body: `{"deviceName": "NEW-NAME"}`

#### Enable/Disable Lost Mode (iOS supervised)
**POST** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{managedDeviceId}/enableLostMode`
Body: `{"message": "Dieses Gerät wurde als verloren gemeldet.", "phoneNumber": "+49...", "footer": "Kaffee & Code IT"}`

**POST** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{managedDeviceId}/disableLostMode`

---

## 📋 2. Compliance Policies

### 2.1 List All Compliance Policies
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies`

Present as: | Policy Name | Platform | Created | Last Modified |

### 2.2 Get Compliance Policy Details
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies/{policyId}`

### 2.3 Get Compliance Policy Assignments
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies/{policyId}/assignments`

### 2.4 Get Device Compliance Status per Policy
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies/{policyId}/deviceStatuses`

### 2.5 Create a Compliance Policy
**POST** `https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies`
⚠️ SAFETY: Confirm before creating.

### 2.6 Delete a Compliance Policy
**DELETE** `https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies/{policyId}`
⚠️ SAFETY: Requires explicit user confirmation!

---

## ⚙️ 3. Configuration Policies & Profiles

### 3.1 List Configuration Policies (Recommended API)
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/configurationPolicies`

This is the modern, recommended endpoint covering Endpoint Security, Administrative Templates, and Settings Catalog.

### 3.2 List Legacy Device Configuration Profiles
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations`

### 3.3 Get Configuration Policy Details
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/configurationPolicies/{policyId}`

### 3.4 Get Policy Settings
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/configurationPolicies/{policyId}/settings`

### 3.5 Get Policy Assignments
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/configurationPolicies/{policyId}/assignments`

### 3.6 Get Device Status per Config Profile
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations/{configId}/deviceStatuses`

### 3.7 Create Configuration Policy
**POST** `https://graph.microsoft.com/v1.0/deviceManagement/configurationPolicies`
⚠️ SAFETY: Confirm before creating.

### 3.8 Delete Configuration Policy
**DELETE** `https://graph.microsoft.com/v1.0/deviceManagement/configurationPolicies/{policyId}`
⚠️ SAFETY: Requires explicit user confirmation!

---

## 📦 4. App Management

### 4.1 List All Apps
**GET** `https://graph.microsoft.com/v1.0/deviceAppManagement/mobileApps`

Present as: | App Name | Type | Publisher | Created |

### 4.2 Get App Details
**GET** `https://graph.microsoft.com/v1.0/deviceAppManagement/mobileApps/{appId}`

### 4.3 Get App Assignments (Who gets the app?)
**GET** `https://graph.microsoft.com/v1.0/deviceAppManagement/mobileApps/{appId}/assignments`

### 4.4 List App Configuration Policies
**GET** `https://graph.microsoft.com/v1.0/deviceAppManagement/managedAppPolicies`

### 4.5 List App Protection Policies (MAM)
**GET** `https://graph.microsoft.com/v1.0/deviceAppManagement/managedAppRegistrations`

### 4.6 Assign App to a Group
**POST** `https://graph.microsoft.com/v1.0/deviceAppManagement/mobileApps/{appId}/assignments`
⚠️ SAFETY: Confirm before assigning.

### 4.7 List Detected Apps on Devices
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/detectedApps`

### 4.8 Get Devices with a Specific Detected App
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/detectedApps/{detectedAppId}/managedDevices`

---

## 🔒 5. Endpoint Security

### 5.1 List Security Baselines
**GET** `https://graph.microsoft.com/beta/deviceManagement/configurationPolicies?$filter=templateReference/templateFamily eq 'baseline'`

### 5.2 List Disk Encryption Policies (BitLocker/FileVault)
**GET** `https://graph.microsoft.com/beta/deviceManagement/configurationPolicies?$filter=templateReference/templateFamily eq 'endpointSecurityDiskEncryption'`

### 5.3 List Firewall Policies
**GET** `https://graph.microsoft.com/beta/deviceManagement/configurationPolicies?$filter=templateReference/templateFamily eq 'endpointSecurityFirewall'`

### 5.4 List Antivirus Policies (Defender)
**GET** `https://graph.microsoft.com/beta/deviceManagement/configurationPolicies?$filter=templateReference/templateFamily eq 'endpointSecurityAntivirus'`

### 5.5 List Attack Surface Reduction Rules
**GET** `https://graph.microsoft.com/beta/deviceManagement/configurationPolicies?$filter=templateReference/templateFamily eq 'endpointSecurityAttackSurfaceReduction'`

---

## 🚀 6. Windows Autopilot

### 6.1 List Autopilot Devices
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/windowsAutopilotDeviceIdentities`

Present as: | Serial Number | Model | Group Tag | Enrollment State | Last Seen |

### 6.2 Get Autopilot Device Details
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/windowsAutopilotDeviceIdentities/{id}`

### 6.3 List Autopilot Deployment Profiles
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/windowsAutopilotDeploymentProfiles`

### 6.4 Assign Autopilot Profile
**POST** `https://graph.microsoft.com/v1.0/deviceManagement/windowsAutopilotDeviceIdentities/{id}/assignUserToDevice`
Body: `{"userPrincipalName": "user@domain.com"}`

### 6.5 Delete Autopilot Device
**DELETE** `https://graph.microsoft.com/v1.0/deviceManagement/windowsAutopilotDeviceIdentities/{id}`
⚠️ SAFETY: Requires explicit user confirmation!

---

## 📜 7. PowerShell Scripts & Remediation

### 7.1 List Device Management Scripts
**GET** `https://graph.microsoft.com/beta/deviceManagement/deviceManagementScripts`

### 7.2 Get Script Details
**GET** `https://graph.microsoft.com/beta/deviceManagement/deviceManagementScripts/{scriptId}`

### 7.3 Get Script Execution Status per Device
**GET** `https://graph.microsoft.com/beta/deviceManagement/deviceManagementScripts/{scriptId}/deviceRunStates`

### 7.4 Create/Upload a PowerShell Script
**POST** `https://graph.microsoft.com/beta/deviceManagement/deviceManagementScripts`
Body must include `scriptContent` as Base64-encoded string.
⚠️ SAFETY: Confirm before uploading. Show the script content to the user first.

### 7.5 List Proactive Remediations (Health Scripts)
**GET** `https://graph.microsoft.com/beta/deviceManagement/deviceHealthScripts`

### 7.6 Get Remediation Script Execution Results
**GET** `https://graph.microsoft.com/beta/deviceManagement/deviceHealthScripts/{scriptId}/deviceRunStates`

---

## 👥 8. Users & Groups

### 8.1 List Users
**GET** `https://graph.microsoft.com/v1.0/users?$select=displayName,userPrincipalName,accountEnabled,jobTitle`

### 8.2 Search User
**GET** `https://graph.microsoft.com/v1.0/users?$filter=startsWith(displayName,'{name}')`

### 8.3 Get User Details
**GET** `https://graph.microsoft.com/v1.0/users/{userId}`

### 8.4 List Groups
**GET** `https://graph.microsoft.com/v1.0/groups?$select=displayName,description,groupTypes,membershipRule`

### 8.5 Get Group Members
**GET** `https://graph.microsoft.com/v1.0/groups/{groupId}/members`

### 8.6 Add User to Group
**POST** `https://graph.microsoft.com/v1.0/groups/{groupId}/members/$ref`
Body: `{"@odata.id": "https://graph.microsoft.com/v1.0/directoryObjects/{userId}"}`
⚠️ SAFETY: Confirm before adding.

### 8.7 Remove User from Group
**DELETE** `https://graph.microsoft.com/v1.0/groups/{groupId}/members/{userId}/$ref`
⚠️ SAFETY: Confirm before removing.

### 8.8 List Devices for a User
**GET** `https://graph.microsoft.com/v1.0/users/{userId}/managedDevices`

---

## 📊 9. Reporting & Dashboards

### 9.1 Device Compliance Summary
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?$select=complianceState`
Agent should calculate: X compliant, Y non-compliant, Z in-grace-period, and present as summary + table.

### 9.2 OS Distribution Summary
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?$select=operatingSystem`
Agent should group by OS and present: "42 Windows, 15 iOS, 8 Android, 3 macOS"

### 9.3 Stale Devices (Not synced recently)
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?$filter=lastSyncDateTime lt {30_days_ago}&$select=deviceName,lastSyncDateTime,userPrincipalName`
Agent should calculate the date for 30 days ago automatically.

### 9.4 Non-Compliant Devices Report
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?$filter=complianceState eq 'noncompliant'&$select=deviceName,complianceState,userPrincipalName,operatingSystem`

### 9.5 Export Report Job
**POST** `https://graph.microsoft.com/beta/deviceManagement/reports/exportJobs`
Body: `{"reportName": "Devices", "filter": "", "select": ["DeviceName","OS","ComplianceState"]}`

---

## 🏷️ 10. Device Categories & Enrollment

### 10.1 List Device Categories
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceCategories`

### 10.2 Create Device Category
**POST** `https://graph.microsoft.com/v1.0/deviceManagement/deviceCategories`
Body: `{"displayName": "Kategoriename", "description": "Beschreibung"}`

### 10.3 Set Device Category on a Device
**PUT** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{deviceId}/deviceCategory/$ref`

### 10.4 List Enrollment Restrictions
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceEnrollmentConfigurations`

---

## 🔄 11. RBAC (Role-Based Access Control)

### 11.1 List Intune Roles
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/roleDefinitions`

### 11.2 List Role Assignments
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/roleAssignments`

### 11.3 Get Role Details
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/roleDefinitions/{roleId}`

---

## 💡 Agent Response Guidelines

When the user asks a question, follow this logic:
1. **"Zeig mir alle Geräte"** → Use 1.1, format as table.
2. **"Ist Gerät X compliant?"** → Use 1.2 to find it, then check `complianceState`.
3. **"Sync Laptop von Max"** → Use 1.2 to find `managedDeviceId`, then use 1.4 Sync.
4. **"Wie viele Geräte hab ich?"** → Use 9.2, give OS distribution + total count.
5. **"Welche Geräte haben sich lange nicht gemeldet?"** → Use 9.3.
6. **"Erstell mir eine Compliance Policy für Windows"** → Use 2.5, ask for requirements first.
7. **"Welche Apps sind deployed?"** → Use 4.1.
8. **"Füg User Max zur Gruppe IT-Geräte hinzu"** → Use 8.2 to find user, 8.4 to find group, then 8.6.
9. **"Zeig mir den Status vom PowerShell Script XY"** → Use 7.3.
10. **"Gib mir einen Compliance Report"** → Use 9.1 + 9.4.
11. **"Zeig mir die Conditional Access Policies"** → Use 12.1.
12. **"Welche WLAN-Profile sind deployed?"** → Use 13.1.
13. **"Wie sind meine Windows Update Ringe konfiguriert?"** → Use 14.1.
14. **"Wer hat letzte Woche was in Intune geändert?"** → Use 17.1.
15. **"Kann Intune die Einstellung XY konfigurieren?"** → Use 18.1 Settings Catalog search.
16. **"Zeig mir alle Autopilot-Geräte ohne zugewiesenes Profil"** → Use 6.1 + filter.

---

## 🛡️ 12. Conditional Access (Bedingter Zugriff)

### 12.1 List Conditional Access Policies
**GET** `https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies`

Present as: | Policy Name | State (enabled/disabled/report) | Conditions | Grant Controls |

### 12.2 Get Conditional Access Policy Details
**GET** `https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies/{policyId}`

### 12.3 Create Conditional Access Policy
**POST** `https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies`
⚠️ SAFETY: Always confirm before creating. Show the user a summary of what the policy will do first.
💡 TIP: Recommend creating in "reportOnly" state first for testing.

### 12.4 Update Conditional Access Policy
**PATCH** `https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies/{policyId}`
⚠️ SAFETY: Confirm before modifying. Explain what will change.

### 12.5 Delete Conditional Access Policy
**DELETE** `https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies/{policyId}`
⚠️ SAFETY: Requires explicit user confirmation!

### 12.6 List Named Locations (Trusted IPs / Countries)
**GET** `https://graph.microsoft.com/v1.0/identity/conditionalAccess/namedLocations`

### 12.7 Create Named Location
**POST** `https://graph.microsoft.com/v1.0/identity/conditionalAccess/namedLocations`
Example IP-based:
```json
{
  "@odata.type": "#microsoft.graph.ipNamedLocation",
  "displayName": "Büro-Netzwerk",
  "isTrusted": true,
  "ipRanges": [{"@odata.type": "#microsoft.graph.iPv4CidrRange", "cidrAddress": "192.168.1.0/24"}]
}
```

### 12.8 List Authentication Strengths
**GET** `https://graph.microsoft.com/v1.0/identity/conditionalAccess/authenticationStrength/policies`

---

## 📶 13. WLAN, VPN & Zertifikate

### 13.1 List WLAN Profiles
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations?$filter=isof('microsoft.graph.windowsWifiConfiguration') or isof('microsoft.graph.iosWiFiConfiguration') or isof('microsoft.graph.androidWorkProfileWiFiConfiguration')`

Alternative (all configs, then filter by odata.type for Wi-Fi):
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations`
Agent should filter results where `@odata.type` contains `WiFi` or `wifi`.

### 13.2 List VPN Profiles
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations`
Agent should filter results where `@odata.type` contains `Vpn` or `vpn`.

### 13.3 Get WLAN/VPN Profile Details
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations/{configId}`

### 13.4 Get WLAN/VPN Profile Assignment
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations/{configId}/assignments`

### 13.5 List SCEP Certificate Profiles
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations`
Agent should filter results where `@odata.type` contains `Scep` or `Certificate`.

### 13.6 List PKCS Certificate Profiles
Same endpoint, filter for `Pkcs` in `@odata.type`.

### 13.7 List Trusted Root Certificate Profiles
Same endpoint, filter for `TrustedRootCertificate` in `@odata.type`.

---

## 🔄 14. Windows Update Management

### 14.1 List Windows Update Rings
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations?$filter=isof('microsoft.graph.windowsUpdateForBusinessConfiguration')`

Present as: | Ring Name | Deferral (Days) | Quality Updates | Feature Updates | Assigned To |

### 14.2 Get Update Ring Details
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations/{ringId}`

### 14.3 List Feature Update Profiles
**GET** `https://graph.microsoft.com/beta/deviceManagement/windowsFeatureUpdateProfiles`

### 14.4 Get Feature Update Profile Details
**GET** `https://graph.microsoft.com/beta/deviceManagement/windowsFeatureUpdateProfiles/{profileId}`

### 14.5 Get Feature Update Deployment State per Device
**GET** `https://graph.microsoft.com/beta/deviceManagement/windowsFeatureUpdateProfiles/{profileId}/deviceUpdateStates`

### 14.6 List Driver Update Profiles
**GET** `https://graph.microsoft.com/beta/deviceManagement/windowsDriverUpdateProfiles`

### 14.7 Get Driver Update Profile Details
**GET** `https://graph.microsoft.com/beta/deviceManagement/windowsDriverUpdateProfiles/{profileId}`

### 14.8 List Quality Update Profiles (Expedited Updates)
**GET** `https://graph.microsoft.com/beta/deviceManagement/windowsQualityUpdateProfiles`

### 14.9 Pause/Resume an Update Ring
**POST** `https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations/{ringId}/windowsUpdateForBusinessConfiguration/pause`
**POST** `https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations/{ringId}/windowsUpdateForBusinessConfiguration/resume`
⚠️ SAFETY: Confirm before pausing/resuming.

---

## 🍎 15. Apple Device Management

### 15.1 List Apple DEP/ADE Enrollment Profiles
**GET** `https://graph.microsoft.com/beta/deviceManagement/depOnboardingSettings`

### 15.2 List Apple DEP Tokens
**GET** `https://graph.microsoft.com/beta/deviceManagement/depOnboardingSettings/{depId}/enrollmentProfiles`

### 15.3 List Apple Push Notification Certificate Info
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/applePushNotificationCertificate`

Shows: Expiration date, Subject, Certificate serial number.
💡 Agent should proactively warn if certificate expires within 30 days!

### 15.4 List VPP Tokens (Volume Purchase Program)
**GET** `https://graph.microsoft.com/beta/deviceManagement/vppTokens`

### 15.5 List iOS/macOS Managed App Configurations
**GET** `https://graph.microsoft.com/v1.0/deviceAppManagement/managedAppPolicies`
Filter for iOS/macOS types.

### 15.6 Activation Lock Bypass (iOS Supervised)
**POST** `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{managedDeviceId}/bypassActivationLock`
⚠️ SAFETY: Requires explicit user confirmation!

---

## 🤖 16. Android Enterprise Management

### 16.1 List Android Managed Store Apps
**GET** `https://graph.microsoft.com/beta/deviceManagement/androidManagedStoreAccountEnterpriseSettings`

### 16.2 List Android Enrollment Profiles
**GET** `https://graph.microsoft.com/beta/deviceManagement/androidDeviceOwnerEnrollmentProfiles`

### 16.3 Get Android Enterprise Binding Status
**GET** `https://graph.microsoft.com/beta/deviceManagement/androidManagedStoreAccountEnterpriseSettings`

Shows if Android Enterprise (Work Profile / Fully Managed / Dedicated) is connected.

### 16.4 List Android App Protection Policies
**GET** `https://graph.microsoft.com/v1.0/deviceAppManagement/androidManagedAppProtections`

---

## 📝 17. Audit Logs & Activity

### 17.1 List Intune Audit Events
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/auditEvents`

Present as: | Date | Activity | Actor (who) | Target | Result |

### 17.2 Filter Audit Events by Date Range
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/auditEvents?$filter=activityDateTime gt {startDate} and activityDateTime lt {endDate}`

Agent should calculate the date range based on user request (e.g., "letzte Woche" → last 7 days).

### 17.3 Filter Audit Events by User
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/auditEvents?$filter=actor/userPrincipalName eq '{user@domain.com}'`

### 17.4 Get Audit Event Details
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/auditEvents/{auditEventId}`

### 17.5 List Directory Audit Logs (Entra ID level)
**GET** `https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?$filter=category eq 'Device'`

### 17.6 List Sign-In Logs
**GET** `https://graph.microsoft.com/v1.0/auditLogs/signIns?$filter=appDisplayName eq 'Microsoft Intune'`

---

## 🏗️ 18. Settings Catalog & GPO Analytics

### 18.1 Search Settings Catalog
**GET** `https://graph.microsoft.com/beta/deviceManagement/configurationSettings?$search="{searchTerm}"`

This is extremely useful when the user asks: "Can Intune configure setting X?" or "Hat Intune eine Einstellung für Bildschirmschoner?"

### 18.2 List Group Policy Migration Reports
**GET** `https://graph.microsoft.com/beta/deviceManagement/groupPolicyMigrationReports`

Use this when the user asks about migrating from on-premises GPO to Intune.

### 18.3 Get Migration Report Details
**GET** `https://graph.microsoft.com/beta/deviceManagement/groupPolicyMigrationReports/{reportId}`

Shows: Which GPO settings are supported in Intune, which are not, and recommended alternatives.

### 18.4 List Group Policy Uploaded Definition Files
**GET** `https://graph.microsoft.com/beta/deviceManagement/groupPolicyUploadedDefinitionFiles`

---

## 📄 19. Terms & Conditions and Notifications

### 19.1 List Terms & Conditions
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/termsAndConditions`

### 19.2 Get Terms & Conditions Details
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/termsAndConditions/{termsId}`

### 19.3 Get Terms Acceptance Status
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/termsAndConditions/{termsId}/acceptanceStatuses`

Shows which users have accepted which version.

### 19.4 Create Terms & Conditions
**POST** `https://graph.microsoft.com/v1.0/deviceManagement/termsAndConditions`
⚠️ SAFETY: Confirm before creating.

### 19.5 List Notification Message Templates
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/notificationMessageTemplates`

### 19.6 Create Notification Template (Non-Compliance Email)
**POST** `https://graph.microsoft.com/v1.0/deviceManagement/notificationMessageTemplates`
⚠️ SAFETY: Confirm before creating.

### 19.7 Send Test Notification
**POST** `https://graph.microsoft.com/v1.0/deviceManagement/notificationMessageTemplates/{templateId}/sendTestMessage`

---

## 🔐 20. App Protection Policies (MAM)

### 20.1 List iOS App Protection Policies
**GET** `https://graph.microsoft.com/v1.0/deviceAppManagement/iosManagedAppProtections`

### 20.2 List Android App Protection Policies
**GET** `https://graph.microsoft.com/v1.0/deviceAppManagement/androidManagedAppProtections`

### 20.3 List Windows Information Protection Policies
**GET** `https://graph.microsoft.com/v1.0/deviceAppManagement/windowsInformationProtectionPolicies`

### 20.4 Get App Protection Policy Details
**GET** `https://graph.microsoft.com/v1.0/deviceAppManagement/iosManagedAppProtections/{policyId}`
or
**GET** `https://graph.microsoft.com/v1.0/deviceAppManagement/androidManagedAppProtections/{policyId}`

### 20.5 Get App Protection Status per User
**GET** `https://graph.microsoft.com/v1.0/deviceAppManagement/managedAppRegistrations?$filter=userId eq '{userId}'`

### 20.6 Create App Protection Policy
**POST** `https://graph.microsoft.com/v1.0/deviceAppManagement/iosManagedAppProtections`
or
**POST** `https://graph.microsoft.com/v1.0/deviceAppManagement/androidManagedAppProtections`
⚠️ SAFETY: Confirm before creating. Show policy summary first.

---

## 📱 21. Enrollment Configuration

### 21.1 List All Enrollment Configurations
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceEnrollmentConfigurations`

Includes: Device Limit Restrictions, Platform Restrictions, Enrollment Status Page (ESP), Windows Hello for Business.

### 21.2 Get Enrollment Configuration Details
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceEnrollmentConfigurations/{configId}`

### 21.3 Get Enrollment Configuration Assignments
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceEnrollmentConfigurations/{configId}/assignments`

### 21.4 List Enrollment Status Page (ESP) Profiles
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceEnrollmentConfigurations?$filter=isof('microsoft.graph.windows10EnrollmentCompletionPageConfiguration')`

### 21.5 List Windows Hello for Business Configurations
**GET** `https://graph.microsoft.com/v1.0/deviceManagement/deviceEnrollmentConfigurations?$filter=isof('microsoft.graph.deviceEnrollmentWindowsHelloForBusinessConfiguration')`

---

## 🧮 22. Filters & Scope Tags

### 22.1 List Assignment Filters
**GET** `https://graph.microsoft.com/beta/deviceManagement/assignmentFilters`

Present as: | Filter Name | Platform | Rule | Created |

### 22.2 Get Filter Details
**GET** `https://graph.microsoft.com/beta/deviceManagement/assignmentFilters/{filterId}`

### 22.3 Create Assignment Filter
**POST** `https://graph.microsoft.com/beta/deviceManagement/assignmentFilters`
⚠️ SAFETY: Confirm before creating.

### 22.4 Test/Preview Filter Results
**POST** `https://graph.microsoft.com/beta/deviceManagement/assignmentFilters/{filterId}/getState`

### 22.5 List Scope Tags
**GET** `https://graph.microsoft.com/beta/deviceManagement/roleScopeTags`

### 22.6 Create Scope Tag
**POST** `https://graph.microsoft.com/beta/deviceManagement/roleScopeTags`
⚠️ SAFETY: Confirm before creating.