Supported Object Types

Intune Commander supports over 30 Microsoft Intune and Entra ID object types across device management, application management, endpoint security, and identity governance.

​

Device Configuration

​

Device Configurations

Graph Endpoint: /deviceManagement/deviceConfigurations
Service: ConfigurationProfileService
Operations: List, Get, Create, Update, Delete, GetAssignments
Permission: DeviceManagementConfiguration.ReadWrite.All Traditional device configuration profiles including:

• Device restrictions
• Email profiles
• Wi-Fi profiles
• VPN profiles
• Certificate profiles
• Custom profiles (OMA-URI)

​

Settings Catalog

Graph Endpoint: /deviceManagement/configurationPolicies
Service: SettingsCatalogService
Operations: List, Get, GetAssignments
Permission: DeviceManagementConfiguration.ReadWrite.All
Note: Uses $top=100 page size limit due to Cosmos DB cursor stability requirements Modern settings catalog policies with thousands of available settings across Windows, macOS, and iOS/iPadOS.

​

Administrative Templates

Graph Endpoint: /deviceManagement/groupPolicyConfigurations
Service: AdministrativeTemplateService
Operations: List, Get, Create, Update, Delete, GetAssignments, Assign
Permission: DeviceManagementConfiguration.ReadWrite.All Windows group policy administrative templates (ADMX-backed policies).

​

ADMX Files

Graph Endpoint: /deviceManagement/groupPolicyUploadedDefinitionFiles
Service: AdmxFileService
Operations: List, Get, Create, Delete
Permission: DeviceManagementConfiguration.ReadWrite.All Custom ADMX files uploaded to the tenant for use with administrative templates.

​

Endpoint Security

Graph Endpoint: /deviceManagement/intents
Service: EndpointSecurityService
Operations: List, Get, Create, Update, Delete, GetAssignments, Assign
Permission: DeviceManagementConfiguration.ReadWrite.All Endpoint security policies:

• Antivirus
• Disk encryption
• Firewall
• Endpoint detection and response (EDR)
• Attack surface reduction
• Account protection

​

Compliance

​

Compliance Policies

Graph Endpoint: /deviceManagement/deviceCompliancePolicies
Service: CompliancePolicyService
Operations: List, Get, Create, Update, Delete, GetAssignments, Assign
Permission: DeviceManagementConfiguration.ReadWrite.All Device compliance policies for Windows, macOS, iOS/iPadOS, and Android platforms.

​

Compliance Scripts

Graph Endpoint: /deviceManagement/deviceComplianceScripts
Service: ComplianceScriptService
Operations: List, Get
Permission: DeviceManagementConfiguration.ReadWrite.All Custom PowerShell scripts for compliance evaluation (Windows 10/11).

​

Application Management

​

Applications

Graph Endpoint: /deviceAppManagement/mobileApps
Service: ApplicationService
Operations: List, Get, GetAssignments
Permission: DeviceManagementApps.ReadWrite.All All application types:

• Win32 apps
• Microsoft Store apps
• Microsoft 365 apps
• Web links
• iOS/iPadOS apps
• Android apps
• macOS apps

​

App Protection Policies

Graph Endpoint: /deviceAppManagement/managedAppPolicies
Service: AppProtectionPolicyService
Operations: List, Get, Create, Update, Delete
Permission: DeviceManagementApps.ReadWrite.All Mobile application management (MAM) policies for iOS/iPadOS and Android.

​

Managed App Configurations

Graph Endpoints:

• /deviceAppManagement/mobileAppConfigurations
• /deviceAppManagement/targetedManagedAppConfigurations

Service: ManagedAppConfigurationService
Operations: List, Get, Create, Update, Delete (both endpoint types)
Permission: DeviceManagementApps.ReadWrite.All Managed app configuration policies for both device-based and user-based scenarios.

​

Policy Sets

Graph Endpoint: /deviceAppManagement/policySets
Service: PolicySetService
Operations: List, Get
Permission: DeviceManagementApps.ReadWrite.All Collections of apps and policies grouped together for unified assignment.

​

Windows Updates

​

Feature Update Profiles

Graph Endpoint: /deviceManagement/windowsFeatureUpdateProfiles
Service: FeatureUpdateProfileService
Operations: List, Get, Create, Update, Delete
Permission: DeviceManagementConfiguration.ReadWrite.All Windows 10/11 feature update deployment profiles.

​

Quality Update Profiles

Graph Endpoint: /deviceManagement/windowsQualityUpdateProfiles
Service: QualityUpdateProfileService
Operations: List, Get, Create, Update
Permission: DeviceManagementConfiguration.ReadWrite.All
Note: Uses $top=200 page size limit (hard API cap) Windows 10/11 quality update (monthly cumulative update) deployment profiles.

​

Driver Update Profiles

Graph Endpoint: /deviceManagement/windowsDriverUpdateProfiles
Service: DriverUpdateProfileService
Operations: List, Get, Create, Update, Delete
Permission: DeviceManagementConfiguration.ReadWrite.All
Note: Uses $top=200 page size limit (hard API cap) Windows driver update deployment profiles.

​

Device Enrollment

​

Enrollment Configurations

Graph Endpoint: /deviceManagement/deviceEnrollmentConfigurations
Service: EnrollmentConfigurationService
Operations: List (4 variants by platform), Get, Create, Update, Delete
Permission: DeviceManagementServiceConfig.ReadWrite.All Enrollment restrictions and configurations:

• Platform restrictions
• Enrollment status page
• Enrollment time device name templates
• Limit settings

​

Autopilot Profiles

Graph Endpoint: /deviceManagement/windowsAutopilotDeploymentProfiles
Service: AutopilotService
Operations: List, Get, Create, Update, Delete
Permission: DeviceManagementServiceConfig.ReadWrite.All Windows Autopilot deployment profiles.

​

Apple DEP Settings

Graph Endpoint: /deviceManagement/depOnboardingSettings
Service: AppleDepService
Operations: List, Get, ListEnrollmentProfiles
Permission: DeviceManagementServiceConfig.ReadWrite.All Apple Device Enrollment Program (DEP) onboarding settings and enrollment profiles.

​

Scripts & Remediation

​

Device Health Scripts

Graph Endpoint: /deviceManagement/deviceHealthScripts
Service: DeviceHealthScriptService
Operations: List, Get, Create, Update, Delete
Permission: DeviceManagementScripts.ReadWrite.All Proactive remediation scripts (detection and remediation) for Windows 10/11.

​

Device Shell Scripts (macOS)

Graph Endpoint: /deviceManagement/deviceShellScripts
Service: DeviceShellScriptService
Operations: List, Get
Permission: DeviceManagementScripts.ReadWrite.All Shell scripts for macOS devices.

​

Mac Custom Attributes

Graph Endpoint: /deviceManagement/deviceCustomAttributeShellScripts
Service: MacCustomAttributeService
Operations: List, Get, Create, Update, Delete
Permission: DeviceManagementScripts.ReadWrite.All Custom attribute collection scripts for macOS devices.

​

Conditional Access & Identity

​

Conditional Access Policies

Graph Endpoint: /identity/conditionalAccess/policies
Service: ConditionalAccessPolicyService
Operations: List, Get
Permission: Policy.ReadWrite.ConditionalAccess or Policy.Read.All Entra ID Conditional Access policies.

​

Named Locations

Graph Endpoint: /identity/conditionalAccess/namedLocations
Service: NamedLocationService
Operations: List, Get, Create, Update, Delete
Permission: Policy.ReadWrite.ConditionalAccess Named locations (IP ranges and country/region locations) for Conditional Access.

​

Authentication Strengths

Graph Endpoint: /identity/conditionalAccess/authenticationStrength/policies
Service: AuthenticationStrengthService
Operations: List, Get, Create, Update, Delete
Permission: Policy.ReadWrite.ConditionalAccess Custom authentication strength policies defining allowed authentication methods.

​

Authentication Contexts

Graph Endpoint: /identity/conditionalAccess/authenticationContextClassReferences
Service: AuthenticationContextService
Operations: List, Get, Create, Update, Delete
Permission: Policy.ReadWrite.ConditionalAccess Authentication context class references for step-up authentication scenarios.

​

Terms of Use

Graph Endpoint: /identityGovernance/termsOfUse/agreements
Service: TermsOfUseService
Operations: List, Get, Create, Update, Delete
Permission: Agreement.ReadWrite.All Entra ID terms of use agreements.

​

Branding & Tenant Settings

​

Intune Branding

Graph Endpoint: /deviceManagement/intuneBrandingProfiles
Service: IntuneBrandingService
Operations: List, Get, Create, Update, Delete
Permission: DeviceManagementServiceConfig.ReadWrite.All Intune Company Portal branding profiles.

​

Azure Branding

Graph Endpoint: /organization/{id}/branding/localizations
Service: AzureBrandingService
Operations: List, Get, Create, Update, Delete
Permissions: Organization.Read.All, OrganizationalBranding.ReadWrite.All Entra ID sign-in page branding and localizations.

​

Terms and Conditions

Graph Endpoint: /deviceManagement/termsAndConditions
Service: TermsAndConditionsService
Operations: List, Get, Create, Update, Delete
Permission: DeviceManagementServiceConfig.ReadWrite.All Intune terms and conditions that users must accept before enrollment.

​

Role-Based Access Control

​

Role Definitions

Graph Endpoint: /deviceManagement/roleDefinitions
Service: RoleDefinitionService
Operations: List, Get, Create, Update, Delete
Permission: DeviceManagementRBAC.ReadWrite.All Custom RBAC role definitions for Intune administration.

​

Scope Tags

Graph Endpoint: /deviceManagement/roleScopeTags
Service: ScopeTagService
Operations: List, Get, Create, Update, Delete
Permission: DeviceManagementRBAC.ReadWrite.All Scope tags for role-based administration and multi-tenant management.

​

Assignment & Filters

​

Assignment Filters

Graph Endpoint: /deviceManagement/assignmentFilters
Service: AssignmentFilterService
Operations: List, Get
Permission: DeviceManagementConfiguration.ReadWrite.All Dynamic device assignment filters for targeted policy and app deployment.

​

Groups

​

Groups

Graph Endpoints:

• /groups
• /groups/{id}/members

Service: GroupService
Operations: List, Search, GetMembers, GetMemberCounts
Permissions: Group.Read.All, GroupMember.Read.All Entra ID groups used for policy and app assignments.

​

Windows 365 (Cloud PC)

​

Cloud PC Provisioning Policies

Graph Endpoint: /deviceManagement/virtualEndpoint/provisioningPolicies
Service: CloudPcProvisioningService
Operations: List, Get
Permission: CloudPC.ReadWrite.All

​

Cloud PC User Settings

Graph Endpoint: /deviceManagement/virtualEndpoint/userSettings
Service: CloudPcUserSettingsService
Operations: List, Get
Permission: CloudPC.ReadWrite.All

​

Other Objects

​

Device Categories

Graph Endpoint: /deviceManagement/deviceCategories
Service: DeviceCategoryService
Operations: List, Get
Permission: DeviceManagementManagedDevices.Read.All Device categories for organizational grouping.

​

Notification Templates

Graph Endpoint: (varies by notification type)
Service: NotificationTemplateService
Permission: DeviceManagementServiceConfig.ReadWrite.All Notification message templates for end-user communications.

​

VPP Tokens

Graph Endpoint: (Apple/Microsoft Volume Purchase Program endpoints)
Service: VppTokenService
Permission: DeviceManagementApps.ReadWrite.All Volume Purchase Program token management for app licensing.

​

Reusable Policy Settings

Graph Endpoint: /deviceManagement/reusablePolicySettings
Service: ReusablePolicySettingService
Permission: DeviceManagementConfiguration.ReadWrite.All Reusable settings groups for endpoint security policies.

​

API Version

All services use the Microsoft Graph Beta API (/beta endpoint). Intune Commander uses the Microsoft.Graph.Beta SDK (version 5.130.x-preview), not the stable Microsoft.Graph package.

​

Multi-Cloud Support

All object types are supported across all four cloud environments:

• Microsoft Commercial (graph.microsoft.com)
• GCC (graph.microsoft.com)
• GCC-High (graph.microsoft.us)
• DoD (dod-graph.microsoft.us)

See the cloud-specific configuration pages for endpoint details.