Microsoft Graph Device Management
Microsoft Intune is a Microsoft cloud-based management solution that provides for mobile device and operating system management.
IT Services · Microsoft Graph Device Management
Details
| ID | Microsoft Graph Device Management |
|---|---|
| Provider | Microsoft |
| Category | IT Services |
| From Version | 5.0.0 |
| Docker Image | demisto/crypto:1.0.0.5490413 |
| Supported Modules | Agentix Cloud Runtime Security XSIAM EDR Cortex Cloud |
README
Microsoft Intune is a Microsoft cloud-based management solution that provides for mobile device and operating system management
Authentication
For more details about the authentication used in this integration, see Microsoft Integrations - Authentication.
Required Permissions
- DeviceManagementApps.ReadWrite.All - Application
- DeviceManagementConfiguration.ReadWrite.All - Application
- DeviceManagementManagedDevices.PrivilegedOperations.All - Application
- DeviceManagementManagedDevices.ReadWrite.All - Application
- DeviceManagementRBAC.ReadWrite.All - Application
- DeviceManagementServiceConfig.ReadWrite.All - Application
Configure Microsoft Endpoint Manager on Cortex XSOAR
- Navigate to Settings > Integrations > Servers & Services.
- Search for Microsoft Endpoint Manager.
- Click Add instance to create and configure a new integration instance.
| Parameter | Description | Required |
|---|---|---|
| azure_cloud | Azure Cloud. | False |
| auth_id | The Auth ID. | False |
| tenant_id | Token or tenant ID. | False |
| enc_key | Key or client secret. | False |
| Certificate Thumbprint | Used for certificate authentication. As appears in the “Certificates & secrets” page of the app. | False |
| Private Key | Used for certificate authentication. The private key of the registered certificate. | False |
| Use Azure Managed Identities | Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab. | False |
| Azure Managed Identities Client ID | The Managed Identities client id for authentication - relevant only if the integration is running on Azure VM. | False |
| url | Server URL, see note below regarding Azure cloud options. | False |
| insecure | Trust any certificate (not secure) | False |
| proxy | Use system proxy settings | False |
| self_deployed | Use a self deployed Azure Application | False |
-
Azure cloud options
Azure Cloud Description Worldwide The publicly accessible Azure Cloud. US GCC Azure cloud for the USA Government Cloud Community (GCC). US GCC-High Azure cloud for the USA Government Cloud Community High (GCC-High). DoD Azure cloud for the USA Department of Defense (DoD). Germany Azure cloud for the German Government. China Azure cloud for the Chinese Government. -
Click Test to validate the URLs, token, and connection.
Commands
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
msgraph-get-managed-device-by-id
Get managed devices
Note: physicalMemoryInBytes will return 0 by default since Microsoft hasn’t updated the v1.0 schema with that information yet
Required Permissions
DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementManagedDevices.Read.All
Base Command
msgraph-get-managed-device-by-id
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the managed device to be fetched (Can be retrieved using the msgraph-list-managed-devices command) | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| MSGraphDeviceManagement.Device.ID | String | The ID of the managed device |
| MSGraphDeviceManagement.Device.UserID | String | Unique Identifier for the user associated with the device |
| MSGraphDeviceManagement.Device.Name | String | Name of the device |
| MSGraphDeviceManagement.Device.ManagedDeviceOwnerType | String | Ownership of the device. Possible values are unknown, company, personal. |
| MSGraphDeviceManagement.Device.ActionResults.actionName | String | Action name |
| MSGraphDeviceManagement.Device.ActionResults.ActionState | String | State of the action. Possible values are none, pending, canceled, active, done, failed, notSupported |
| MSGraphDeviceManagement.Device.ActionResults.StartDateTime | Date | Time the action was initiated |
| MSGraphDeviceManagement.Device.ActionResults.lastUpdatedDateTime | Date | Time the action state was last updated |
| MSGraphDeviceManagement.Device.EnrolledDateTime | Date | Enrollment time of the device |
| MSGraphDeviceManagement.Device.LastSyncDateTime | Date | The date and time that the device last completed a successful sync with Intune. |
| MSGraphDeviceManagement.Device.OperatingSystem | String | Operating system of the device. Windows, iOS, etc. |
| MSGraphDeviceManagement.Device.ComplianceState | String | Compliance state of the device. Possible values are unknown, compliant, noncompliant, conflict, error, inGracePeriod, configManager |
| MSGraphDeviceManagement.Device.JailBroken | String | whether the device is jail broken or rooted. |
| MSGraphDeviceManagement.Device.ManagementAgent | String | Management channel of the device. Possible values are eas, mdm, easMdm, intuneClient, easIntuneClient, configurationManagerClient, configurationManagerClientMdm, configurationManagerClientMdmEas, unknown, jamf, googleCloudDevicePolicyController. |
| MSGraphDeviceManagement.Device.OSVersion | String | Operating system version of the device. |
| MSGraphDeviceManagement.Device.EASDeviceId | String | Exchange ActiveSync Id of the device. |
| MSGraphDeviceManagement.Device.EASActivationDateTime | Date | Exchange ActivationSync activation time of the device. |
| MSGraphDeviceManagement.Device.ActivationLockBypassCode | String | Code that allows the Activation Lock on a device to be bypassed. |
| MSGraphDeviceManagement.Device.EmailAddress | String | Email(s) for the user associated with the device |
| MSGraphDeviceManagement.Device.AzureADDeviceId | String | The unique identifier for the Entra ID device. Read only. |
| MSGraphDeviceManagement.Device.CategoryDisplayName | String | Device category display name |
| MSGraphDeviceManagement.Device.ExchangeAccessState | String | The Access State of the device in Exchange. Possible values are none, unknown, allowed, blocked, quarantined. |
| MSGraphDeviceManagement.Device.exchangeAccessStateReason | String | The reason for the device’s access state in Exchange. Possible values are none, unknown, exchangeGlobalRule, exchangeIndividualRule, exchangeDeviceRule, exchangeUpgrade, exchangeMailboxPolicy, other, compliant, notCompliant, notEnrolled, unknownLocation, mfaRequired, azureADBlockDueToAccessPolicy, compromisedPassword, deviceNotKnownWithManagedApp. |
| MSGraphDeviceManagement.Device.IsSupervised | Boolean | Device supervised status |
| MSGraphDeviceManagement.Device.IsEncrypted | Boolean | Device encryption status |
| MSGraphDeviceManagement.Device.UserPrincipalName | String | Device user principal name |
| MSGraphDeviceManagement.Device.Model | String | Model of the device |
| MSGraphDeviceManagement.Device.Manufacturer | String | Manufacturer of the device |
| MSGraphDeviceManagement.Device.IMEI | String | IMEI of the device |
| MSGraphDeviceManagement.Device.SerialNumber | String | Serial number of the device |
| MSGraphDeviceManagement.Device.PhoneNumber | String | Phone number of the device |
| MSGraphDeviceManagement.Device.AndroidSecurityPatchLevel | String | Android security patch level of the device |
| MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.inventory | Boolean | Whether inventory is managed by Intune |
| MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.modernApps | Boolean | Whether modern application is managed by Intune |
| MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.resourceAccess | Boolean | Whether resource access is managed by Intune |
| MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.deviceConfiguration | Boolean | Whether device configuration is managed by Intune |
| MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.compliancePolicy | Boolean | Whether compliance policy is managed by Intune |
| MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.windowsUpdateForBusiness | Boolean | Whether Windows Update for Business is managed by Intune |
| MSGraphDeviceManagement.Device.WiFiMacAddress | String | Wi-Fi MAC |
| MSGraphDeviceManagement.Device.HealthAttestationState.lastUpdateDateTime | String | The Timestamp of the last update. |
| MSGraphDeviceManagement.Device.HealthAttestationState.issuedDateTime | Date | The DateTime when device was evaluated or issued to MDM |
| MSGraphDeviceManagement.Device.HealthAttestationState.resetCount | Number | The number of times a PC device has hibernated or resumed |
| MSGraphDeviceManagement.Device.HealthAttestationState.restartCount | Number | The number of times a PC device has rebooted |
| MSGraphDeviceManagement.Device.HealthAttestationState.bitLockerStatus | String | On or Off of BitLocker Drive Encryption |
| MSGraphDeviceManagement.Device.HealthAttestationState.bootManagerVersion | String | The version of the Boot Manager |
| MSGraphDeviceManagement.Device.HealthAttestationState.secureBoot | String | When Secure Boot is enabled, the core components must have the correct cryptographic signatures |
| MSGraphDeviceManagement.Device.HealthAttestationState.bootDebugging | String | When bootDebugging is enabled, the device is used in development and testing |
| MSGraphDeviceManagement.Device.HealthAttestationState.operatingSystemKernelDebugging | String | When operatingSystemKernelDebugging is enabled, the device is used in development and testing |
| MSGraphDeviceManagement.Device.HealthAttestationState.codeIntegrity | String | When code integrity is enabled, code execution is restricted to integrity verified code |
| MSGraphDeviceManagement.Device.HealthAttestationState.testSigning | String | When test signing is allowed, the device does not enforce signature validation during boot |
| MSGraphDeviceManagement.Device.HealthAttestationState.safeMode, | String | Safe mode is a troubleshooting option for Windows that starts your computer in a limited state |
| MSGraphDeviceManagement.Device.HealthAttestationState.windowsPE | String | Operating system running with limited services that is used to prepare a computer for Windows |
| MSGraphDeviceManagement.Device.HealthAttestationState.earlyLaunchAntiMalwareDriverProtection | String | ELAM provides protection for the computers in your network when they start up |
| MSGraphDeviceManagement.Device.HealthAttestationState.virtualSecureMode | String | VSM is a container that protects high value assets from a compromised kernel |
| MSGraphDeviceManagement.Device.HealthAttestationState.pcrHashAlgorithm | String | Informational attribute that identifies the HASH algorithm that was used by TPM |
| MSGraphDeviceManagement.Device.HealthAttestationState.bootAppSecurityVersion | String | The security version number of the Boot Application |
| MSGraphDeviceManagement.Device.HealthAttestationState.bootManagerSecurityVersion | String | The security version number of the Boot Application |
| MSGraphDeviceManagement.Device.HealthAttestationState.tpmVersion | String | The security version number of the Boot Application |
| MSGraphDeviceManagement.Device.HealthAttestationState.pcr0 | String | The measurement that is captured in PCR[0] |
| MSGraphDeviceManagement.Device.HealthAttestationState.secureBootConfigurationPolicyFingerPrint | String | Fingerprint of the Custom Secure Boot Configuration Policy |
| MSGraphDeviceManagement.Device.HealthAttestationState.codeIntegrityPolicy | String | The Code Integrity policy that is controlling the security of the boot environment |
| MSGraphDeviceManagement.Device.HealthAttestationState.bootRevisionListInfo | String | The Boot Revision List that was loaded during initial boot on the attested device |
| MSGraphDeviceManagement.Device.HealthAttestationState.operatingSystemRevListInfo | String | The Operating System Revision List that was loaded during initial boot on the attested device |
| MSGraphDeviceManagement.Device.HealthAttestationState.healthStatusMismatchInfo | String | This attribute appears if DHA-Service detects an integrity issue |
| MSGraphDeviceManagement.Device.HealthAttestationState.healthAttestationSupportedStatus | String | This attribute indicates if DHA is supported for the device |
| MSGraphDeviceManagement.Device.SubscriberCarrier | String | Subscriber Carrier |
| MSGraphDeviceManagement.Device.MEID | String | MEID |
| MSGraphDeviceManagement.Device.TotalStorageSpaceInBytes | Number | Total Storage in Bytes |
| MSGraphDeviceManagement.Device.FreeStorageSpaceInBytes | Number | Free Storage in Bytes |
| MSGraphDeviceManagement.Device.ManagedDeviceName | String | Automatically generated name to identify a device. Can be overwritten to a user friendly name. |
| MSGraphDeviceManagement.Device.PartnerReportedThreatState | String | Indicates the threat state of a device when a Mobile Threat Defense partner is in use by the account and device. Read Only. Possible values are unknown, activated, deactivated, secured, lowSeverity, mediumSeverity, highSeverity, unresponsive, compromised, misconfigured. |
Command Example
!msgraph-get-managed-device-by-id device_id=DEVICE_ID_VALUE
Context Example
{
"MSGraphDeviceManagement": {
"Device": {
"AzureADDeviceID": "AZURE_AD_DEVICE_ID",
"ComplianceState": "compliant",
"EASActivationDateTime": "0001-01-01T00:00:00Z",
"EmailAddress": "EMAIL_ADDRESS",
"EnrolledDateTime": "2020-03-03T11:32:54.6467627Z",
"ExchangeAccessState": "none",
"ExchangeAccessStateReason": "none",
"FreeStorageSpaceInBytes": -1247805440,
"ID": "ID_VALUE",
"IsEncrypted": false,
"IsSupervised": false,
"JailBroken": "Unknown",
"LastSyncDateTime": "2020-05-05T10:34:20.9574056Z",
"ManagedDeviceName": "MANAGED_DEVICE_NAME",
"ManagedDeviceOwnerType": "company",
"ManagementAgent": "MANAGEMENT_AGENT",
"Manufacturer": "MANUFACTURER_VALUE",
"Model": "MODEL_VALUE",
"Name": "NAME_VALUE",
"OSVersion": "10.0.18363.778",
"OperatingSystem": "Windows",
"PartnerReportedThreatState": "highSeverity",
"SerialNumber": "SERIAL_NUMBER_VALUE",
"TotalStorageSpaceInBytes": -2097152,
"UserID": "USER_ID_VALUE",
"UserPrincipalName": "USER_PRINCIPAL_VALUE_NAME"
}
}
}
Human Readable Output
Managed device DESKTOP-S2455R8
ID User ID Device Name Operating System OS Version Email Address Manufacturer Model DEVICE_ID_VALUE 2827c1e7-edb6-4529-b50d-25984e968637 DESKTOP-S2455R8 Windows 10.0.18363.778 dev@demistodev.onmicrosoft.com VMware, Inc. VMware7,1
msgraph-sync-device
Check the device with Intune, immediately receive pending actions and policies
Required Permissions
DeviceManagementManagedDevices.PrivilegedOperations.All
Base Command
msgraph-sync-device
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command) | Required |
Context Output
There is no context output for this command.
Command Example
!msgraph-sync-device device_id=DEVICE_ID_VALUE
Human Readable Output
Sync device action activated successfully.
msgraph-device-disable-lost-mode
Disable the lost mode of the device
Required Permissions
DeviceManagementManagedDevices.PriviligedOperation.All
Base Command
msgraph-device-disable-lost-mode
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command) | Required |
Context Output
There is no context output for this command.
Command Example
!msgraph-windows-device-defender-scan device_id=DEVICE_ID_VALUE
Human Readable Output
Windows device defender scan action activated successfully.
msgraph-locate-device
Gets the GPS location of a device (iOS only)
Required Permissions
DeviceManagementManagedDevices.PriviligedOperation.All
Base Command
msgraph-locate-device
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command) | Required |
Context Output
There is no context output for this command.
Command Example
!msgraph-locate-device device_id=DEVICE_ID_VALUE
Human Readable Output
Locate device action activated successfully.
msgraph-device-reboot-now
Immediately reboots the device
Required Permissions
DeviceManagementManagedDevices.PrivilegedOperations.All
Base Command
msgraph-device-reboot-now
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command) | Required |
Context Output
There is no context output for this command.
Command Example
!msgraph-device-reboot-now device_id=DEVICE_ID_VALUE
Human Readable Output
Device reboot now action activated successfully..
msgraph-device-shutdown
Immideately shuts down the device
Required Permissions
DeviceManagementManagedDevices.PriviligedOperation.All
Base Command
msgraph-device-shutdown
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command) | Required |
Context Output
There is no context output for this command.
Command Example
!msgraph-device-shutdown device_id=DEVICE_ID_VALUE
Human Readable Output
Device shutdown action activated successfully.
msgraph-device-bypass-activation-lock
Removes the activation lock (iOS devices only)
Required Permissions
DeviceManagementManagedDevices.PriviligedOperation.All
Base Command
msgraph-device-bypass-activation-lock
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command) | Required |
Context Output
There is no context output for this command.
Command Example
!msgraph-device-bypass-activation-lock device_id=DEVICE_ID_VALUE
Human Readable Output
Device bypass activation lock action activated successfully.
msgraph-device-retire
Remove the device from intune management
Required Permissions
DeviceManagementManagedDevices.PriviligedOperation.All
Base Command
msgraph-device-retire
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command) | Required |
Context Output
There is no context output for this command.
Command Example
!msgraph-device-retire device_id=DEVICE_ID_VALUE
Human Readable Output
Retire device action activated successfully.
msgraph-device-reset-passcode
Resets the passcode for the device
Required Permissions
DeviceManagementManagedDevices.PriviligedOperation.All
Base Command
msgraph-device-reset-passcode
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command) | Required |
Context Output
There is no context output for this command.
Command Example
!msgraph-device-reset-passcode device_id=DEVICE_ID_VALUE
Human Readable Output
Device reset passcode action activated successfully.
msgraph-device-remote-lock
Lock the device, to unlock the user will have to use the passcode
Required Permissions
DeviceManagementManagedDevices.PriviligedOperation.All
Base Command
msgraph-device-remote-lock
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command) | Required |
Context Output
There is no context output for this command.
Command Example
!msgraph-device-remote-lock device_id=DEVICE_ID_VALUE
Human Readable Output
Device remote lock action activated successfully.
msgraph-device-request-remote-assistance
Request a remote access via TeamViewer
Required Permissions
DeviceManagementManagedDevices.ReadWrite.All
Base Command
msgraph-device-request-remote-assistance
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command) | Required |
Context Output
There is no context output for this command.
Command Example
!msgraph-device-request-remote-assistance device_id=DEVICE_ID_VALUE
Human Readable Output
Device request remote assistance action activated successfully.
msgraph-device-recover-passcode
Recovers the passcode from the device
Required Permissions
DeviceManagementManagedDevices.PriviligedOperation.All
Base Command
msgraph-device-recover-passcode
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command) | Required |
Context Output
There is no context output for this command.
Command Example
!msgraph-device-recover-passcode device_id=DEVICE_ID_VALUE
Human Readable Output
Device recover passcode action activated successfully.
msgraph-logout-shared-apple-device-active-user
logs out the current user on a shared iPad device
Required Permissions
DeviceManagementManagedDevices.PriviligedOperation.All
Base Command
msgraph-logout-shared-apple-device-active-user
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command) | Required |
Context Output
There is no context output for this command.
Command Example
!msgraph-logout-shared-apple-device-active-user device_id=DEVICE_ID_VALUE
Human Readable Output
Logout shard apple device active user action activated successfully.
msgraph-delete-user-from-shared-apple-device
deletes a user that you select from the local cache on a shared iPad device
Required Permissions
DeviceManagementManagedDevices.PriviligedOperation.All
Base Command
msgraph-delete-user-from-shared-apple-device
Input
| Argument Name | Description | Required |
|---|---|---|
| user_principal_name | The principal name of the user to be deleted. | Required |
| device_id | The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command) | Required |
Context Output
There is no context output for this command.
Command Example
!msgraph-delete-user-from-shared-apple-device device_id=DEVICE_ID_VALUE user_principal_name=USER_PRINCIPAL_NAME_VALUE
Human Readable Output
Delete user from shared apple device action activated successfully.
msgraph-windows-device-defender-update-signatures
Forece update windows defender signatures
Required Permissions
DeviceManagementManagedDevices.PriviligedOperation.All
Base Command
msgraph-windows-device-defender-update-signatures
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command) | Required |
Context Output
There is no context output for this command.
Command Example
!msgraph-windows-device-defender-update-signatures device_id=DEVICE_ID_VALUE
Human Readable Output
Windows device defender update signatures action activated successfully.
msgraph-clean-windows-device
removes any apps that are installed on a PC running Windows 10. it helps remove pre-installed (OEM) apps that are typically installed with a new PC
Required Permissions
DeviceManagementManagedDevices.PriviligedOperation.All
Base Command
msgraph-clean-windows-device
Input
| Argument Name | Description | Required |
|---|---|---|
| keep_user_data | Whether to keep the user’s data or not. (Default is set to true) | Optional |
| device_id | The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command) | Required |
Context Output
There is no context output for this command.
Command Example
!msgraph-clean-windows-device device_id=DEVICE_ID_VALUE keep_user_data=false
Human Readable Output
Clean windows device action activated successfully.
msgraph-windows-device-defender-scan
Scans the device with windows defender (windows devices only)
Required Permissions
DeviceManagementManagedDevices.PriviligedOperation.All
Base Command
msgraph-windows-device-defender-scan
Input
| Argument Name | Description | Required |
|---|---|---|
| quick_scan | Whether to peformn quick scan or not. (Default is set to true) | Optional |
| device_id | The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command) | Required |
Context Output
There is no context output for this command.
Command Example
!msgraph-windows-device-defender-scan device_id=DEVICE_ID_VALUE quick_scan=false
Human Readable Output
Windows device defender scan action activated successfully.
msgraph-wipe-device
restores a device to its factory default settings
Required Permissions
DeviceManagementManagedDevices.PriviligedOperation.All, DeviceManagementManagedDevices.ReadWrite.All
Base Command
msgraph-wipe-device
Input
| Argument Name | Description | Required |
|---|---|---|
| keep_enrollment_data | Whether to keep enrollment data or not. (Default is set to true) | Optional |
| keep_user_data | Whether to keep the user’s data or not. (Default is set to true) | Optional |
| mac_os_unlock_code | The MacOS unlock code. | Optional |
| device_id | The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command) | Required |
Context Output
There is no context output for this command.
Command Example
!msgraph-wipe-device device_id=DEVICE_ID_VALUE keep_enrollment_data=false keep_user_data=true
Human Readable Output
Wipe device action activated successfully.
msgraph-update-windows-device-account
Updates the windows account of the device
Required Permissions
DeviceManagementManagedDevices.PriviligedOperation.All
Base Command
msgraph-update-windows-device-account
Input
| Argument Name | Description | Required |
|---|---|---|
| session_initiation_protocal_address | SIP address | Required |
| exchange_server | Exchenge servier adddress | Required |
| calendar_sync_enabled | Whether to enable calendar sync or not. (Default is set to false) | Optional |
| password_rotation_enabled | Whether to enable password rotation or not. (Default is set to false) | Optional |
| device_account_password | The device account password. | Required |
| device_account_email | The device account email. | Required |
| device_id | The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command) | Required |
Context Output
There is no context output for this command.
Command Example
!msgraph-update-windows-device-account device_id=DEVICE_ID_VALUE session_initiation_protocal_address=PA_VALUE device_account_password=PW_VALUE device_account_email=MAIL_VALUE
Human Readable Output
Update windows device account action activated successfully.
msgraph-list-managed-devices
List of managed devices
Required Permissions
DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementManagedDevices.Read.All
Base Command
msgraph-list-managed-devices
Input
| Argument Name | Description | Required |
|---|---|---|
| limit | The number of managed devices to fetch. Default is 10. | Optional |
| next_link | A link that specifies a starting point to use for subsequent calls. | Optional |
| page_size | Number of results to return per page. Note: Page size is only relevant when the next_link parameter is not specified. |
Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| MSGraphDeviceManagement.DeviceNextLink | String | A link that specifies a starting point to use for subsequent calls. |
| MSGraphDeviceManagement.Device.ID | String | The ID of the managed device. |
| MSGraphDeviceManagement.Device.UserID | String | Unique identifier for the user associated with the device. |
| MSGraphDeviceManagement.Device.Name | String | Name of the device. |
| MSGraphDeviceManagement.Device.ManagedDeviceOwnerType | String | Ownership of the device. Possible values are unknown, company, personal. |
| MSGraphDeviceManagement.Device.ActionResults.actionName | String | Action name. |
| MSGraphDeviceManagement.Device.ActionResults.ActionState | String | State of the action. Possible values are none, pending, canceled, active, done, failed, notSupported. |
| MSGraphDeviceManagement.Device.ActionResults.StartDateTime | Date | Time the action was initiated. |
| MSGraphDeviceManagement.Device.ActionResults.lastUpdatedDateTime | Date | Time the action state was last updated. |
| MSGraphDeviceManagement.Device.EnrolledDateTime | Date | Enrollment time of the device. |
| MSGraphDeviceManagement.Device.LastSyncDateTime | Date | The date and time that the device last completed a successful sync with Intune. |
| MSGraphDeviceManagement.Device.OperatingSystem | String | Operating system of the device. Windows, iOS, etc. |
| MSGraphDeviceManagement.Device.ComplianceState | String | Compliance state of the device. Possible values are unknown, compliant, noncompliant, conflict, error, inGracePeriod, configManager. |
| MSGraphDeviceManagement.Device.JailBroken | String | Whether the device is jail broken or rooted. |
| MSGraphDeviceManagement.Device.ManagementAgent | String | Management channel of the device. Possible values are eas, mdm, easMdm, intuneClient, easIntuneClient, configurationManagerClient, configurationManagerClientMdm, configurationManagerClientMdmEas, unknown, jamf, googleCloudDevicePolicyController. |
| MSGraphDeviceManagement.Device.OSVersion | String | Operating system version of the device. |
| MSGraphDeviceManagement.Device.EASDeviceId | String | Exchange ActiveSync ID of the device. |
| MSGraphDeviceManagement.Device.EASActivationDateTime | Date | Exchange ActivationSync activation time of the device. |
| MSGraphDeviceManagement.Device.ActivationLockBypassCode | String | Code that allows the Activation Lock on a device to be bypassed. |
| MSGraphDeviceManagement.Device.EmailAddress | String | Email(s) for the user associated with the device. |
| MSGraphDeviceManagement.Device.AzureADDeviceId | String | The unique identifier for the Entra ID device. Read only. |
| MSGraphDeviceManagement.Device.CategoryDisplayName | String | Device category display name. |
| MSGraphDeviceManagement.Device.ExchangeAccessState | String | The Access State of the device in Exchange. Possible values are none, unknown, allowed, blocked, quarantined. |
| MSGraphDeviceManagement.Device.exchangeAccessStateReason | String | The reason for the device’s access state in Exchange. Possible values are none, unknown, exchangeGlobalRule, exchangeIndividualRule, exchangeDeviceRule, exchangeUpgrade, exchangeMailboxPolicy, other, compliant, notCompliant, notEnrolled, unknownLocation, mfaRequired, azureADBlockDueToAccessPolicy, compromisedPassword, deviceNotKnownWithManagedApp. |
| MSGraphDeviceManagement.Device.IsSupervised | Boolean | Device supervised status. |
| MSGraphDeviceManagement.Device.IsEncrypted | Boolean | Device encryption status. |
| MSGraphDeviceManagement.Device.UserPrincipalName | String | Device user principal name. |
| MSGraphDeviceManagement.Device.Model | String | Model of the device. |
| MSGraphDeviceManagement.Device.Manufacturer | String | Manufacturer of the device. |
| MSGraphDeviceManagement.Device.IMEI | String | IMEI of the device. |
| MSGraphDeviceManagement.Device.SerialNumber | String | Serial number of the device. |
| MSGraphDeviceManagement.Device.PhoneNumber | String | Phone number of the device. |
| MSGraphDeviceManagement.Device.AndroidSecurityPatchLevel | String | Android security patch level of the device. |
| MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.inventory | Boolean | Whether inventory is managed by Intune. |
| MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.modernApps | Boolean | Whether modern application is managed by Intune. |
| MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.resourceAccess | Boolean | Whether resource access is managed by Intune. |
| MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.deviceConfiguration | Boolean | Whether device configuration is managed by Intune. |
| MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.compliancePolicy | Boolean | Whether compliance policy is managed by Intune. |
| MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.windowsUpdateForBusiness | Boolean | Whether Windows Update for Business is managed by Intune. |
| MSGraphDeviceManagement.Device.WiFiMacAddress | String | Wi-Fi MAC. |
| MSGraphDeviceManagement.Device.HealthAttestationState.lastUpdateDateTime | String | The timestamp of the last update. |
| MSGraphDeviceManagement.Device.HealthAttestationState.issuedDateTime | Date | The datetime when the device was evaluated or issued to MDM. |
| MSGraphDeviceManagement.Device.HealthAttestationState.resetCount | Number | The number of times a PC device has hibernated or resumed. |
| MSGraphDeviceManagement.Device.HealthAttestationState.restartCount | Number | The number of times a PC device has rebooted. |
| MSGraphDeviceManagement.Device.HealthAttestationState.bitLockerStatus | String | On or Off of BitLocker Drive Encryption. |
| MSGraphDeviceManagement.Device.HealthAttestationState.bootManagerVersion | String | The version of the Boot Manager. |
| MSGraphDeviceManagement.Device.HealthAttestationState.secureBoot | String | When Secure Boot is enabled, the core components must have the correct cryptographic signatures. |
| MSGraphDeviceManagement.Device.HealthAttestationState.bootDebugging | String | When bootDebugging is enabled, the device is used in development and testing. |
| MSGraphDeviceManagement.Device.HealthAttestationState.operatingSystemKernelDebugging | String | When operatingSystemKernelDebugging is enabled, the device is used in development and testing. |
| MSGraphDeviceManagement.Device.HealthAttestationState.codeIntegrity | String | When code integrity is enabled, code execution is restricted to integrity verified code. |
| MSGraphDeviceManagement.Device.HealthAttestationState.testSigning | String | When test signing is allowed, the device does not enforce signature validation during boot. |
| MSGraphDeviceManagement.Device.HealthAttestationState.safeMode, | String | Safe mode is a troubleshooting option for Windows that starts your computer in a limited state. |
| MSGraphDeviceManagement.Device.HealthAttestationState.windowsPE | String | Operating system running with limited services that is used to prepare a computer for Windows. |
| MSGraphDeviceManagement.Device.HealthAttestationState.earlyLaunchAntiMalwareDriverProtection | String | ELAM provides protection for the computers in your network when they start up. |
| MSGraphDeviceManagement.Device.HealthAttestationState.virtualSecureMode | String | VSM is a container that protects high value assets from a compromised kernel. |
| MSGraphDeviceManagement.Device.HealthAttestationState.pcrHashAlgorithm | String | Informational attribute that identifies the HASH algorithm that was used by TPM. |
| MSGraphDeviceManagement.Device.HealthAttestationState.bootAppSecurityVersion | String | The security version number of the Boot Application. |
| MSGraphDeviceManagement.Device.HealthAttestationState.bootManagerSecurityVersion | String | The security version number of the Boot Application. |
| MSGraphDeviceManagement.Device.HealthAttestationState.tpmVersion | String | The security version number of the Boot Application. |
| MSGraphDeviceManagement.Device.HealthAttestationState.pcr0 | String | The measurement that is captured in PCR[0]. |
| MSGraphDeviceManagement.Device.HealthAttestationState.secureBootConfigurationPolicyFingerPrint | String | Fingerprint of the Custom Secure Boot Configuration Policy. |
| MSGraphDeviceManagement.Device.HealthAttestationState.codeIntegrityPolicy | String | The Code Integrity policy that is controlling the security of the boot environment. |
| MSGraphDeviceManagement.Device.HealthAttestationState.bootRevisionListInfo | String | The Boot Revision List that was loaded during initial boot on the attested device. |
| MSGraphDeviceManagement.Device.HealthAttestationState.operatingSystemRevListInfo | String | The Operating System Revision List that was loaded during initial boot on the attested device. |
| MSGraphDeviceManagement.Device.HealthAttestationState.healthStatusMismatchInfo | String | This attribute appears if DHA-Service detects an integrity issue. |
| MSGraphDeviceManagement.Device.HealthAttestationState.healthAttestationSupportedStatus | String | This attribute indicates if DHA is supported for the device. |
| MSGraphDeviceManagement.Device.SubscriberCarrier | String | Subscriber carrier. |
| MSGraphDeviceManagement.Device.MEID | String | Mobile Equipment Identifier. |
| MSGraphDeviceManagement.Device.TotalStorageSpaceInBytes | Number | Total storage in bytes. |
| MSGraphDeviceManagement.Device.FreeStorageSpaceInBytes | Number | Free storage in bytes. |
| MSGraphDeviceManagement.Device.ManagedDeviceName | String | Automatically generated name to identify a device. Can be overwritten to a user friendly name. |
| MSGraphDeviceManagement.Device.PartnerReportedThreatState | String | Indicates the threat state of a device when a Mobile Threat Defense partner is in use by the account and device. Read Only. Possible values are unknown, activated, deactivated, secured, lowSeverity, mediumSeverity, highSeverity, unresponsive, compromised, misconfigured. |
Command example
!msgraph-list-managed-devices page_size=1
Context Example
{
"MSGraphDeviceManagement": {
"Device": {
"AzureADDeviceID": "AZURE_AD_DEVICE_ID",
"ComplianceState": "compliant",
"EASActivationDateTime": "0001-01-01T00:00:00Z",
"EmailAddress": "EMAIL_ADDRESS",
"EnrolledDateTime": "2020-03-03T11:32:54.6467627Z",
"ExchangeAccessState": "none",
"ExchangeAccessStateReason": "none",
"FreeStorageSpaceInBytes": -1247805440,
"ID": "ID_VALUE",
"IsEncrypted": false,
"IsSupervised": false,
"JailBroken": "Unknown",
"LastSyncDateTime": "2020-05-05T10:34:20.9574056Z",
"ManagedDeviceName": "MANAGED_DEVICE_NAME",
"ManagedDeviceOwnerType": "company",
"ManagementAgent": "MANAGEMENT_AGENT",
"Manufacturer": "MANUFACTURER_VALUE",
"Model": "MODEL_VALUE",
"Name": "NAME_VALUE",
"OSVersion": "10.0.18363.778",
"OperatingSystem": "Windows",
"PartnerReportedThreatState": "highSeverity",
"SerialNumber": "SERIAL_NUMBER_VALUE",
"TotalStorageSpaceInBytes": -2097152,
"UserID": "USER_ID_VALUE",
"UserPrincipalName": "USER_PRINCIPAL_VALUE_NAME"},
"DeviceNextLink": {
"NextLink": "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices"
}
}
}
Human Readable Output
Managed device DESKTOP-S2455R8
ID User ID Device Name Operating System OS Version Email Address Manufacturer Model DEVICE_ID_VALUE 2827c1e7-edb6-4529-b50d-25984e968637 DESKTOP-S2455R8 Windows 10.0.18363.778 dev@demistodev.onmicrosoft.com VMware, Inc. VMware7,1 There are more results than shown. For more data please enter the next_link argument: next_link=https://graph.microsoft.com/v1.0/deviceManagement/managedDevices
msgraph-find-managed-devices-by-name
Search of managed devices by name
Required Permissions
DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementManagedDevices.Read.All
Base Command
msgraph-find-managed-devices-by-name
Input
| Argument Name | Description | Required |
|---|---|---|
| device_name | Search of managed devices by name | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| MSGraphDeviceManagement.Device.ID | String | The ID of the managed device |
| MSGraphDeviceManagement.Device.UserID | String | Unique Identifier for the user associated with the device |
| MSGraphDeviceManagement.Device.Name | String | Name of the device |
| MSGraphDeviceManagement.Device.ManagedDeviceOwnerType | String | Ownership of the device. Possible values are unknown, company, personal. |
| MSGraphDeviceManagement.Device.ActionResults.actionName | String | Action name |
| MSGraphDeviceManagement.Device.ActionResults.ActionState | String | State of the action. Possible values are none, pending, canceled, active, done, failed, notSupported |
| MSGraphDeviceManagement.Device.ActionResults.StartDateTime | Date | Time the action was initiated |
| MSGraphDeviceManagement.Device.ActionResults.lastUpdatedDateTime | Date | Time the action state was last updated |
| MSGraphDeviceManagement.Device.EnrolledDateTime | Date | Enrollment time of the device |
| MSGraphDeviceManagement.Device.LastSyncDateTime | Date | The date and time that the device last completed a successful sync with Intune. |
| MSGraphDeviceManagement.Device.OperatingSystem | String | Operating system of the device. Windows, iOS, etc. |
| MSGraphDeviceManagement.Device.ComplianceState | String | Compliance state of the device. Possible values are unknown, compliant, noncompliant, conflict, error, inGracePeriod, configManager |
| MSGraphDeviceManagement.Device.JailBroken | String | whether the device is jail broken or rooted. |
| MSGraphDeviceManagement.Device.ManagementAgent | String | Management channel of the device. Possible values are eas, mdm, easMdm, intuneClient, easIntuneClient, configurationManagerClient, configurationManagerClientMdm, configurationManagerClientMdmEas, unknown, jamf, googleCloudDevicePolicyController. |
| MSGraphDeviceManagement.Device.OSVersion | String | Operating system version of the device. |
| MSGraphDeviceManagement.Device.EASDeviceId | String | Exchange ActiveSync Id of the device. |
| MSGraphDeviceManagement.Device.EASActivationDateTime | Date | Exchange ActivationSync activation time of the device. |
| MSGraphDeviceManagement.Device.ActivationLockBypassCode | String | Code that allows the Activation Lock on a device to be bypassed. |
| MSGraphDeviceManagement.Device.EmailAddress | String | Email(s) for the user associated with the device |
| MSGraphDeviceManagement.Device.AzureADDeviceId | String | The unique identifier for the Entra ID device. Read only. |
| MSGraphDeviceManagement.Device.CategoryDisplayName | String | Device category display name |
| MSGraphDeviceManagement.Device.ExchangeAccessState | String | The Access State of the device in Exchange. Possible values are none, unknown, allowed, blocked, quarantined. |
| MSGraphDeviceManagement.Device.exchangeAccessStateReason | String | The reason for the device’s access state in Exchange. Possible values are none, unknown, exchangeGlobalRule, exchangeIndividualRule, exchangeDeviceRule, exchangeUpgrade, exchangeMailboxPolicy, other, compliant, notCompliant, notEnrolled, unknownLocation, mfaRequired, azureADBlockDueToAccessPolicy, compromisedPassword, deviceNotKnownWithManagedApp. |
| MSGraphDeviceManagement.Device.IsSupervised | Boolean | Device supervised status |
| MSGraphDeviceManagement.Device.IsEncrypted | Boolean | Device encryption status |
| MSGraphDeviceManagement.Device.UserPrincipalName | String | Device user principal name |
| MSGraphDeviceManagement.Device.Model | String | Model of the device |
| MSGraphDeviceManagement.Device.Manufacturer | String | Manufacturer of the device |
| MSGraphDeviceManagement.Device.IMEI | String | IMEI of the device |
| MSGraphDeviceManagement.Device.SerialNumber | String | Serial number of the device |
| MSGraphDeviceManagement.Device.PhoneNumber | String | Phone number of the device |
| MSGraphDeviceManagement.Device.AndroidSecurityPatchLevel | String | Android security patch level of the device |
| MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.inventory | Boolean | Whether inventory is managed by Intune |
| MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.modernApps | Boolean | Whether modern application is managed by Intune |
| MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.resourceAccess | Boolean | Whether resource access is managed by Intune |
| MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.deviceConfiguration | Boolean | Whether device configuration is managed by Intune |
| MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.compliancePolicy | Boolean | Whether compliance policy is managed by Intune |
| MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.windowsUpdateForBusiness | Boolean | Whether Windows Update for Business is managed by Intune |
| MSGraphDeviceManagement.Device.WiFiMacAddress | String | Wi-Fi MAC |
| MSGraphDeviceManagement.Device.HealthAttestationState.lastUpdateDateTime | String | The Timestamp of the last update. |
| MSGraphDeviceManagement.Device.HealthAttestationState.issuedDateTime | Date | The DateTime when device was evaluated or issued to MDM |
| MSGraphDeviceManagement.Device.HealthAttestationState.resetCount | Number | The number of times a PC device has hibernated or resumed |
| MSGraphDeviceManagement.Device.HealthAttestationState.restartCount | Number | The number of times a PC device has rebooted |
| MSGraphDeviceManagement.Device.HealthAttestationState.bitLockerStatus | String | On or Off of BitLocker Drive Encryption |
| MSGraphDeviceManagement.Device.HealthAttestationState.bootManagerVersion | String | The version of the Boot Manager |
| MSGraphDeviceManagement.Device.HealthAttestationState.secureBoot | String | When Secure Boot is enabled, the core components must have the correct cryptographic signatures |
| MSGraphDeviceManagement.Device.HealthAttestationState.bootDebugging | String | When bootDebugging is enabled, the device is used in development and testing |
| MSGraphDeviceManagement.Device.HealthAttestationState.operatingSystemKernelDebugging | String | When operatingSystemKernelDebugging is enabled, the device is used in development and testing |
| MSGraphDeviceManagement.Device.HealthAttestationState.codeIntegrity | String | When code integrity is enabled, code execution is restricted to integrity verified code |
| MSGraphDeviceManagement.Device.HealthAttestationState.testSigning | String | When test signing is allowed, the device does not enforce signature validation during boot |
| MSGraphDeviceManagement.Device.HealthAttestationState.safeMode, | String | Safe mode is a troubleshooting option for Windows that starts your computer in a limited state |
| MSGraphDeviceManagement.Device.HealthAttestationState.windowsPE | String | Operating system running with limited services that is used to prepare a computer for Windows |
| MSGraphDeviceManagement.Device.HealthAttestationState.earlyLaunchAntiMalwareDriverProtection | String | ELAM provides protection for the computers in your network when they start up |
| MSGraphDeviceManagement.Device.HealthAttestationState.virtualSecureMode | String | VSM is a container that protects high value assets from a compromised kernel |
| MSGraphDeviceManagement.Device.HealthAttestationState.pcrHashAlgorithm | String | Informational attribute that identifies the HASH algorithm that was used by TPM |
| MSGraphDeviceManagement.Device.HealthAttestationState.bootAppSecurityVersion | String | The security version number of the Boot Application |
| MSGraphDeviceManagement.Device.HealthAttestationState.bootManagerSecurityVersion | String | The security version number of the Boot Application |
| MSGraphDeviceManagement.Device.HealthAttestationState.tpmVersion | String | The security version number of the Boot Application |
| MSGraphDeviceManagement.Device.HealthAttestationState.pcr0 | String | The measurement that is captured in PCR[0] |
| MSGraphDeviceManagement.Device.HealthAttestationState.secureBootConfigurationPolicyFingerPrint | String | Fingerprint of the Custom Secure Boot Configuration Policy |
| MSGraphDeviceManagement.Device.HealthAttestationState.codeIntegrityPolicy | String | The Code Integrity policy that is controlling the security of the boot environment |
| MSGraphDeviceManagement.Device.HealthAttestationState.bootRevisionListInfo | String | The Boot Revision List that was loaded during initial boot on the attested device |
| MSGraphDeviceManagement.Device.HealthAttestationState.operatingSystemRevListInfo | String | The Operating System Revision List that was loaded during initial boot on the attested device |
| MSGraphDeviceManagement.Device.HealthAttestationState.healthStatusMismatchInfo | String | This attribute appears if DHA-Service detects an integrity issue |
| MSGraphDeviceManagement.Device.HealthAttestationState.healthAttestationSupportedStatus | String | This attribute indicates if DHA is supported for the device |
| MSGraphDeviceManagement.Device.SubscriberCarrier | String | Subscriber Carrier |
| MSGraphDeviceManagement.Device.MEID | String | MEID |
| MSGraphDeviceManagement.Device.TotalStorageSpaceInBytes | Number | Total Storage in Bytes |
| MSGraphDeviceManagement.Device.FreeStorageSpaceInBytes | Number | Free Storage in Bytes |
| MSGraphDeviceManagement.Device.ManagedDeviceName | String | Automatically generated name to identify a device. Can be overwritten to a user friendly name. |
| MSGraphDeviceManagement.Device.PartnerReportedThreatState | String | Indicates the threat state of a device when a Mobile Threat Defense partner is in use by the account and device. Read Only. Possible values are unknown, activated, deactivated, secured, lowSeverity, mediumSeverity, highSeverity, unresponsive, compromised, misconfigured. |
Command Example
!msgraph-find-managed-devices-by-name device_name=NAME_VALUE
Context Example
{
"MSGraphDeviceManagement": {
"Device": {
"AzureADDeviceID": "AZURE_AD_DEVICE_ID",
"ComplianceState": "compliant",
"EASActivationDateTime": "0001-01-01T00:00:00Z",
"EmailAddress": "EMAIL_ADDRESS",
"EnrolledDateTime": "2020-03-03T11:32:54.6467627Z",
"ExchangeAccessState": "none",
"ExchangeAccessStateReason": "none",
"FreeStorageSpaceInBytes": -1247805440,
"ID": "ID_VALUE",
"IsEncrypted": false,
"IsSupervised": false,
"JailBroken": "Unknown",
"LastSyncDateTime": "2020-05-05T10:34:20.9574056Z",
"ManagedDeviceName": "MANAGED_DEVICE_NAME",
"ManagedDeviceOwnerType": "company",
"ManagementAgent": "MANAGEMENT_AGENT",
"Manufacturer": "MANUFACTURER_VALUE",
"Model": "MODEL_VALUE",
"Name": "NAME_VALUE",
"OSVersion": "10.0.18363.778",
"OperatingSystem": "Windows",
"PartnerReportedThreatState": "highSeverity",
"SerialNumber": "SERIAL_NUMBER_VALUE",
"TotalStorageSpaceInBytes": -2097152,
"UserID": "USER_ID_VALUE",
"UserPrincipalName": "USER_PRINCIPAL_VALUE_NAME"
}
}
}
Human Readable Output
Managed device DESKTOP-S2455R8
ID User ID Device Name Operating System OS Version Email Address Manufacturer Model DEVICE_ID_VALUE 2827c1e7-edb6-4529-b50d-25984e968637 DESKTOP-S2455R8 Windows 10.0.18363.778 dev@demistodev.onmicrosoft.com VMware, Inc. VMware7,1
msgraph-device-auth-reset
Run this command if for some reason you need to rerun the authentication process.
Base Command
msgraph-device-auth-reset
Input
There are no input arguments for this command.
Context Output
There is no context output for this command.
msgraph-get-managed-device-physical-memory-by-id
Get the managed device physical memory bytes.
Base Command
msgraph-get-managed-device-physical-memory-by-id
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the managed device to be fetched. Can be retrieved using the msgraph-list-managed-devices command. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| MSGraphDeviceManagement.Device.id | String | The ID of the managed device. |
| MSGraphDeviceManagement.Device.physicalMemoryInBytes | String | The correct value of ID of the managed device. |
| MSGraphDeviceManagement.Device.deviceName | String | Name of the device. |
Command example
!msgraph-get-managed-device-physical-memory-by-id device_id=111111-1111-1111-1111-1111111
Context Example
{
"MSGraphDeviceManagement": {
"DeviceMemory": {
"ID": "111111-1111-1111-1111-1111111",
"Name": "Test",
"physicalMemoryInBytes": 4294967296
}
}
}
Human Readable Output
Managed device
physicalMemoryInBytes id 4294967296 111111-1111-1111-1111-1111111
Configuration parameters
azure_cloud— Azure Cloudauth_id— ID or Client IDcredentials_auth_id—tenant_id— Token or Tenant IDcredentials_tenant_id—enc_key— Key or Client Secretcredentials_enc_key—certificate_thumbprint— Certificate Thumbprintcredentials_certificate_thumbprint—private_key— Private Keyuse_managed_identities— Use Azure Managed Identitiesmanaged_identities_client_id—url— Server URLinsecure— Trust any certificate (not secure)proxy— Use system proxy settingsself_deployed— Use a self deployed Azure Application
Commands (23)
-
msgraph-clean-windows-deviceremoves any apps that are installed on a PC running Windows 10. it helps remove pre-installed (OEM) apps that are typically installed with a new PC.
-
msgraph-delete-user-from-shared-apple-devicedeletes a user that you select from the local cache on a shared iPad device.
-
msgraph-device-auth-resetRun this command if for some reason you need to rerun the authentication process.
-
msgraph-device-bypass-activation-lockRemoves the activation lock (iOS devices only).
-
msgraph-device-disable-lost-modeDisable the lost mode of the device.
-
msgraph-device-reboot-nowImmediately reboots the device.
-
msgraph-device-recover-passcodeRecovers the passcode from the device.
-
msgraph-device-remote-lockLock the device, to unlock the user will have to use the passcode.
-
msgraph-device-request-remote-assistanceRequest a remote access via TeamViewer.
-
msgraph-device-reset-passcodeResets the passcode for the device.
-
msgraph-device-retireRemove the device from intune management.
-
msgraph-device-shutdownImmideately shuts down the device.
-
msgraph-find-managed-devices-by-nameSearch of managed devices by name.
-
msgraph-get-managed-device-by-idGet managed devices. PhysicalMemoryInBytes will return 0 by default.
-
msgraph-get-managed-device-physical-memory-by-idGet the managed device physical memory bytes.
-
msgraph-list-managed-devicesList of managed devices.
-
msgraph-locate-deviceGets the GPS location of a device (iOS only).
-
msgraph-logout-shared-apple-device-active-userlogs out the current user on a shared iPad device.
-
msgraph-sync-deviceCheck the device with Intune, immediately receive pending actions and policies.
-
msgraph-update-windows-device-accountUpdates the windows account of the device.
-
msgraph-windows-device-defender-scanScans the device with windows defender (windows devices only).
-
msgraph-windows-device-defender-update-signaturesForece update windows defender signatures.
-
msgraph-wipe-devicerestores a device to its factory default settings.
category: IT Services provider: Microsoft sectionorder: - Connect - Collect commonfields: id: Microsoft Graph Device Management version: -1 configuration: - defaultvalue: Worldwide display: Azure Cloud name: azure_cloud required: false type: 15 options: - Worldwide - US GCC - US GCC-High - DoD - Germany - China - Custom additionalinfo: When selecting the Custom option, the Server URL parameter must be filled. More information about National Clouds can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud section: Connect advanced: true - display: ID or Client ID name: auth_id type: 4 hidden: true required: false section: Connect advanced: true - displaypassword: ID or Client ID name: credentials_auth_id hiddenusername: true type: 9 required: false section: Connect - display: Token or Tenant ID name: tenant_id type: 4 hidden: true required: false section: Connect advanced: true - displaypassword: Token or Tenant ID name: credentials_tenant_id hiddenusername: true type: 9 required: false section: Connect - display: Key or Client Secret name: enc_key type: 4 hidden: true required: false section: Connect advanced: true - displaypassword: Key or Client Secret name: credentials_enc_key hiddenusername: true type: 9 required: false section: Connect - additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app. display: Certificate Thumbprint name: certificate_thumbprint type: 4 hidden: true required: false section: Connect advanced: true - displaypassword: Certificate Thumbprint additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app. name: credentials_certificate_thumbprint hiddenusername: true type: 9 required: false section: Connect - additionalinfo: Used for certificate authentication. The private key of the registered certificate. display: Private Key name: private_key type: 14 required: false section: Connect advanced: true - additionalinfo: Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab. display: Use Azure Managed Identities name: use_managed_identities type: 8 required: false section: Connect advanced: true - additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM. displaypassword: Azure Managed Identities Client ID name: managed_identities_client_id hiddenusername: true type: 9 required: false section: Connect advanced: true - defaultvalue: https://graph.microsoft.com display: Server URL name: url required: false type: 0 additionalinfo: Use this option when required to customize the URL to the Azure management endpoint. More information can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud section: Connect advanced: true - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect advanced: true - display: Use system proxy settings name: proxy type: 8 required: false section: Connect advanced: true - additionalinfo: Select this checkbox if you are using a self-deployed Azure application. display: Use a self deployed Azure Application name: self_deployed type: 8 required: false section: Connect description: Microsoft Intune is a Microsoft cloud-based management solution that provides for mobile device and operating system management. display: Microsoft Endpoint Manager (Intune) name: Microsoft Graph Device Management script: commands: - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Get managed devices. PhysicalMemoryInBytes will return 0 by default. name: msgraph-get-managed-device-by-id outputs: - contextPath: MSGraphDeviceManagement.Device.ID description: The ID of the managed device. type: String - contextPath: MSGraphDeviceManagement.Device.UserID description: Unique Identifier for the user associated with the device. type: String - contextPath: MSGraphDeviceManagement.Device.Name description: Name of the device. type: String - contextPath: MSGraphDeviceManagement.Device.ManagedDeviceOwnerType description: Ownership of the device. Possible values are unknown, company, personal. type: String - contextPath: MSGraphDeviceManagement.Device.ActionResults.actionName description: Action name. type: String - contextPath: MSGraphDeviceManagement.Device.ActionResults.ActionState description: State of the action. Possible values are none, pending, canceled, active, done, failed, notSupported. type: String - contextPath: MSGraphDeviceManagement.Device.ActionResults.StartDateTime description: Time the action was initiated. type: Date - contextPath: MSGraphDeviceManagement.Device.ActionResults.lastUpdatedDateTime description: Time the action state was last updated. type: Date - contextPath: MSGraphDeviceManagement.Device.EnrolledDateTime description: Enrollment time of the device. type: Date - contextPath: MSGraphDeviceManagement.Device.LastSyncDateTime description: The date and time that the device last completed a successful sync with Intune. type: Date - contextPath: MSGraphDeviceManagement.Device.OperatingSystem description: Operating system of the device. Windows, iOS, etc. type: String - contextPath: MSGraphDeviceManagement.Device.ComplianceState description: Compliance state of the device. Possible values are unknown, compliant, noncompliant, conflict, error, inGracePeriod, configManager. type: String - contextPath: MSGraphDeviceManagement.Device.JailBroken description: whether the device is jail broken or rooted. type: String - contextPath: MSGraphDeviceManagement.Device.ManagementAgent description: Management channel of the device. Possible values are eas, mdm, easMdm, intuneClient, easIntuneClient, configurationManagerClient, configurationManagerClientMdm, configurationManagerClientMdmEas, unknown, jamf, googleCloudDevicePolicyController. type: String - contextPath: MSGraphDeviceManagement.Device.OSVersion description: Operating system version of the device. type: String - contextPath: MSGraphDeviceManagement.Device.EASDeviceId description: Exchange ActiveSync Id of the device. type: String - contextPath: MSGraphDeviceManagement.Device.EASActivationDateTime description: Exchange ActivationSync activation time of the device. type: Date - contextPath: MSGraphDeviceManagement.Device.ActivationLockBypassCode description: Code that allows the Activation Lock on a device to be bypassed. type: String - contextPath: MSGraphDeviceManagement.Device.EmailAddress description: Email(s) for the user associated with the device. type: String - contextPath: MSGraphDeviceManagement.Device.AzureADDeviceId description: The unique identifier for the Entra ID device. Read only. type: String - contextPath: MSGraphDeviceManagement.Device.CategoryDisplayName description: Device category display name. type: String - contextPath: MSGraphDeviceManagement.Device.ExchangeAccessState description: The Access State of the device in Exchange. Possible values are none, unknown, allowed, blocked, quarantined. type: String - contextPath: MSGraphDeviceManagement.Device.exchangeAccessStateReason description: The reason for the device's access state in Exchange. Possible values are none, unknown, exchangeGlobalRule, exchangeIndividualRule, exchangeDeviceRule, exchangeUpgrade, exchangeMailboxPolicy, other, compliant, notCompliant, notEnrolled, unknownLocation, mfaRequired, azureADBlockDueToAccessPolicy, compromisedPassword, deviceNotKnownWithManagedApp. type: String - contextPath: MSGraphDeviceManagement.Device.IsSupervised description: Device supervised status. type: Boolean - contextPath: MSGraphDeviceManagement.Device.IsEncrypted description: Device encryption status. type: Boolean - contextPath: MSGraphDeviceManagement.Device.UserPrincipalName description: Device user principal name. type: String - contextPath: MSGraphDeviceManagement.Device.Model description: Model of the device. type: String - contextPath: MSGraphDeviceManagement.Device.Manufacturer description: Manufacturer of the device. type: String - contextPath: MSGraphDeviceManagement.Device.IMEI description: IMEI of the device. type: String - contextPath: MSGraphDeviceManagement.Device.SerialNumber description: Serial number of the device. type: String - contextPath: MSGraphDeviceManagement.Device.PhoneNumber description: Phone number of the device. type: String - contextPath: MSGraphDeviceManagement.Device.AndroidSecurityPatchLevel description: Android security patch level of the device. type: String - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.inventory description: Whether inventory is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.modernApps description: Whether modern application is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.resourceAccess description: Whether resource access is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.deviceConfiguration description: Whether device configuration is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.compliancePolicy description: Whether compliance policy is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.windowsUpdateForBusiness description: Whether Windows Update for Business is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.WiFiMacAddress description: Wi-Fi MAC. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.lastUpdateDateTime description: The Timestamp of the last update. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.issuedDateTime description: The DateTime when device was evaluated or issued to MDM. type: Date - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.resetCount description: The number of times a PC device has hibernated or resumed. type: Number - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.restartCount description: The number of times a PC device has rebooted. type: Number - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bitLockerStatus description: On or Off of BitLocker Drive Encryption. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootManagerVersion description: The version of the Boot Manager. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.secureBoot description: When Secure Boot is enabled, the core components must have the correct cryptographic signatures. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootDebugging description: When bootDebugging is enabled, the device is used in development and testing. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.operatingSystemKernelDebugging description: When operatingSystemKernelDebugging is enabled, the device is used in development and testing. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.codeIntegrity description: When code integrity is enabled, code execution is restricted to integrity verified code. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.testSigning description: When test signing is allowed, the device does not enforce signature validation during boot. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.safeMode, description: Safe mode is a troubleshooting option for Windows that starts your computer in a limited state. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.windowsPE description: Operating system running with limited services that is used to prepare a computer for Windows. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.earlyLaunchAntiMalwareDriverProtection description: ELAM provides protection for the computers in your network when they start up. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.virtualSecureMode description: VSM is a container that protects high value assets from a compromised kernel. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.pcrHashAlgorithm description: Informational attribute that identifies the HASH algorithm that was used by TPM. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootAppSecurityVersion description: The security version number of the Boot Application. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootManagerSecurityVersion description: The security version number of the Boot Application. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.tpmVersion description: The security version number of the Boot Application. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.pcr0 description: The measurement that is captured in PCR[0]. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.secureBootConfigurationPolicyFingerPrint description: Fingerprint of the Custom Secure Boot Configuration Policy. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.codeIntegrityPolicy description: The Code Integrity policy that is controlling the security of the boot environment. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootRevisionListInfo description: The Boot Revision List that was loaded during initial boot on the attested device. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.operatingSystemRevListInfo description: The Operating System Revision List that was loaded during initial boot on the attested device. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.healthStatusMismatchInfo description: This attribute appears if DHA-Service detects an integrity issue. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.healthAttestationSupportedStatus description: This attribute indicates if DHA is supported for the device. type: String - contextPath: MSGraphDeviceManagement.Device.SubscriberCarrier description: Subscriber Carrier. type: String - contextPath: MSGraphDeviceManagement.Device.MEID description: MEID. type: String - contextPath: MSGraphDeviceManagement.Device.TotalStorageSpaceInBytes description: Total Storage in Bytes. type: Number - contextPath: MSGraphDeviceManagement.Device.FreeStorageSpaceInBytes description: Free Storage in Bytes. type: Number - contextPath: MSGraphDeviceManagement.Device.ManagedDeviceName description: Automatically generated name to identify a device. Can be overwritten to a user friendly name. type: String - contextPath: MSGraphDeviceManagement.Device.PartnerReportedThreatState description: Indicates the threat state of a device when a Mobile Threat Defense partner is in use by the account and device. Read Only. Possible values are unknown, activated, deactivated, secured, lowSeverity, mediumSeverity, highSeverity, unresponsive, compromised, misconfigured. type: String - arguments: - description: The ID of the managed device to be fetched. Can be retrieved using the msgraph-list-managed-devices command. name: device_id required: true description: Get the managed device physical memory bytes. name: msgraph-get-managed-device-physical-memory-by-id outputs: - contextPath: MSGraphDeviceManagement.Device.id description: The ID of the managed device. type: String - contextPath: MSGraphDeviceManagement.Device.physicalMemoryInBytes description: The correct value of ID of the managed device. type: String - contextPath: MSGraphDeviceManagement.Device.deviceName description: Name of the device. type: String - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Check the device with Intune, immediately receive pending actions and policies. name: msgraph-sync-device - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Disable the lost mode of the device. name: msgraph-device-disable-lost-mode - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Gets the GPS location of a device (iOS only). name: msgraph-locate-device - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Immediately reboots the device. name: msgraph-device-reboot-now - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Immideately shuts down the device. name: msgraph-device-shutdown - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Removes the activation lock (iOS devices only). name: msgraph-device-bypass-activation-lock - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Remove the device from intune management. name: msgraph-device-retire - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Resets the passcode for the device. name: msgraph-device-reset-passcode - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Lock the device, to unlock the user will have to use the passcode. name: msgraph-device-remote-lock - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Request a remote access via TeamViewer. name: msgraph-device-request-remote-assistance - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Recovers the passcode from the device. name: msgraph-device-recover-passcode - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: logs out the current user on a shared iPad device. name: msgraph-logout-shared-apple-device-active-user - arguments: - description: The principal name of the user to be deleted. name: user_principal_name required: true - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: deletes a user that you select from the local cache on a shared iPad device. name: msgraph-delete-user-from-shared-apple-device - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Forece update windows defender signatures. name: msgraph-windows-device-defender-update-signatures - arguments: - auto: PREDEFINED defaultValue: 'true' description: Whether to keep the user's data or not. (Default is set to true). name: keep_user_data predefined: - 'true' - 'false' - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: removes any apps that are installed on a PC running Windows 10. it helps remove pre-installed (OEM) apps that are typically installed with a new PC. name: msgraph-clean-windows-device - arguments: - auto: PREDEFINED defaultValue: 'true' description: Whether to peformn quick scan or not. (Default is set to true). name: quick_scan predefined: - 'true' - 'false' - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Scans the device with windows defender (windows devices only). name: msgraph-windows-device-defender-scan - arguments: - auto: PREDEFINED defaultValue: 'true' description: Whether to keep enrollment data or not. (Default is set to true). name: keep_enrollment_data predefined: - 'true' - 'false' - auto: PREDEFINED defaultValue: 'true' description: Whether to keep the user's data or not. (Default is set to true). name: keep_user_data predefined: - 'true' - 'false' - description: The MacOS unlock code. name: mac_os_unlock_code - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: restores a device to its factory default settings. name: msgraph-wipe-device - arguments: - description: SIP address. name: session_initiation_protocal_address required: true - description: Exchenge servier adddress. name: exchange_server required: true - auto: PREDEFINED defaultValue: 'false' description: Whether to enable calendar sync or not. (Default is set to false). name: calendar_sync_enabled predefined: - 'true' - 'false' - auto: PREDEFINED defaultValue: 'false' description: Whether to enable password rotation or not. (Default is set to false). name: password_rotation_enabled predefined: - 'true' - 'false' - description: The device account password. name: device_account_password required: true - description: The device account email. name: device_account_email required: true - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Updates the windows account of the device. name: msgraph-update-windows-device-account - arguments: - default: true defaultValue: '10' description: The number of managed devices to fetch. name: limit - description: A link that specifies a starting point to use for subsequent calls. name: next_link - description: "Number of results to return per page.\nNote: This parameter is intended for pagination purposes and will surpass the specified limit." name: page_size description: List of managed devices. name: msgraph-list-managed-devices outputs: - contextPath: MSGraphDeviceManagement.DeviceNextLink description: A link that specifies a starting point to use for subsequent calls. type: String - contextPath: MSGraphDeviceManagement.Device.ID description: The ID of the managed device. type: String - contextPath: MSGraphDeviceManagement.Device.UserID description: Unique Identifier for the user associated with the device. type: String - contextPath: MSGraphDeviceManagement.Device.Name description: Name of the device. type: String - contextPath: MSGraphDeviceManagement.Device.ManagedDeviceOwnerType description: Ownership of the device. Possible values are unknown, company, personal. type: String - contextPath: MSGraphDeviceManagement.Device.ActionResults.actionName description: Action name. type: String - contextPath: MSGraphDeviceManagement.Device.ActionResults.ActionState description: State of the action. Possible values are none, pending, canceled, active, done, failed, notSupported. type: String - contextPath: MSGraphDeviceManagement.Device.ActionResults.StartDateTime description: Time the action was initiated. type: Date - contextPath: MSGraphDeviceManagement.Device.ActionResults.lastUpdatedDateTime description: Time the action state was last updated. type: Date - contextPath: MSGraphDeviceManagement.Device.EnrolledDateTime description: Enrollment time of the device. type: Date - contextPath: MSGraphDeviceManagement.Device.LastSyncDateTime description: The date and time that the device last completed a successful sync with Intune. type: Date - contextPath: MSGraphDeviceManagement.Device.OperatingSystem description: Operating system of the device. Windows, iOS, etc. type: String - contextPath: MSGraphDeviceManagement.Device.ComplianceState description: Compliance state of the device. Possible values are unknown, compliant, noncompliant, conflict, error, inGracePeriod, configManager. type: String - contextPath: MSGraphDeviceManagement.Device.JailBroken description: whether the device is jail broken or rooted. type: String - contextPath: MSGraphDeviceManagement.Device.ManagementAgent description: Management channel of the device. Possible values are eas, mdm, easMdm, intuneClient, easIntuneClient, configurationManagerClient, configurationManagerClientMdm, configurationManagerClientMdmEas, unknown, jamf, googleCloudDevicePolicyController. type: String - contextPath: MSGraphDeviceManagement.Device.OSVersion description: Operating system version of the device. type: String - contextPath: MSGraphDeviceManagement.Device.EASDeviceId description: Exchange ActiveSync Id of the device. type: String - contextPath: MSGraphDeviceManagement.Device.EASActivationDateTime description: Exchange ActivationSync activation time of the device. type: Date - contextPath: MSGraphDeviceManagement.Device.ActivationLockBypassCode description: Code that allows the Activation Lock on a device to be bypassed. type: String - contextPath: MSGraphDeviceManagement.Device.EmailAddress description: Email(s) for the user associated with the device. type: String - contextPath: MSGraphDeviceManagement.Device.AzureADDeviceId description: The unique identifier for the Entra ID device. Read only. type: String - contextPath: MSGraphDeviceManagement.Device.CategoryDisplayName description: Device category display name. type: String - contextPath: MSGraphDeviceManagement.Device.ExchangeAccessState description: The Access State of the device in Exchange. Possible values are none, unknown, allowed, blocked, quarantined. type: String - contextPath: MSGraphDeviceManagement.Device.exchangeAccessStateReason description: The reason for the device's access state in Exchange. Possible values are none, unknown, exchangeGlobalRule, exchangeIndividualRule, exchangeDeviceRule, exchangeUpgrade, exchangeMailboxPolicy, other, compliant, notCompliant, notEnrolled, unknownLocation, mfaRequired, azureADBlockDueToAccessPolicy, compromisedPassword, deviceNotKnownWithManagedApp. type: String - contextPath: MSGraphDeviceManagement.Device.IsSupervised description: Device supervised status. type: Boolean - contextPath: MSGraphDeviceManagement.Device.IsEncrypted description: Device encryption status. type: Boolean - contextPath: MSGraphDeviceManagement.Device.UserPrincipalName description: Device user principal name. type: String - contextPath: MSGraphDeviceManagement.Device.Model description: Model of the device. type: String - contextPath: MSGraphDeviceManagement.Device.Manufacturer description: Manufacturer of the device. type: String - contextPath: MSGraphDeviceManagement.Device.IMEI description: IMEI of the device. type: String - contextPath: MSGraphDeviceManagement.Device.SerialNumber description: Serial number of the device. type: String - contextPath: MSGraphDeviceManagement.Device.PhoneNumber description: Phone number of the device. type: String - contextPath: MSGraphDeviceManagement.Device.AndroidSecurityPatchLevel description: Android security patch level of the device. type: String - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.inventory description: Whether inventory is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.modernApps description: Whether modern application is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.resourceAccess description: Whether resource access is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.deviceConfiguration description: Whether device configuration is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.compliancePolicy description: Whether compliance policy is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.windowsUpdateForBusiness description: Whether Windows Update for Business is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.WiFiMacAddress description: Wi-Fi MAC. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.lastUpdateDateTime description: The Timestamp of the last update. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.issuedDateTime description: The DateTime when device was evaluated or issued to MDM. type: Date - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.resetCount description: The number of times a PC device has hibernated or resumed. type: Number - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.restartCount description: The number of times a PC device has rebooted. type: Number - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bitLockerStatus description: On or Off of BitLocker Drive Encryption. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootManagerVersion description: The version of the Boot Manager. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.secureBoot description: When Secure Boot is enabled, the core components must have the correct cryptographic signatures. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootDebugging description: When bootDebugging is enabled, the device is used in development and testing. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.operatingSystemKernelDebugging description: When operatingSystemKernelDebugging is enabled, the device is used in development and testing. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.codeIntegrity description: When code integrity is enabled, code execution is restricted to integrity verified code. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.testSigning description: When test signing is allowed, the device does not enforce signature validation during boot. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.safeMode, description: Safe mode is a troubleshooting option for Windows that starts your computer in a limited state. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.windowsPE description: Operating system running with limited services that is used to prepare a computer for Windows. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.earlyLaunchAntiMalwareDriverProtection description: ELAM provides protection for the computers in your network when they start up. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.virtualSecureMode description: VSM is a container that protects high value assets from a compromised kernel. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.pcrHashAlgorithm description: Informational attribute that identifies the HASH algorithm that was used by TPM. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootAppSecurityVersion description: The security version number of the Boot Application. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootManagerSecurityVersion description: The security version number of the Boot Application. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.tpmVersion description: The security version number of the Boot Application. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.pcr0 description: The measurement that is captured in PCR[0]. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.secureBootConfigurationPolicyFingerPrint description: Fingerprint of the Custom Secure Boot Configuration Policy. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.codeIntegrityPolicy description: The Code Integrity policy that is controlling the security of the boot environment. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootRevisionListInfo description: The Boot Revision List that was loaded during initial boot on the attested device. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.operatingSystemRevListInfo description: The Operating System Revision List that was loaded during initial boot on the attested device. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.healthStatusMismatchInfo description: This attribute appears if DHA-Service detects an integrity issue. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.healthAttestationSupportedStatus description: This attribute indicates if DHA is supported for the device. type: String - contextPath: MSGraphDeviceManagement.Device.SubscriberCarrier description: Subscriber Carrier. type: String - contextPath: MSGraphDeviceManagement.Device.MEID description: MEID. type: String - contextPath: MSGraphDeviceManagement.Device.TotalStorageSpaceInBytes description: Total Storage in Bytes. type: Number - contextPath: MSGraphDeviceManagement.Device.FreeStorageSpaceInBytes description: Free Storage in Bytes. type: Number - contextPath: MSGraphDeviceManagement.Device.ManagedDeviceName description: Automatically generated name to identify a device. Can be overwritten to a user friendly name. type: String - contextPath: MSGraphDeviceManagement.Device.PartnerReportedThreatState description: Indicates the threat state of a device when a Mobile Threat Defense partner is in use by the account and device. Read Only. Possible values are unknown, activated, deactivated, secured, lowSeverity, mediumSeverity, highSeverity, unresponsive, compromised, misconfigured. type: String - arguments: - description: The name of the managed device to be fetched. name: device_name required: true description: Search of managed devices by name. name: msgraph-find-managed-devices-by-name outputs: - contextPath: MSGraphDeviceManagement.Device.ID description: The ID of the managed device. type: string - contextPath: MSGraphDeviceManagement.Device.UserID description: Unique Identifier for the user associated with the device. type: string - contextPath: MSGraphDeviceManagement.Device.Name description: Name of the device. type: string - contextPath: MSGraphDeviceManagement.Device.ManagedDeviceOwnerType description: Ownership of the device. Possible values are unknown, company, personal. type: string - contextPath: MSGraphDeviceManagement.Device.ActionResults.actionName description: Action name. type: string - contextPath: MSGraphDeviceManagement.Device.ActionResults.ActionState description: State of the action. Possible values are none, pending, canceled, active, done, failed, notSupported. type: string - contextPath: MSGraphDeviceManagement.Device.ActionResults.StartDateTime description: Time the action was initiated. type: date - contextPath: MSGraphDeviceManagement.Device.ActionResults.lastUpdatedDateTime description: Time the action state was last updated. type: date - contextPath: MSGraphDeviceManagement.Device.EnrolledDateTime description: Enrollment time of the device. type: date - contextPath: MSGraphDeviceManagement.Device.LastSyncDateTime description: The date and time that the device last completed a successful sync with Intune. type: date - contextPath: MSGraphDeviceManagement.Device.OperatingSystem description: Operating system of the device. Windows, iOS, etc. type: string - contextPath: MSGraphDeviceManagement.Device.ComplianceState description: Compliance state of the device. Possible values are unknown, compliant, noncompliant, conflict, error, inGracePeriod, configManager. type: string - contextPath: MSGraphDeviceManagement.Device.JailBroken description: Whether the device is jail broken or rooted. type: string - contextPath: MSGraphDeviceManagement.Device.ManagementAgent description: Management channel of the device. Possible values are eas, mdm, easMdm, intuneClient, easIntuneClient, configurationManagerClient, configurationManagerClientMdm, configurationManagerClientMdmEas, unknown, jamf, googleCloudDevicePolicyController. type: string - contextPath: MSGraphDeviceManagement.Device.OSVersion description: Operating system version of the device. type: string - contextPath: MSGraphDeviceManagement.Device.EASDeviceId description: Exchange ActiveSync Id of the device. type: string - contextPath: MSGraphDeviceManagement.Device.EASActivationDateTime description: Exchange ActivationSync activation time of the device. type: date - contextPath: MSGraphDeviceManagement.Device.ActivationLockBypassCode description: Code that allows the Activation Lock on a device to be bypassed. type: string - contextPath: MSGraphDeviceManagement.Device.EmailAddress description: Email(s) for the user associated with the device. type: string - contextPath: MSGraphDeviceManagement.Device.AzureADDeviceId description: The unique identifier for the Entra ID device. Read only. type: string - contextPath: MSGraphDeviceManagement.Device.CategoryDisplayName description: Device category display name. type: string - contextPath: MSGraphDeviceManagement.Device.ExchangeAccessState description: The Access State of the device in Exchange. Possible values are none, unknown, allowed, blocked, quarantined. type: string - contextPath: MSGraphDeviceManagement.Device.exchangeAccessStateReason description: The reason for the device's access state in Exchange. Possible values are none, unknown, exchangeGlobalRule, exchangeIndividualRule, exchangeDeviceRule, exchangeUpgrade, exchangeMailboxPolicy, other, compliant, notCompliant, notEnrolled, unknownLocation, mfaRequired, azureADBlockDueToAccessPolicy, compromisedPassword, deviceNotKnownWithManagedApp. type: string - contextPath: MSGraphDeviceManagement.Device.IsSupervised description: Device supervised status. type: boolean - contextPath: MSGraphDeviceManagement.Device.IsEncrypted description: Device encryption status. type: boolean - contextPath: MSGraphDeviceManagement.Device.UserPrincipalName description: Device user principal name. type: string - contextPath: MSGraphDeviceManagement.Device.Model description: Model of the device. type: string - contextPath: MSGraphDeviceManagement.Device.Manufacturer description: Manufacturer of the device. type: string - contextPath: MSGraphDeviceManagement.Device.IMEI description: IMEI of the device. type: string - contextPath: MSGraphDeviceManagement.Device.SerialNumber description: Serial number of the device. type: string - contextPath: MSGraphDeviceManagement.Device.PhoneNumber description: Phone number of the device. type: string - contextPath: MSGraphDeviceManagement.Device.AndroidSecurityPatchLevel description: Android security patch level of the device. type: string - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.inventory description: Whether inventory is managed by Intune. type: boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.modernApps description: Whether modern application is managed by Intune. type: boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.resourceAccess description: Whether resource access is managed by Intune. type: boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.deviceConfiguration description: Whether device configuration is managed by Intune. type: boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.compliancePolicy description: Whether compliance policy is managed by Intune. type: boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.windowsUpdateForBusiness description: Whether Windows Update for Business is managed by Intune. type: boolean - contextPath: MSGraphDeviceManagement.Device.WiFiMacAddress description: Wi-Fi MAC. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.lastUpdateDateTime description: The Timestamp of the last update. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.issuedDateTime description: The DateTime when device was evaluated or issued to MDM. type: date - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.resetCount description: The number of times a PC device has hibernated or resumed. type: number - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.restartCount description: The number of times a PC device has rebooted. type: number - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bitLockerStatus description: On or Off of BitLocker Drive Encryption. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootManagerVersion description: The version of the Boot Manager. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.secureBoot description: When Secure Boot is enabled, the core components must have the correct cryptographic signatures. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootDebugging description: When bootDebugging is enabled, the device is used in development and testing. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.operatingSystemKernelDebugging description: When operatingSystemKernelDebugging is enabled, the device is used in development and testing. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.codeIntegrity description: When code integrity is enabled, code execution is restricted to integrity verified code. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.testSigning description: When test signing is allowed, the device does not enforce signature validation during boot. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.safeMode, description: Safe mode is a troubleshooting option for Windows that starts your computer in a limited state. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.windowsPE description: Operating system running with limited services that is used to prepare a computer for Windows. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.earlyLaunchAntiMalwareDriverProtection description: ELAM provides protection for the computers in your network when they start up. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.virtualSecureMode description: VSM is a container that protects high value assets from a compromised kernel. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.pcrHashAlgorithm description: Informational attribute that identifies the HASH algorithm that was used by TPM. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootAppSecurityVersion description: The security version number of the Boot Application. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootManagerSecurityVersion description: The security version number of the Boot Application. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.tpmVersion description: The security version number of the Boot Application. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.pcr0 description: The measurement that is captured in PCR[0]. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.secureBootConfigurationPolicyFingerPrint description: Fingerprint of the Custom Secure Boot Configuration Policy. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.codeIntegrityPolicy description: The Code Integrity policy that is controlling the security of the boot environment. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootRevisionListInfo description: The Boot Revision List that was loaded during initial boot on the attested device. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.operatingSystemRevListInfo description: The Operating System Revision List that was loaded during initial boot on the attested device. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.healthStatusMismatchInfo description: This attribute appears if DHA-Service detects an integrity issue. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.healthAttestationSupportedStatus description: This attribute indicates if DHA is supported for the device. type: string - contextPath: MSGraphDeviceManagement.Device.SubscriberCarrier description: Subscriber Carrier. type: string - contextPath: MSGraphDeviceManagement.Device.MEID description: MEID. type: string - contextPath: MSGraphDeviceManagement.Device.TotalStorageSpaceInBytes description: Total Storage in Bytes. type: number - contextPath: MSGraphDeviceManagement.Device.FreeStorageSpaceInBytes description: Free Storage in Bytes. type: number - contextPath: MSGraphDeviceManagement.Device.ManagedDeviceName description: Automatically generated name to identify a device. Can be overwritten to a user friendly name. type: string - contextPath: MSGraphDeviceManagement.Device.PartnerReportedThreatState description: Indicates the threat state of a device when a Mobile Threat Defense partner is in use by the account and device. Read Only. Possible values are unknown, activated, deactivated, secured, lowSeverity, mediumSeverity, highSeverity, unresponsive, compromised, misconfigured. type: string - description: Run this command if for some reason you need to rerun the authentication process. execution: false name: msgraph-device-auth-reset arguments: [] dockerimage: demisto/crypto:1.0.0.5490413 script: '' subtype: python3 type: python fromversion: 5.0.0 tests: - MSGraph_DeviceManagement_Test