category: IT Services provider: Microsoft sectionorder: - Connect - Collect commonfields: id: Microsoft Graph Device Management version: -1 configuration: - defaultvalue: Worldwide display: Azure Cloud name: azure_cloud required: false type: 15 options: - Worldwide - US GCC - US GCC-High - DoD - Germany - China - Custom additionalinfo: When selecting the Custom option, the Server URL parameter must be filled. More information about National Clouds can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud section: Connect advanced: true - display: ID or Client ID name: auth_id type: 4 hidden: true required: false section: Connect advanced: true - displaypassword: ID or Client ID name: credentials_auth_id hiddenusername: true type: 9 required: false section: Connect - display: Token or Tenant ID name: tenant_id type: 4 hidden: true required: false section: Connect advanced: true - displaypassword: Token or Tenant ID name: credentials_tenant_id hiddenusername: true type: 9 required: false section: Connect - display: Key or Client Secret name: enc_key type: 4 hidden: true required: false section: Connect advanced: true - displaypassword: Key or Client Secret name: credentials_enc_key hiddenusername: true type: 9 required: false section: Connect - additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app. display: Certificate Thumbprint name: certificate_thumbprint type: 4 hidden: true required: false section: Connect advanced: true - displaypassword: Certificate Thumbprint additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app. name: credentials_certificate_thumbprint hiddenusername: true type: 9 required: false section: Connect - additionalinfo: Used for certificate authentication. The private key of the registered certificate. display: Private Key name: private_key type: 14 required: false section: Connect advanced: true - additionalinfo: Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab. display: Use Azure Managed Identities name: use_managed_identities type: 8 required: false section: Connect advanced: true - additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM. displaypassword: Azure Managed Identities Client ID name: managed_identities_client_id hiddenusername: true type: 9 required: false section: Connect advanced: true - defaultvalue: https://graph.microsoft.com display: Server URL name: url required: false type: 0 additionalinfo: Use this option when required to customize the URL to the Azure management endpoint. More information can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud section: Connect advanced: true - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect advanced: true - display: Use system proxy settings name: proxy type: 8 required: false section: Connect advanced: true - additionalinfo: Select this checkbox if you are using a self-deployed Azure application. display: Use a self deployed Azure Application name: self_deployed type: 8 required: false section: Connect description: Microsoft Intune is a Microsoft cloud-based management solution that provides for mobile device and operating system management. display: Microsoft Endpoint Manager (Intune) name: Microsoft Graph Device Management script: commands: - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Get managed devices. PhysicalMemoryInBytes will return 0 by default. name: msgraph-get-managed-device-by-id outputs: - contextPath: MSGraphDeviceManagement.Device.ID description: The ID of the managed device. type: String - contextPath: MSGraphDeviceManagement.Device.UserID description: Unique Identifier for the user associated with the device. type: String - contextPath: MSGraphDeviceManagement.Device.Name description: Name of the device. type: String - contextPath: MSGraphDeviceManagement.Device.ManagedDeviceOwnerType description: Ownership of the device. Possible values are unknown, company, personal. type: String - contextPath: MSGraphDeviceManagement.Device.ActionResults.actionName description: Action name. type: String - contextPath: MSGraphDeviceManagement.Device.ActionResults.ActionState description: State of the action. Possible values are none, pending, canceled, active, done, failed, notSupported. type: String - contextPath: MSGraphDeviceManagement.Device.ActionResults.StartDateTime description: Time the action was initiated. type: Date - contextPath: MSGraphDeviceManagement.Device.ActionResults.lastUpdatedDateTime description: Time the action state was last updated. type: Date - contextPath: MSGraphDeviceManagement.Device.EnrolledDateTime description: Enrollment time of the device. type: Date - contextPath: MSGraphDeviceManagement.Device.LastSyncDateTime description: The date and time that the device last completed a successful sync with Intune. type: Date - contextPath: MSGraphDeviceManagement.Device.OperatingSystem description: Operating system of the device. Windows, iOS, etc. type: String - contextPath: MSGraphDeviceManagement.Device.ComplianceState description: Compliance state of the device. Possible values are unknown, compliant, noncompliant, conflict, error, inGracePeriod, configManager. type: String - contextPath: MSGraphDeviceManagement.Device.JailBroken description: whether the device is jail broken or rooted. type: String - contextPath: MSGraphDeviceManagement.Device.ManagementAgent description: Management channel of the device. Possible values are eas, mdm, easMdm, intuneClient, easIntuneClient, configurationManagerClient, configurationManagerClientMdm, configurationManagerClientMdmEas, unknown, jamf, googleCloudDevicePolicyController. type: String - contextPath: MSGraphDeviceManagement.Device.OSVersion description: Operating system version of the device. type: String - contextPath: MSGraphDeviceManagement.Device.EASDeviceId description: Exchange ActiveSync Id of the device. type: String - contextPath: MSGraphDeviceManagement.Device.EASActivationDateTime description: Exchange ActivationSync activation time of the device. type: Date - contextPath: MSGraphDeviceManagement.Device.ActivationLockBypassCode description: Code that allows the Activation Lock on a device to be bypassed. type: String - contextPath: MSGraphDeviceManagement.Device.EmailAddress description: Email(s) for the user associated with the device. type: String - contextPath: MSGraphDeviceManagement.Device.AzureADDeviceId description: The unique identifier for the Entra ID device. Read only. type: String - contextPath: MSGraphDeviceManagement.Device.CategoryDisplayName description: Device category display name. type: String - contextPath: MSGraphDeviceManagement.Device.ExchangeAccessState description: The Access State of the device in Exchange. Possible values are none, unknown, allowed, blocked, quarantined. type: String - contextPath: MSGraphDeviceManagement.Device.exchangeAccessStateReason description: The reason for the device's access state in Exchange. Possible values are none, unknown, exchangeGlobalRule, exchangeIndividualRule, exchangeDeviceRule, exchangeUpgrade, exchangeMailboxPolicy, other, compliant, notCompliant, notEnrolled, unknownLocation, mfaRequired, azureADBlockDueToAccessPolicy, compromisedPassword, deviceNotKnownWithManagedApp. type: String - contextPath: MSGraphDeviceManagement.Device.IsSupervised description: Device supervised status. type: Boolean - contextPath: MSGraphDeviceManagement.Device.IsEncrypted description: Device encryption status. type: Boolean - contextPath: MSGraphDeviceManagement.Device.UserPrincipalName description: Device user principal name. type: String - contextPath: MSGraphDeviceManagement.Device.Model description: Model of the device. type: String - contextPath: MSGraphDeviceManagement.Device.Manufacturer description: Manufacturer of the device. type: String - contextPath: MSGraphDeviceManagement.Device.IMEI description: IMEI of the device. type: String - contextPath: MSGraphDeviceManagement.Device.SerialNumber description: Serial number of the device. type: String - contextPath: MSGraphDeviceManagement.Device.PhoneNumber description: Phone number of the device. type: String - contextPath: MSGraphDeviceManagement.Device.AndroidSecurityPatchLevel description: Android security patch level of the device. type: String - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.inventory description: Whether inventory is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.modernApps description: Whether modern application is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.resourceAccess description: Whether resource access is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.deviceConfiguration description: Whether device configuration is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.compliancePolicy description: Whether compliance policy is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.windowsUpdateForBusiness description: Whether Windows Update for Business is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.WiFiMacAddress description: Wi-Fi MAC. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.lastUpdateDateTime description: The Timestamp of the last update. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.issuedDateTime description: The DateTime when device was evaluated or issued to MDM. type: Date - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.resetCount description: The number of times a PC device has hibernated or resumed. type: Number - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.restartCount description: The number of times a PC device has rebooted. type: Number - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bitLockerStatus description: On or Off of BitLocker Drive Encryption. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootManagerVersion description: The version of the Boot Manager. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.secureBoot description: When Secure Boot is enabled, the core components must have the correct cryptographic signatures. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootDebugging description: When bootDebugging is enabled, the device is used in development and testing. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.operatingSystemKernelDebugging description: When operatingSystemKernelDebugging is enabled, the device is used in development and testing. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.codeIntegrity description: When code integrity is enabled, code execution is restricted to integrity verified code. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.testSigning description: When test signing is allowed, the device does not enforce signature validation during boot. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.safeMode, description: Safe mode is a troubleshooting option for Windows that starts your computer in a limited state. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.windowsPE description: Operating system running with limited services that is used to prepare a computer for Windows. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.earlyLaunchAntiMalwareDriverProtection description: ELAM provides protection for the computers in your network when they start up. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.virtualSecureMode description: VSM is a container that protects high value assets from a compromised kernel. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.pcrHashAlgorithm description: Informational attribute that identifies the HASH algorithm that was used by TPM. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootAppSecurityVersion description: The security version number of the Boot Application. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootManagerSecurityVersion description: The security version number of the Boot Application. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.tpmVersion description: The security version number of the Boot Application. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.pcr0 description: The measurement that is captured in PCR[0]. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.secureBootConfigurationPolicyFingerPrint description: Fingerprint of the Custom Secure Boot Configuration Policy. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.codeIntegrityPolicy description: The Code Integrity policy that is controlling the security of the boot environment. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootRevisionListInfo description: The Boot Revision List that was loaded during initial boot on the attested device. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.operatingSystemRevListInfo description: The Operating System Revision List that was loaded during initial boot on the attested device. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.healthStatusMismatchInfo description: This attribute appears if DHA-Service detects an integrity issue. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.healthAttestationSupportedStatus description: This attribute indicates if DHA is supported for the device. type: String - contextPath: MSGraphDeviceManagement.Device.SubscriberCarrier description: Subscriber Carrier. type: String - contextPath: MSGraphDeviceManagement.Device.MEID description: MEID. type: String - contextPath: MSGraphDeviceManagement.Device.TotalStorageSpaceInBytes description: Total Storage in Bytes. type: Number - contextPath: MSGraphDeviceManagement.Device.FreeStorageSpaceInBytes description: Free Storage in Bytes. type: Number - contextPath: MSGraphDeviceManagement.Device.ManagedDeviceName description: Automatically generated name to identify a device. Can be overwritten to a user friendly name. type: String - contextPath: MSGraphDeviceManagement.Device.PartnerReportedThreatState description: Indicates the threat state of a device when a Mobile Threat Defense partner is in use by the account and device. Read Only. Possible values are unknown, activated, deactivated, secured, lowSeverity, mediumSeverity, highSeverity, unresponsive, compromised, misconfigured. type: String - arguments: - description: The ID of the managed device to be fetched. Can be retrieved using the msgraph-list-managed-devices command. name: device_id required: true description: Get the managed device physical memory bytes. name: msgraph-get-managed-device-physical-memory-by-id outputs: - contextPath: MSGraphDeviceManagement.Device.id description: The ID of the managed device. type: String - contextPath: MSGraphDeviceManagement.Device.physicalMemoryInBytes description: The correct value of ID of the managed device. type: String - contextPath: MSGraphDeviceManagement.Device.deviceName description: Name of the device. type: String - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Check the device with Intune, immediately receive pending actions and policies. name: msgraph-sync-device - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Disable the lost mode of the device. name: msgraph-device-disable-lost-mode - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Gets the GPS location of a device (iOS only). name: msgraph-locate-device - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Immediately reboots the device. name: msgraph-device-reboot-now - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Immideately shuts down the device. name: msgraph-device-shutdown - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Removes the activation lock (iOS devices only). name: msgraph-device-bypass-activation-lock - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Remove the device from intune management. name: msgraph-device-retire - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Resets the passcode for the device. name: msgraph-device-reset-passcode - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Lock the device, to unlock the user will have to use the passcode. name: msgraph-device-remote-lock - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Request a remote access via TeamViewer. name: msgraph-device-request-remote-assistance - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Recovers the passcode from the device. name: msgraph-device-recover-passcode - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: logs out the current user on a shared iPad device. name: msgraph-logout-shared-apple-device-active-user - arguments: - description: The principal name of the user to be deleted. name: user_principal_name required: true - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: deletes a user that you select from the local cache on a shared iPad device. name: msgraph-delete-user-from-shared-apple-device - arguments: - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Forece update windows defender signatures. name: msgraph-windows-device-defender-update-signatures - arguments: - auto: PREDEFINED defaultValue: 'true' description: Whether to keep the user's data or not. (Default is set to true). name: keep_user_data predefined: - 'true' - 'false' - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: removes any apps that are installed on a PC running Windows 10. it helps remove pre-installed (OEM) apps that are typically installed with a new PC. name: msgraph-clean-windows-device - arguments: - auto: PREDEFINED defaultValue: 'true' description: Whether to peformn quick scan or not. (Default is set to true). name: quick_scan predefined: - 'true' - 'false' - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Scans the device with windows defender (windows devices only). name: msgraph-windows-device-defender-scan - arguments: - auto: PREDEFINED defaultValue: 'true' description: Whether to keep enrollment data or not. (Default is set to true). name: keep_enrollment_data predefined: - 'true' - 'false' - auto: PREDEFINED defaultValue: 'true' description: Whether to keep the user's data or not. (Default is set to true). name: keep_user_data predefined: - 'true' - 'false' - description: The MacOS unlock code. name: mac_os_unlock_code - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: restores a device to its factory default settings. name: msgraph-wipe-device - arguments: - description: SIP address. name: session_initiation_protocal_address required: true - description: Exchenge servier adddress. name: exchange_server required: true - auto: PREDEFINED defaultValue: 'false' description: Whether to enable calendar sync or not. (Default is set to false). name: calendar_sync_enabled predefined: - 'true' - 'false' - auto: PREDEFINED defaultValue: 'false' description: Whether to enable password rotation or not. (Default is set to false). name: password_rotation_enabled predefined: - 'true' - 'false' - description: The device account password. name: device_account_password required: true - description: The device account email. name: device_account_email required: true - description: The ID of the managed device to be fetched (Can be retreived using the msgraph-list-managed-devices command). name: device_id required: true description: Updates the windows account of the device. name: msgraph-update-windows-device-account - arguments: - default: true defaultValue: '10' description: The number of managed devices to fetch. name: limit - description: A link that specifies a starting point to use for subsequent calls. name: next_link - description: "Number of results to return per page.\nNote: This parameter is intended for pagination purposes and will surpass the specified limit." name: page_size description: List of managed devices. name: msgraph-list-managed-devices outputs: - contextPath: MSGraphDeviceManagement.DeviceNextLink description: A link that specifies a starting point to use for subsequent calls. type: String - contextPath: MSGraphDeviceManagement.Device.ID description: The ID of the managed device. type: String - contextPath: MSGraphDeviceManagement.Device.UserID description: Unique Identifier for the user associated with the device. type: String - contextPath: MSGraphDeviceManagement.Device.Name description: Name of the device. type: String - contextPath: MSGraphDeviceManagement.Device.ManagedDeviceOwnerType description: Ownership of the device. Possible values are unknown, company, personal. type: String - contextPath: MSGraphDeviceManagement.Device.ActionResults.actionName description: Action name. type: String - contextPath: MSGraphDeviceManagement.Device.ActionResults.ActionState description: State of the action. Possible values are none, pending, canceled, active, done, failed, notSupported. type: String - contextPath: MSGraphDeviceManagement.Device.ActionResults.StartDateTime description: Time the action was initiated. type: Date - contextPath: MSGraphDeviceManagement.Device.ActionResults.lastUpdatedDateTime description: Time the action state was last updated. type: Date - contextPath: MSGraphDeviceManagement.Device.EnrolledDateTime description: Enrollment time of the device. type: Date - contextPath: MSGraphDeviceManagement.Device.LastSyncDateTime description: The date and time that the device last completed a successful sync with Intune. type: Date - contextPath: MSGraphDeviceManagement.Device.OperatingSystem description: Operating system of the device. Windows, iOS, etc. type: String - contextPath: MSGraphDeviceManagement.Device.ComplianceState description: Compliance state of the device. Possible values are unknown, compliant, noncompliant, conflict, error, inGracePeriod, configManager. type: String - contextPath: MSGraphDeviceManagement.Device.JailBroken description: whether the device is jail broken or rooted. type: String - contextPath: MSGraphDeviceManagement.Device.ManagementAgent description: Management channel of the device. Possible values are eas, mdm, easMdm, intuneClient, easIntuneClient, configurationManagerClient, configurationManagerClientMdm, configurationManagerClientMdmEas, unknown, jamf, googleCloudDevicePolicyController. type: String - contextPath: MSGraphDeviceManagement.Device.OSVersion description: Operating system version of the device. type: String - contextPath: MSGraphDeviceManagement.Device.EASDeviceId description: Exchange ActiveSync Id of the device. type: String - contextPath: MSGraphDeviceManagement.Device.EASActivationDateTime description: Exchange ActivationSync activation time of the device. type: Date - contextPath: MSGraphDeviceManagement.Device.ActivationLockBypassCode description: Code that allows the Activation Lock on a device to be bypassed. type: String - contextPath: MSGraphDeviceManagement.Device.EmailAddress description: Email(s) for the user associated with the device. type: String - contextPath: MSGraphDeviceManagement.Device.AzureADDeviceId description: The unique identifier for the Entra ID device. Read only. type: String - contextPath: MSGraphDeviceManagement.Device.CategoryDisplayName description: Device category display name. type: String - contextPath: MSGraphDeviceManagement.Device.ExchangeAccessState description: The Access State of the device in Exchange. Possible values are none, unknown, allowed, blocked, quarantined. type: String - contextPath: MSGraphDeviceManagement.Device.exchangeAccessStateReason description: The reason for the device's access state in Exchange. Possible values are none, unknown, exchangeGlobalRule, exchangeIndividualRule, exchangeDeviceRule, exchangeUpgrade, exchangeMailboxPolicy, other, compliant, notCompliant, notEnrolled, unknownLocation, mfaRequired, azureADBlockDueToAccessPolicy, compromisedPassword, deviceNotKnownWithManagedApp. type: String - contextPath: MSGraphDeviceManagement.Device.IsSupervised description: Device supervised status. type: Boolean - contextPath: MSGraphDeviceManagement.Device.IsEncrypted description: Device encryption status. type: Boolean - contextPath: MSGraphDeviceManagement.Device.UserPrincipalName description: Device user principal name. type: String - contextPath: MSGraphDeviceManagement.Device.Model description: Model of the device. type: String - contextPath: MSGraphDeviceManagement.Device.Manufacturer description: Manufacturer of the device. type: String - contextPath: MSGraphDeviceManagement.Device.IMEI description: IMEI of the device. type: String - contextPath: MSGraphDeviceManagement.Device.SerialNumber description: Serial number of the device. type: String - contextPath: MSGraphDeviceManagement.Device.PhoneNumber description: Phone number of the device. type: String - contextPath: MSGraphDeviceManagement.Device.AndroidSecurityPatchLevel description: Android security patch level of the device. type: String - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.inventory description: Whether inventory is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.modernApps description: Whether modern application is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.resourceAccess description: Whether resource access is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.deviceConfiguration description: Whether device configuration is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.compliancePolicy description: Whether compliance policy is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.windowsUpdateForBusiness description: Whether Windows Update for Business is managed by Intune. type: Boolean - contextPath: MSGraphDeviceManagement.Device.WiFiMacAddress description: Wi-Fi MAC. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.lastUpdateDateTime description: The Timestamp of the last update. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.issuedDateTime description: The DateTime when device was evaluated or issued to MDM. type: Date - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.resetCount description: The number of times a PC device has hibernated or resumed. type: Number - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.restartCount description: The number of times a PC device has rebooted. type: Number - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bitLockerStatus description: On or Off of BitLocker Drive Encryption. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootManagerVersion description: The version of the Boot Manager. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.secureBoot description: When Secure Boot is enabled, the core components must have the correct cryptographic signatures. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootDebugging description: When bootDebugging is enabled, the device is used in development and testing. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.operatingSystemKernelDebugging description: When operatingSystemKernelDebugging is enabled, the device is used in development and testing. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.codeIntegrity description: When code integrity is enabled, code execution is restricted to integrity verified code. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.testSigning description: When test signing is allowed, the device does not enforce signature validation during boot. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.safeMode, description: Safe mode is a troubleshooting option for Windows that starts your computer in a limited state. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.windowsPE description: Operating system running with limited services that is used to prepare a computer for Windows. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.earlyLaunchAntiMalwareDriverProtection description: ELAM provides protection for the computers in your network when they start up. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.virtualSecureMode description: VSM is a container that protects high value assets from a compromised kernel. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.pcrHashAlgorithm description: Informational attribute that identifies the HASH algorithm that was used by TPM. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootAppSecurityVersion description: The security version number of the Boot Application. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootManagerSecurityVersion description: The security version number of the Boot Application. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.tpmVersion description: The security version number of the Boot Application. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.pcr0 description: The measurement that is captured in PCR[0]. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.secureBootConfigurationPolicyFingerPrint description: Fingerprint of the Custom Secure Boot Configuration Policy. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.codeIntegrityPolicy description: The Code Integrity policy that is controlling the security of the boot environment. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootRevisionListInfo description: The Boot Revision List that was loaded during initial boot on the attested device. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.operatingSystemRevListInfo description: The Operating System Revision List that was loaded during initial boot on the attested device. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.healthStatusMismatchInfo description: This attribute appears if DHA-Service detects an integrity issue. type: String - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.healthAttestationSupportedStatus description: This attribute indicates if DHA is supported for the device. type: String - contextPath: MSGraphDeviceManagement.Device.SubscriberCarrier description: Subscriber Carrier. type: String - contextPath: MSGraphDeviceManagement.Device.MEID description: MEID. type: String - contextPath: MSGraphDeviceManagement.Device.TotalStorageSpaceInBytes description: Total Storage in Bytes. type: Number - contextPath: MSGraphDeviceManagement.Device.FreeStorageSpaceInBytes description: Free Storage in Bytes. type: Number - contextPath: MSGraphDeviceManagement.Device.ManagedDeviceName description: Automatically generated name to identify a device. Can be overwritten to a user friendly name. type: String - contextPath: MSGraphDeviceManagement.Device.PartnerReportedThreatState description: Indicates the threat state of a device when a Mobile Threat Defense partner is in use by the account and device. Read Only. Possible values are unknown, activated, deactivated, secured, lowSeverity, mediumSeverity, highSeverity, unresponsive, compromised, misconfigured. type: String - arguments: - description: The name of the managed device to be fetched. name: device_name required: true description: Search of managed devices by name. name: msgraph-find-managed-devices-by-name outputs: - contextPath: MSGraphDeviceManagement.Device.ID description: The ID of the managed device. type: string - contextPath: MSGraphDeviceManagement.Device.UserID description: Unique Identifier for the user associated with the device. type: string - contextPath: MSGraphDeviceManagement.Device.Name description: Name of the device. type: string - contextPath: MSGraphDeviceManagement.Device.ManagedDeviceOwnerType description: Ownership of the device. Possible values are unknown, company, personal. type: string - contextPath: MSGraphDeviceManagement.Device.ActionResults.actionName description: Action name. type: string - contextPath: MSGraphDeviceManagement.Device.ActionResults.ActionState description: State of the action. Possible values are none, pending, canceled, active, done, failed, notSupported. type: string - contextPath: MSGraphDeviceManagement.Device.ActionResults.StartDateTime description: Time the action was initiated. type: date - contextPath: MSGraphDeviceManagement.Device.ActionResults.lastUpdatedDateTime description: Time the action state was last updated. type: date - contextPath: MSGraphDeviceManagement.Device.EnrolledDateTime description: Enrollment time of the device. type: date - contextPath: MSGraphDeviceManagement.Device.LastSyncDateTime description: The date and time that the device last completed a successful sync with Intune. type: date - contextPath: MSGraphDeviceManagement.Device.OperatingSystem description: Operating system of the device. Windows, iOS, etc. type: string - contextPath: MSGraphDeviceManagement.Device.ComplianceState description: Compliance state of the device. Possible values are unknown, compliant, noncompliant, conflict, error, inGracePeriod, configManager. type: string - contextPath: MSGraphDeviceManagement.Device.JailBroken description: Whether the device is jail broken or rooted. type: string - contextPath: MSGraphDeviceManagement.Device.ManagementAgent description: Management channel of the device. Possible values are eas, mdm, easMdm, intuneClient, easIntuneClient, configurationManagerClient, configurationManagerClientMdm, configurationManagerClientMdmEas, unknown, jamf, googleCloudDevicePolicyController. type: string - contextPath: MSGraphDeviceManagement.Device.OSVersion description: Operating system version of the device. type: string - contextPath: MSGraphDeviceManagement.Device.EASDeviceId description: Exchange ActiveSync Id of the device. type: string - contextPath: MSGraphDeviceManagement.Device.EASActivationDateTime description: Exchange ActivationSync activation time of the device. type: date - contextPath: MSGraphDeviceManagement.Device.ActivationLockBypassCode description: Code that allows the Activation Lock on a device to be bypassed. type: string - contextPath: MSGraphDeviceManagement.Device.EmailAddress description: Email(s) for the user associated with the device. type: string - contextPath: MSGraphDeviceManagement.Device.AzureADDeviceId description: The unique identifier for the Entra ID device. Read only. type: string - contextPath: MSGraphDeviceManagement.Device.CategoryDisplayName description: Device category display name. type: string - contextPath: MSGraphDeviceManagement.Device.ExchangeAccessState description: The Access State of the device in Exchange. Possible values are none, unknown, allowed, blocked, quarantined. type: string - contextPath: MSGraphDeviceManagement.Device.exchangeAccessStateReason description: The reason for the device's access state in Exchange. Possible values are none, unknown, exchangeGlobalRule, exchangeIndividualRule, exchangeDeviceRule, exchangeUpgrade, exchangeMailboxPolicy, other, compliant, notCompliant, notEnrolled, unknownLocation, mfaRequired, azureADBlockDueToAccessPolicy, compromisedPassword, deviceNotKnownWithManagedApp. type: string - contextPath: MSGraphDeviceManagement.Device.IsSupervised description: Device supervised status. type: boolean - contextPath: MSGraphDeviceManagement.Device.IsEncrypted description: Device encryption status. type: boolean - contextPath: MSGraphDeviceManagement.Device.UserPrincipalName description: Device user principal name. type: string - contextPath: MSGraphDeviceManagement.Device.Model description: Model of the device. type: string - contextPath: MSGraphDeviceManagement.Device.Manufacturer description: Manufacturer of the device. type: string - contextPath: MSGraphDeviceManagement.Device.IMEI description: IMEI of the device. type: string - contextPath: MSGraphDeviceManagement.Device.SerialNumber description: Serial number of the device. type: string - contextPath: MSGraphDeviceManagement.Device.PhoneNumber description: Phone number of the device. type: string - contextPath: MSGraphDeviceManagement.Device.AndroidSecurityPatchLevel description: Android security patch level of the device. type: string - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.inventory description: Whether inventory is managed by Intune. type: boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.modernApps description: Whether modern application is managed by Intune. type: boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.resourceAccess description: Whether resource access is managed by Intune. type: boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.deviceConfiguration description: Whether device configuration is managed by Intune. type: boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.compliancePolicy description: Whether compliance policy is managed by Intune. type: boolean - contextPath: MSGraphDeviceManagement.Device.ConfigurationManagerClientEnabledFeatures.windowsUpdateForBusiness description: Whether Windows Update for Business is managed by Intune. type: boolean - contextPath: MSGraphDeviceManagement.Device.WiFiMacAddress description: Wi-Fi MAC. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.lastUpdateDateTime description: The Timestamp of the last update. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.issuedDateTime description: The DateTime when device was evaluated or issued to MDM. type: date - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.resetCount description: The number of times a PC device has hibernated or resumed. type: number - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.restartCount description: The number of times a PC device has rebooted. type: number - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bitLockerStatus description: On or Off of BitLocker Drive Encryption. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootManagerVersion description: The version of the Boot Manager. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.secureBoot description: When Secure Boot is enabled, the core components must have the correct cryptographic signatures. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootDebugging description: When bootDebugging is enabled, the device is used in development and testing. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.operatingSystemKernelDebugging description: When operatingSystemKernelDebugging is enabled, the device is used in development and testing. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.codeIntegrity description: When code integrity is enabled, code execution is restricted to integrity verified code. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.testSigning description: When test signing is allowed, the device does not enforce signature validation during boot. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.safeMode, description: Safe mode is a troubleshooting option for Windows that starts your computer in a limited state. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.windowsPE description: Operating system running with limited services that is used to prepare a computer for Windows. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.earlyLaunchAntiMalwareDriverProtection description: ELAM provides protection for the computers in your network when they start up. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.virtualSecureMode description: VSM is a container that protects high value assets from a compromised kernel. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.pcrHashAlgorithm description: Informational attribute that identifies the HASH algorithm that was used by TPM. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootAppSecurityVersion description: The security version number of the Boot Application. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootManagerSecurityVersion description: The security version number of the Boot Application. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.tpmVersion description: The security version number of the Boot Application. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.pcr0 description: The measurement that is captured in PCR[0]. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.secureBootConfigurationPolicyFingerPrint description: Fingerprint of the Custom Secure Boot Configuration Policy. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.codeIntegrityPolicy description: The Code Integrity policy that is controlling the security of the boot environment. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.bootRevisionListInfo description: The Boot Revision List that was loaded during initial boot on the attested device. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.operatingSystemRevListInfo description: The Operating System Revision List that was loaded during initial boot on the attested device. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.healthStatusMismatchInfo description: This attribute appears if DHA-Service detects an integrity issue. type: string - contextPath: MSGraphDeviceManagement.Device.HealthAttestationState.healthAttestationSupportedStatus description: This attribute indicates if DHA is supported for the device. type: string - contextPath: MSGraphDeviceManagement.Device.SubscriberCarrier description: Subscriber Carrier. type: string - contextPath: MSGraphDeviceManagement.Device.MEID description: MEID. type: string - contextPath: MSGraphDeviceManagement.Device.TotalStorageSpaceInBytes description: Total Storage in Bytes. type: number - contextPath: MSGraphDeviceManagement.Device.FreeStorageSpaceInBytes description: Free Storage in Bytes. type: number - contextPath: MSGraphDeviceManagement.Device.ManagedDeviceName description: Automatically generated name to identify a device. Can be overwritten to a user friendly name. type: string - contextPath: MSGraphDeviceManagement.Device.PartnerReportedThreatState description: Indicates the threat state of a device when a Mobile Threat Defense partner is in use by the account and device. Read Only. Possible values are unknown, activated, deactivated, secured, lowSeverity, mediumSeverity, highSeverity, unresponsive, compromised, misconfigured. type: string - description: Run this command if for some reason you need to rerun the authentication process. execution: false name: msgraph-device-auth-reset arguments: [] dockerimage: demisto/crypto:1.0.0.5490413 script: '' subtype: python3 type: python fromversion: 5.0.0 tests: - MSGraph_DeviceManagement_Test