Usa Microsoft Intune con Sokko.

Replace every assignment for the named app. An empty list clears all assignments and requires confirm_clear_all_assignments=true.

Replace every assignment for the named app config. An empty list clears all assignments and requires confirm_clear_all_assignments=true.

Replace the complete assignment target set for one compliance policy; use assignment CRUD tools to manage a single assignment relationship. Clearing all targets requires `confirm_clear_all_assignments=true`.

Replace all group, user, device, collection, exclusion, or scope-tag assignments for an Intune device configuration. Sending an empty collection removes every assignment and requires `confirm_clear_all_assignments=true`.

Replace the complete assignment set for one device enrollment configuration with the supplied assignment targets. Sending an empty collection removes every assignment and requires `confirm_clear_all_assignments=true`.

Associate one user, identified by the supplied user names, with one Windows Autopilot device identity; no other device identity is changed.

Permanently unregister the Windows Autopilot device identities matching the supplied serial numbers. Requires `confirm_destructive_action=true`.

Clean a Windows device addressed as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`, removing user-installed Win32 apps and restoring policy-managed apps and settings. Select only while traversing from a detected app; prefer `MICROSOFT_INTUNE_CLEAN_WINDOWS_DEVICE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`.

Clean a Windows device addressed through its detected-app membership and associated user, removing user-installed Win32 apps and restoring policy-managed apps and settings. Select only while traversing from that app and user; prefer `MICROSOFT_INTUNE_CLEAN_WINDOWS_DEVICE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`.

Clean a Windows device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, removing user-installed Win32 apps and restoring policy-managed apps and settings. Prefer this route whenever the device ID is known. Requires `confirm_destructive_action=true`.

Commit an uploaded content file to a specific Intune mobile-app content version using its encryption metadata.

Create an Intune Android line-of-business app record for deploying an uploaded APK package.

Create a tenant-wide Intune app category that can be attached to mobile apps.

Create an Intune iOS managed-app configuration that delivers app settings to targeted devices.

Create one Intune app deployment assignment with an install intent and target, without replacing sibling assignments.

Attach an existing tenant-wide Intune category to a specific mobile app.

Create mobileAppContent through the provider-required microsoft.graph.mobileLobApp cast. This generic-call-surface variant is retained separately from the mobile-LOB and managed-LOB endpoint-fidelity variants.

Create a Windows Universal AppX contained-app entry under a specific generic content version; use the committed-contained-app create tool for the app-level committed route.

Create a contained-app entry on a Windows Universal AppX app's committedContainedApps route, independent of a specific content-version route.

Create a legacy Android compliance policy with its required scheduled block action embedded in the initial request.

Create one device-and-user compliance observation under a setting summary, not aggregate setting counts.

Create a managed-device record under a specific detected app's managed-devices relationship. Select this route only when the detected app owns the creation context; Microsoft Graph does not serve direct creation on the tenant-wide managed-devices collection.

Record a Windows malware detection and its severity, execution, remediation, and threat state beneath a device reached from a detected app. Returns the created malware-state record.

Create a device log-collection request under the managed device reached from a detected app. Returns the request record and its status; use this route only in that relationship context.

Submit Microsoft Graph's documented discriminator-only request to create a user relationship beneath the managed device reached from a detected app. The route accepts no caller-specified user properties and does not create a Microsoft Entra user.

Create a managed-device record under a user reached through a detected app and one of its devices. Select this deeply nested route only when continuing that detected-app/user traversal; Microsoft Graph does not serve direct creation on the tenant-wide managed-devices collection.

Create an Android custom device configuration with OMA settings in Intune.

Create one group, user, device, collection, exclusion, or scope-tag assignment for an Intune device configuration.

Create one target assignment on a device enrollment configuration for a group, collection, all devices, or all licensed users.

Create one enrollment limit configuration that caps how many devices targeted users may enroll.

Create a persisted Microsoft Intune report export job. Graph returns the new job with HTTP 201; poll the job until completion before using its temporary download URL.

Stage one imported Windows Autopilot device identity in Intune from its serial number, hardware identifier, and optional assignment metadata.

Create a diagnostic log-collection request for a device addressed as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`. Select only while traversing from a detected app; prefer `MICROSOFT_INTUNE_CREATE_LOG_REQUEST_MANAGED_DEVICE` otherwise.

Create a diagnostic log-collection request for a device addressed through its detected-app membership and associated user. Select only while traversing from that app and user; prefer `MICROSOFT_INTUNE_CREATE_LOG_REQUEST_MANAGED_DEVICE` otherwise.

Create a diagnostic log-collection request through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this direct route whenever the managed-device ID is known.

Create mobileAppContent in a managed mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This managed-LOB endpoint-fidelity variant is retained separately from the generic and mobile-LOB variants.

Create mobileAppContent in a mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This mobile-LOB endpoint-fidelity variant is retained separately from the generic and managed-LOB variants.

Delete an Intune Android line-of-business app record used for APK deployment. This permanently destroys only the app record; it does not imply a device wipe. Requires `confirm_destructive_action=true`.

Delete a tenant-wide Intune app category, not merely one app's category relationship. This permanently destroys only the category; it does not imply a device wipe. Requires `confirm_destructive_action=true`.

Delete an Intune iOS managed-app configuration used to deliver app settings. This permanently destroys only the configuration; it does not imply a device wipe. Requires `confirm_destructive_action=true`.

Delete one target assignment from an Intune mobile-app configuration. This permanently destroys only the assignment; it does not imply a device wipe. Requires `confirm_destructive_action=true`.

Delete one device deployment-status record from an Intune mobile-app configuration. This permanently destroys only the status record; it does not imply a device wipe. Requires `confirm_destructive_action=true`.

Delete one user deployment-status record from an Intune mobile-app configuration. This permanently destroys only the status record; it does not imply a device wipe. Requires `confirm_destructive_action=true`.

Delete one install-intent target assignment from an Intune mobile app. This permanently destroys only the assignment; it does not imply a device wipe. Requires `confirm_destructive_action=true`.

Detach an Intune category from a specific mobile app without deleting the tenant-wide category. Requires `confirm_destructive_action=true`.

Delete mobileAppContent through the provider-required microsoft.graph.mobileLobApp cast. This generic-call-surface variant is retained separately from the mobile-LOB and managed-LOB endpoint-fidelity variants. This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. Requires `confirm_destructive_action=true`.

Delete a Windows Universal AppX contained-app entry from a specific generic content version, not the app-level committed route. This permanently destroys only that entry; it does not imply a device wipe. Requires `confirm_destructive_action=true`.

Delete an uploaded content file from a specific Intune mobile-app content version. This permanently destroys only the file record; it does not imply a device wipe. Requires `confirm_destructive_action=true`.

Permanently unregister one Windows Autopilot device identity without wiping the physical device. Requires `confirm_destructive_action=true`.

Delete a contained-app entry from a Windows Universal AppX app's committedContainedApps route, not a specific content version. This permanently destroys only that entry; it does not imply a device wipe. Requires `confirm_destructive_action=true`.

Delete one legacy Android compliance policy and its device requirements. This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. Requires `confirm_destructive_action=true`.

Delete one device-and-user compliance observation under a setting summary. This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. Requires `confirm_destructive_action=true`.

Delete one setting-and-platform compliance count summary. This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. Requires `confirm_destructive_action=true`.

Delete a detected application record. Requires `confirm_destructive_action=true`.

Delete a device addressed as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`; this removes its Intune record and can trigger Retire or Wipe. Select only while traversing from a detected app; prefer `MICROSOFT_INTUNE_DELETE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`.

Deletes a windowsDeviceMalwareState. This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. Requires `confirm_destructive_action=true`.

Deletes a deviceLogCollectionResponse. This permanently destroys only the resource or relationship identified by this endpoint; it does not imply a device wipe. Requires `confirm_destructive_action=true`.

Remove the user relationship record under the specified detected-app managed-device route. This does not delete the user's Microsoft Entra account or wipe the device. Requires `confirm_destructive_action=true`.

Delete a device addressed through its detected-app membership and associated user; this removes its Intune record and can trigger Retire or Wipe. Select only while traversing from that app and user; prefer `MICROSOFT_INTUNE_DELETE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`.

Permanently delete an Android custom device configuration from Intune; this does not wipe devices. Requires `confirm_destructive_action=true`.

Permanently delete one assignment from an Intune device configuration; this does not delete or wipe devices. Requires `confirm_destructive_action=true`.

Permanently remove one target assignment from a device enrollment configuration without deleting the configuration or wiping devices. Requires `confirm_destructive_action=true`.

Permanently delete one enrollment limit configuration without wiping or unenrolling any device. Requires `confirm_destructive_action=true`.

Permanently delete one Intune report export-job resource selected by ID; this does not delete or wipe devices. Requires `confirm_destructive_action=true`.

Permanently delete one staged imported Windows Autopilot device identity without wiping the physical device. Requires `confirm_destructive_action=true`.

Delete a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Immediately removes its Intune record and can trigger a platform-dependent Retire or Wipe command. Prefer this direct route whenever the device ID is known. Requires `confirm_destructive_action=true`.

Delete mobileAppContent in a managed mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This managed-LOB endpoint-fidelity variant is retained separately from the generic and mobile-LOB variants. This destroys only this content version and requires `confirm_destructive_action=true`.

Delete mobileAppContent in a mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This mobile-LOB endpoint-fidelity variant is retained separately from the generic and managed-LOB variants. This destroys only this content version and requires `confirm_destructive_action=true`.

Delete a user and that user's data from a shared Apple device addressed as a detected app's managed-device member. Select only while traversing from that detected app; prefer `MICROSOFT_INTUNE_DELETE_SHARED_APPLE_USER_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`.

Delete a user and that user's data from a shared Apple device addressed through a detected app and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_DELETE_SHARED_APPLE_USER_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`.

Delete a user and that user's data from a shared Apple device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the device ID is known. Requires `confirm_destructive_action=true`.

Disable Lost Mode for a device addressed as a detected app's managed-device member, removing the recovery lock-screen details. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_DISABLE_LOST_MODE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`.

Disable Lost Mode for a device addressed through its detected-app membership and associated user, removing the recovery lock-screen details. Select only while traversing that context; prefer `MICROSOFT_INTUNE_DISABLE_LOST_MODE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`.

Disable Lost Mode through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, removing the recovery lock-screen message and contact information. Prefer this route whenever the device ID is known. Requires `confirm_destructive_action=true`.

Enable applicable processor architectures for the named Win32 app.

Get one Intune Android line-of-business app and its deployment metadata by app ID.

Get one tenant-wide Intune app category; use GET_APPS_CATEGORIES for a category through a specific app's categories route.

Get one Intune iOS managed-app configuration and its delivered settings by configuration ID.

Get one target assignment for a specific Intune mobile-app configuration.

Get one device's deployment status for a specific Intune mobile-app configuration.

Get aggregate per-device deployment outcome counts for a specific Intune mobile-app configuration.

Get one user's deployment status for a specific Intune mobile-app configuration.

Get aggregate per-user deployment outcome counts for a specific Intune mobile-app configuration.

Get one Intune mobile-app assignment, including its install intent, target, and settings.

Get one category through a specific mobile app's categories route; use GET_APP_CATEGORY for the tenant-wide category route.

Read mobileAppContent through the provider-required microsoft.graph.mobileLobApp cast. This generic-call-surface variant is retained separately from the mobile-LOB and managed-LOB endpoint-fidelity variants.

Get one Windows Universal AppX contained app from a specific generic content version; use the committed-contained-app get tool for the app-level committed route.

Retrieve one Windows Autopilot device identity, including its hardware, enrollment, and assigned-user properties.

Query cached Intune report data by ID, with optional column selection, grouping, ordering, search, and paging.

Get one contained app from a Windows Universal AppX app's committedContainedApps route; use the content-version contained-app get tool for a specific version.

Get tenant-wide device counts by compliance-policy state; use a policy device status overview for one policy.

Get aggregate compliant, noncompliant, error, and conflict device counts for one policy; use device statuses for individual records.

Get aggregate compliant, noncompliant, error, and conflict user counts for one policy; use user statuses for individual rollups.

Get one legacy Android compliance policy and its device requirement settings; use LIST_COMPLIANCE_POLICIES to find its ID.

Query noncompliance details organized by Intune compliance policy; use the summary sibling for aggregated policy results.

Query summarized noncompliance results organized by Intune compliance policy; use the detail sibling for non-summary results.

Query noncompliance results organized by compliance setting rather than by compliance policy.

Get one device-and-user compliance observation under a setting summary; use LIST_COMPLIANCE_SETTING_STATES to find its ID.

Get one setting-and-platform compliance count summary; use LIST_COMPLIANCE_SETTING_SUMMARIES to find its ID.

Query noncompliance details organized by Intune configuration policy; use the summary sibling for aggregated policy results.

Query summarized noncompliance results organized by Intune configuration policy; use the detail sibling for non-summary results.

Query noncompliance results organized by configuration setting rather than by configuration policy.

Retrieve one Intune detected-app inventory record by ID, including its platform, publisher, version, size, and device-count metadata. Use its ID to traverse the app's managed-device relationships.

Get one device as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`, returning exactly id, deviceName, operatingSystem, osVersion, complianceState, managementState, and lastSyncDateTime. Select only while traversing from a detected app; prefer `MICROSOFT_INTUNE_GET_MANAGED_DEVICE` otherwise. activationLockBypassCode and remoteAssistanceSessionUrl are omitted.

Retrieve one malware-state record under a detected app's managed device, including threat identity, severity, execution state, remediation state, detection count, and timestamps.

Retrieve the category assigned to a managed device reached through a detected app, including the category ID and display metadata. Use only when preserving that detected-app relationship context.

Retrieve one device log-collection request reached through a detected app and managed device, including status, timestamps, initiator, expiration, and log size. Use it to monitor a known request ID.

Retrieve one user relationship attached to a managed device reached through a detected app. Use this route only when the detected-app, device, and user IDs define the current traversal context.

Retrieve Windows protection health for a managed device reached through a detected app, including malware protection, scan, signature, reboot, engine, and tamper-protection status.

Get one device through its detected-app membership and associated user, returning exactly id, deviceName, operatingSystem, osVersion, complianceState, managementState, and lastSyncDateTime. Select only while traversing that context; prefer `MICROSOFT_INTUNE_GET_MANAGED_DEVICE` otherwise. activationLockBypassCode and remoteAssistanceSessionUrl are omitted.

Get one Android custom device configuration and its OMA settings by ID.

Get aggregate pending, successful, failed, and not-applicable device counts for an Intune device configuration.

Get aggregate pending, successful, failed, and not-applicable user counts for an Intune device configuration.

Retrieve the Intune device configuration activity report for device-scoped activity, returned as report content. Select this when activity must be viewed by device; use `MICROSOFT_INTUNE_GET_DEVICE_CONFIGURATION_USER_ACTIVITY` for user-scoped activity.

Get tenant-wide device counts by deployment state across Intune device configurations.

Retrieve the Intune device configuration activity report for user-scoped activity, returned as report content. Select this when activity must be viewed by user; use `MICROSOFT_INTUNE_GET_DEVICE_CONFIGURATION_DEVICE_ACTIVITY` for device-scoped activity.

Query settings associated with Intune device-management intents; use the contributing-profiles sibling to identify profiles per setting.

Retrieve only the tenant's Microsoft Graph reports-root container metadata, such as its root ID and OData type. Use this to inspect the reports container itself; use a specialized report action when report rows, summaries, filters, or export jobs are needed.

Query Intune noncompliance results organized by device rather than by policy or setting.

Query device compliance status organized by policy; use the policy-settings sibling for setting-level status. This operation is available only on Microsoft Graph beta and may change before general availability.

Query device compliance status organized by policy setting; use the policies sibling for policy-level status. This operation is available only on Microsoft Graph beta and may change before general availability.

Query device compliance status organized by setting without selecting a specific compliance-policy hierarchy. This operation is available only on Microsoft Graph beta and may change before general availability.

Query detailed device status organized by compliance policy; use the policy summary sibling for summarized status. This operation is available only on Microsoft Graph beta and may change before general availability.

Query devices that have no compliance policy, for identifying gaps in policy coverage.

Retrieve one device enrollment configuration of any subtype by its Microsoft Graph ID.

Retrieve one Intune report export job by ID to inspect its current properties and relationships.

Query the named Intune historical report with optional projection, grouping, ordering, search, paging, and filtering.

Retrieve one staged imported Windows Autopilot device identity, including its hardware identifier, assignment, and import state.

Query the Intune profiles contributing to each device-management intent setting; use the intent-settings sibling for settings rather than profiles.

Get one managed device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, returning exactly id, deviceName, operatingSystem, osVersion, complianceState, managementState, and lastSyncDateTime. Prefer this route whenever the device ID is known. activationLockBypassCode and remoteAssistanceSessionUrl are omitted.

Return detailed managed-device enrollment failures, with optional row offset, limit, filter, and continuation token.

Return the most frequent managed-device enrollment failures for the optional reporting period.

Retrieve the tenant-wide Intune managed-device overview: enrollment totals plus operating-system and Exchange access-state distributions. Use this for fleet summary counts, not individual devices.

Read mobileAppContent in a managed mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This managed-LOB endpoint-fidelity variant is retained separately from the generic and mobile-LOB variants.

Read mobileAppContent in a mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This mobile-LOB endpoint-fidelity variant is retained separately from the generic and managed-LOB variants.

Query noncompliance results across both device and setting dimensions in one report.

Query summarized device status organized by compliance policy; use the policy detail sibling for detailed status. This operation is available only on Microsoft Graph beta and may change before general availability.

Query metadata for Intune policy noncompliance reporting; use report siblings when row or summary data is needed.

Query policy noncompliance details; use the policy summary sibling for aggregated results or metadata sibling for report metadata.

Query summarized policy noncompliance results; use the policy detail sibling for non-summary results.

Query device compliance status organized by both policy and platform; use policy-only siblings when platform is not a needed dimension. This operation is available only on Microsoft Graph beta and may change before general availability.

Query detailed device status organized by compliance-policy setting; use the setting summary sibling for summarized status. This operation is available only on Microsoft Graph beta and may change before general availability.

Query summarized device status organized by compliance-policy setting; use the setting detail sibling for detailed status. This operation is available only on Microsoft Graph beta and may change before general availability.

Query filter metadata for an Intune report before constructing a filtered report request.

Query setting-level noncompliance results when no compliance- or configuration-specific setting family is required.

Submit the supplied Windows Autopilot device identities together for import processing in Intune.

List tenant-wide Intune app categories available for organizing mobile apps.

List Intune iOS managed-app configurations that deliver settings to targeted apps and devices.

List the group or device targets assigned to a specific Intune mobile-app configuration.

List per-device deployment statuses for a specific Intune mobile-app configuration.

List per-user deployment statuses for a specific Intune mobile-app configuration.

List dependency and supersedence relationships between Intune mobile apps.

List Intune Android line-of-business apps used to deploy uploaded APK packages.

List install-intent target assignments for a specific Intune mobile app.

List categories attached to a specific Intune mobile app; use LIST_APP_CATEGORIES for the tenant-wide category collection.

List mobileAppContent versions through the provider-required microsoft.graph.mobileLobApp cast. This is the generic-call-surface variant; do not use an uncast generic route unless Microsoft Graph requires it, and use the separate managedMobileLobApp subtype action only for that app context.

List Windows Universal AppX contained apps under a specific generic content version; use the committed-contained-app list tool for the app-level committed route.

List Windows Autopilot device identities one page at a time, including their hardware, enrollment, and assigned-user properties.

List contained apps on a Windows Universal AppX app's committedContainedApps route; use the content-version contained-app list tool for a specific version.

List legacy Android compliance policies that define device security and password requirements.

List individual target assignment relationships under one compliance policy; use ASSIGN_COMPLIANCE_POLICY to replace the complete target set.

List per-setting device-count rollups under one compliance policy, distinct from individual device statuses.

List individual device evaluation statuses under one compliance policy; use the device status overview for aggregate counts.

List individual user compliance rollups under one policy; use the user status overview for aggregate counts.

List individual device-and-user compliance observations under one setting summary, not aggregate setting counts.

List setting-and-platform summaries of device compliance counts; use compliance setting states for individual device and user observations.

List paginated malware-state records beneath a detected app's managed device, including threat severity, execution and remediation states, detection counts, and timestamps.

List managed devices associated with the named detected app. The sensitive fields activationLockBypassCode and remoteAssistanceSessionUrl are omitted from every returned record. Use only when intentionally traversing the detected-app relationship and its ID is available; for the ordinary device collection, use `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`.

List paginated log-collection requests for a managed device reached through a detected app, returning request statuses, timestamps, initiators, expiration, and sizes for monitoring or ID lookup.

List paginated user relationships for a managed device reached through a detected app. Use the returned user IDs to continue the detected-app/device/user traversal; this does not list all tenant users.

List applications detected on managed devices in Microsoft Intune.

List managed devices through the named detected-app and user relationships. The sensitive fields activationLockBypassCode and remoteAssistanceSessionUrl are omitted from every returned record. Use only when intentionally traversing those relationships and all IDs are available; for the ordinary device collection, use `MICROSOFT_INTUNE_LIST_MANAGED_DEVICES`.

List all Intune device configurations across configuration subtypes. Inspect each item's `@odata.type` before passing its ID to a subtype-specific action.

List the group, user, device, collection, exclusion, and scope-tag assignments for an Intune device configuration.

List per-setting deployment-state counts for an Intune device configuration.

List per-device deployment statuses for an Intune device configuration. Microsoft is deprecating support for this entity starting May 2026 and has not named a replacement: https://learn.microsoft.com/en-us/graph/api/resources/intune-deviceconfig-deviceconfigurationdevicestatus

List per-user deployment statuses for an Intune device configuration.

List device enrollment configurations of every subtype one page at a time, including limit, enrollment-status-page, Windows Hello, and platform-restriction configurations.

List one device enrollment configuration's target assignments one page at a time.

List Intune report export jobs so an agent can select a job to inspect, update, or delete.

List staged imported Windows Autopilot device identities one page at a time, including each identity's import state.

List managed-device records. The sensitive fields activationLockBypassCode and remoteAssistanceSessionUrl are omitted from every returned record.

List mobileAppContent through the documented microsoft.graph.managedMobileLobApp cast in a managed mobile line-of-business app context. Use only when Microsoft Graph requires that subtype cast; otherwise use the generic content-version action.

List mobileAppContent through the concrete microsoft.graph.androidLobApp cast in a mobile line-of-business app context. Use only when Microsoft Graph requires that subtype cast; otherwise use the generic content-version action.

Asynchronously request location for a device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_LOCATE_DEVICE_MANAGED_DEVICE` otherwise. An empty response only acknowledges the request; observe the result with `MICROSOFT_INTUNE_GET_MANAGED_DEVICE`.

Asynchronously request location for a device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_LOCATE_DEVICE_MANAGED_DEVICE` otherwise. An empty response only acknowledges the request; observe the result with `MICROSOFT_INTUNE_GET_MANAGED_DEVICE`.

Asynchronously request device location through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the device ID is known. An empty response only acknowledges the request; observe the result with `MICROSOFT_INTUNE_GET_MANAGED_DEVICE`.

Log out the active user from a shared Apple device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_LOGOUT_SHARED_APPLE_USER_MANAGED_DEVICE` otherwise. Unsaved work can be lost. Requires `confirm_destructive_action=true`.

Log out the active user from a shared Apple device addressed through a detected app and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_LOGOUT_SHARED_APPLE_USER_MANAGED_DEVICE` otherwise. Unsaved work can be lost. Requires `confirm_destructive_action=true`.

Log out the active user from a shared Apple device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the device ID is known; unsaved work can be lost. Requires `confirm_destructive_action=true`.

Reboot a device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_REBOOT_NOW_MANAGED_DEVICE` otherwise. The active user may lose unsaved work. Requires `confirm_destructive_action=true`.

Reboot a device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_REBOOT_NOW_MANAGED_DEVICE` otherwise. The active user may lose unsaved work. Requires `confirm_destructive_action=true`.

Reboot a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the device ID is known; the active user is interrupted and may lose unsaved work. Requires `confirm_destructive_action=true`.

Remotely lock a device addressed as a detected app's managed-device member, blocking the active user. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_REMOTE_LOCK_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`.

Remotely lock a device addressed through its detected-app membership and associated user, blocking the active user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_REMOTE_LOCK_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`.

Remotely lock a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, blocking the active user until unlock. Prefer this route whenever the device ID is known. Requires `confirm_destructive_action=true`.

Retire all devices from management for this user. Removes all devices associated with the named user from Intune management. Requires `confirm_destructive_action=true`.

Request a Microsoft Defender scan for a Windows device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_REQUEST_DEFENDER_SCAN_MANAGED_DEVICE` otherwise.

Request a Microsoft Defender scan for a Windows device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_REQUEST_DEFENDER_SCAN_MANAGED_DEVICE` otherwise.

Request a Microsoft Defender scan through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the managed Windows device ID is known.

Retire a device addressed as a detected app's managed-device member, unenrolling it and removing company-managed data while preserving personal data. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_RETIRE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`.

Retire a device addressed through its detected-app membership and associated user, unenrolling it and removing company-managed data while preserving personal data. Select only while traversing that context; prefer `MICROSOFT_INTUNE_RETIRE_MANAGED_DEVICE` otherwise. Requires `confirm_destructive_action=true`.

Retire a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, unenrolling it and removing company-managed data while preserving personal data. Prefer this route whenever the device ID is known. Delivery waits for check-in. Requires `confirm_destructive_action=true`.

Apply the supplied complete rule-action schedule to one compliance policy; use scheduled-rule-action tools to manage one schedule resource. Clearing the schedule requires `confirm_clear_all_rule_actions=true`.

Set one enrollment limit configuration's precedence position for users targeted by multiple configurations.

Shut down a device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_SHUT_DOWN_MANAGED_DEVICE` otherwise. The active user may lose unsaved work. Requires `confirm_destructive_action=true`.

Shut down a device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_SHUT_DOWN_MANAGED_DEVICE` otherwise. The active user may lose unsaved work. Requires `confirm_destructive_action=true`.

Shut down a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the device ID is known; the active user may lose unsaved work. Requires `confirm_destructive_action=true`.

Request an immediate policy sync for a device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_SYNC_DEVICE_MANAGED_DEVICE` otherwise.

Request an immediate policy sync for a device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_SYNC_DEVICE_MANAGED_DEVICE` otherwise.

Request an immediate Intune policy sync through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the managed-device ID is known.

Removes the assigned user from the Autopilot device identity, disrupting its user-targeted provisioning association. Requires `confirm_destructive_action=true`.

Update deployment metadata for an Intune Android line-of-business app.

Update a tenant-wide Intune app category's properties, independent of any one app relationship.

Update the settings or metadata of an Intune iOS managed-app configuration.

Update one target assignment for a specific Intune mobile-app configuration.

Update one device's deployment-status record for a specific Intune mobile-app configuration.

Update one user's deployment-status record for a specific Intune mobile-app configuration.

Update one Intune mobile-app assignment's target or settings.

Update a category through a specific mobile app's categories route; use UPDATE_APP_CATEGORY for the tenant-wide route.

Update mobileAppContent through the provider-required microsoft.graph.mobileLobApp cast. This generic-call-surface variant is retained separately from the mobile-LOB and managed-LOB endpoint-fidelity variants.

Update a Windows Universal AppX contained-app entry under a specific generic content version; use the committed-contained-app update tool for the app-level committed route.

Update a contained-app entry on a Windows Universal AppX app's committedContainedApps route; use the content-version update tool for an entry owned by a specific version.

Update device security or password requirements on one legacy Android compliance policy.

Update one enforcement action or delay within a scheduled compliance rule-action container.

Update one device-and-user compliance observation under a setting summary, not its aggregate counts.

Update aggregate device compliance counts for one setting and platform, not an individual device setting state.

Request a Defender security-intelligence update for a Windows device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_UPDATE_DEFENDER_SIGNATURES_MANAGED_DEVICE` otherwise.

Request a Defender security-intelligence update for a Windows device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_UPDATE_DEFENDER_SIGNATURES_MANAGED_DEVICE` otherwise.

Request a Microsoft Defender security-intelligence update through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Prefer this route whenever the managed Windows device ID is known.

Update a detected application's properties.

Update ownership classification, administrator-friendly name, or notes for a device addressed as a detected app's managed-device member. Select only while traversing from that app; prefer `MICROSOFT_INTUNE_UPDATE_MANAGED_DEVICE` otherwise.

Update supplied threat identity, severity, execution, remediation, detection-count, category, URL, or timestamp fields on a known malware-state record beneath a detected app's managed device.

Submit Microsoft Graph's documented discriminator-only device-category PATCH for a managed device reached through a detected app. This update route accepts no caller-specified category or other writable state, so it cannot assign or change a category; use `MICROSOFT_INTUNE_GET_DETECTED_APP_DEVICES_DEVICE_CATEGORY` to retrieve the same relationship without issuing a PATCH. Select this action only when the provider's exact discriminator-only PATCH operation is explicitly required.

Update supplied status, identity, timing, initiator, expiration, size, or enrollment metadata on a known log-collection request reached through a detected app and managed device; returns the updated request.

Submit Microsoft Graph's documented discriminator-only PATCH for the existing user relationship reached through a detected app and managed device. The route accepts no caller-specified user properties and does not edit the user's Microsoft Entra profile.

Update supplied Windows protection health fields for a managed device reached through a detected app, such as malware protection, scan, signature, reboot, engine, product, or tamper status.

Update ownership classification, administrator-friendly name, or notes for a device addressed through its detected-app membership and associated user. Select only while traversing that context; prefer `MICROSOFT_INTUNE_UPDATE_MANAGED_DEVICE` otherwise.

Update the name, description, version, or OMA settings of an Android custom device configuration in Intune.

Update only the supplied user principal name, addressable user name, group tag, or display name on one Windows Autopilot device identity.

Replace the target of one assignment on a device enrollment configuration.

Update only the supplied limit, priority, version, name, or description on one enrollment limit configuration.

Update the supplied properties of one Intune report export job selected by ID.

Update a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route, changing its ownership classification, administrator-friendly name, or notes. Prefer this direct route for ordinary device maintenance over detected-app relationship variants.

Update mobileAppContent in a managed mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This managed-LOB endpoint-fidelity variant is retained separately from the generic and mobile-LOB variants.

Update mobileAppContent in a mobile line-of-business app context through the provider-required microsoft.graph.mobileLobApp cast. This mobile-LOB endpoint-fidelity variant is retained separately from the generic and managed-LOB variants.

Check whether Windows enrollment auto-discovery is configured for one domain and return Microsoft Graph's Boolean result.

Wipe a device addressed as a member of `/deviceManagement/detectedApps/{detectedAppId}/managedDevices`. Select this relationship route only while traversing from a detected app; prefer `MICROSOFT_INTUNE_WIPE_MANAGED_DEVICE` for ordinary device operations. Factory-resets by default, with platform-dependent retention options. Requires `confirm_destructive_action=true`.

Wipe a device addressed through its detected-app membership and associated user. Select this nested relationship route only while traversing from that detected app and user; prefer `MICROSOFT_INTUNE_WIPE_MANAGED_DEVICE` for ordinary device operations. Factory-resets by default, with platform-dependent retention options. Requires `confirm_destructive_action=true`.

Wipe a device through the direct `/deviceManagement/managedDevices/{managedDeviceId}` route. Factory-resets it by default, removing personal and organizational data, apps, and configurations; retention options vary by platform. Prefer this direct route whenever the managed-device ID is known. Graph acceptance is not completion. Requires `confirm_destructive_action=true`.