Microsoft 365 Community Microsoft Graph, 8 Feb 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Introduction to Microsoft Intune APIs on Microsoft Graph

Description

In this 13-minute developer focused demo delivered by Dave Randall, viewers are treated to an overview of the Microsoft Graph API for Microsoft Intune enables programmatic access to Intune information for your tenant. See what types of administrative device/compliance tasks can be done via the Graph API (add/delete permissions, update compliance policies, review devices, etc.). Call Intune services from the Graph Explorer tool and through PowerShell scripts/cmdlets as an alternative to accessing the services from the Microsoft Endpoint Manager console UI. This PnP Community demo is taken from the weekly Microsoft 365 Platform Community call recorded on February 8, 2022.

Demo Presenter: Dave Randall (Microsoft)

Supporting materials:
• Documentation v1.0 - Working with Intune in Microsoft Graph | https://docs.microsoft.com/graph/api/resources/intune-graph-overview?view=graph-rest-1.0
• Documentation beta - Working with Intune in Microsoft Graph | https://docs.microsoft.com/graph/api/resources/intune-graph-overview?view=graph-rest-beta
• Repo - Intune Graph Samples | https://github.com/microsoftgraph/powershell-intune-samples
• Reference - Microsoft365DSC | https://microsoft365dsc.com
• Tool – Graph Explorer | aka.ms/ge
• Documentation - Get started with Desired State Configuration (DSC) for Windows | https://docs.microsoft.com/powershell/dsc/getting-started/wingettingstarted?view=dsc-1.1
• Documentation - Microsoft Endpoint Manager overview | https://docs.microsoft.com/mem/endpoint-manager-overview

Learn more:
• Learn more about the Microsoft 365 Patterns and Practices community at: http://aka.ms/m365pnp
• Visit the Microsoft 365 Patterns and Practices community YouTube channel: https://aka.ms/m365pnp/videos

A

uh My name is dave randall, I'm a program manager in the endpoint manager team. You may also know endpoint manager by microsoft, intune or system center configuration manager. Both products are part of endpoint manager if you're getting started using intune apis. There's a couple of different sets of apis that are available, we're going to focus on the microsoft graph apis, but there's also a graph sdk that allows you to interact with the apis for intune and there's an app protection policy sdk.

A

So if you're a developer, building, ios or android applications- and you want to take advantage of intune's app protection policies, there is a mam sdk that you can incorporate in your applications and then, if you're, an integration partner, there's a set of apis for third-party mdm compliance network access control and mobile threat. Defense. Those are available for partners that have a specific integration directly with intune.

A

Now, if you're using graph. If for those of you who are familiar with graph, you'll recognize generally, this particular diagram, but if you're new to intune and graph everything that we do in the intune console, which is hosted as part of azure portal, goes through the graph api.

A

Now you can also use powershell or third-party isvs that have developed applications can go and go against graph, and all of that builds our itpro experience.

A

I know that many of you have been working also with sharepoint teams, onedrive azure, active directory and all of them have apis that are hosted in microsoft, graph and, of course, the benefit to you as a developer. Is you get a consistent set of services that are hosted as part of graphs such as role-based access control, multi-region routing, telemetry logging authentication for both delegated and apple and the auth?

A

Our graph apis for intune then connect to the intune front-end service and that front-end service is then routed directly to regional scale units all around the world? I had mentioned a couple of other apis that are for our integration partners or for an information worker. Those apis connect directly to our front end service and don't go through graph, so there are a set of apis which are which are not part of graph.

A

So, if you're developing against the intune apis, there's a lot of different things that you can perform, you can do aad device or user membership. You can perform actions such as retire wipe devices.

A

You can get inventory information about devices that have been rolled enrolled in intune or you can deploy profiles for configuration, deploy, new applications or compliance policy.

A

Now a lot of times you may be working as a customer or with customers who are interested in managing a pilot environment and a production environment, and so configuring, third-party connectors or rollback our back roles and role assignments, things that are more one-time operations or infrequent can also be done via the graph api.

A

And then, if you want to pull together an entire scenario and automate that through our graph api, you could do an entire set of pilot to production settings migration from one environment to another or maybe desired. State configuration is of high value for you to be able to ensure that your configurations don't drift over time.

A

So uh in order to demonstrate a few of these different concepts, what we're going to talk about what we're going to use is we're going to use some graph explorer tool.

A

Many of you may be familiar with this or postman is also somewhat of an equivalent to graph explorer, at least for being able to make and and receive api calls, and then I'll give you a little tip on how to ensure that you know which specific intune api calls are being made when you're looking at the console and then we'll also spend a little bit of time using some powershell script and modules.

A

And lastly, I've got some reference material here for you, so we'll leave this available for you to take a look at and get the information that you need for all of the different apis for intune. So let me switch over. I've got a couple of different tools. Open I've got powershell, I've got our console. I've got a folder here. I've got vs code and these are the different tools that we'll use for the demo.

A

So the first thing that we're going to do is we're going to go to tenant administration in the intune console and we're going to take a look at all of the roles.

A

um So we've got a set of roles here and I've got one role: that's a custom role that has all the admin permissions, so I've gone through and added every possible permission rather than one that's a little bit more purpose-built and what we can then do is we can go over to graph explorer and I'm just going to run a a get call against our v10, and this is looking under device management.

A

So that's the main area of all of the graph api and then we're going to look at role, definitions and when I run this you'll see the first one that we have is endpoint security manager and I've got quite a few roles and if we go all the way to the bottom, I think let's see here is our all admin permissions that we were looking at. So this is our json output from graph explorer.

A

That shows all of the different roles that we've got now if looking at that list is a little bit of a challenge. The other thing that I can do is I can append just a select equals display name here and then we get just the individual display name. So I can select any property, and if I'm interested in seeing all of the details about just one of the roles, then I can do a filter and do a dollar filter or display name equals all admin permissions.

A

And when I run that you'll see, I get all of the details for this particular individual role. So now that we've we've looked at just some basic queries that we can do with graph explorer, I said I'd give you a hint to understand how all of the intune api calls are being made. So I'm going to press f12 to go to developer mode and I've got network selected and fetch, and when I press refresh here, you'll notice that we get a single entry for our role, definitions, call and here's the specific request.

A

Url again, it's identical to the one that we did in graph explorer so a lot of times when I'm working with developers they're looking through the api reference material on the developer site and it's really difficult to figure out which api call matches individual actions in the console. So this is a great way to be able to put them together.

A

So we've got our list of role definitions and we can go run an rbac script, a powershell script that goes and retrieves exactly the same information. Now this is just displaying it in the console and so here's our uh all admin permissions role and a list of all the permissions. But let's say that I wanted to make a copy of that particular role, but I wanted to eliminate one of the permissions.

A

So I've got another script here that will export all of our custom roles and we'll put that out in the demos, folder and here's my all admin permissions in the in json output and let's move that over to our visual studio code. And now we can take a look and see here's the json output that came from our powershell script and I'm going to give this a new name without role assign and I'm going to remove this one roll permission. So we've just taken one out rather than having to click a lot in the ui.

A

I'm just going to go ahead and save this.

A

Now it's saved back to this all admin permissions and now what I can do is go back to our import role from json script, we'll run that and the role that I want. I'm just gonna copy this and.

A

I'll do that with actually the proper quotes.

A

And it will import that json that we made changes to, and so now I can go back to the intune console and we'll refresh and you'll see. We've got our all admin permissions without role assign, so that was really easy for us to be able to make a simple modification and re-import without having to use the ui. Now you notice, I've also got an action here called duplicate and some of the features in intune allow you to easily duplicate a an object.

A

But if I go over to devices compliance policies, you'll notice, I've got a whole bunch of different compliance policies and if I click on the three dots I don't have, a duplicate and compliance policies can be relatively complex and so again, just like in our long list of role, permissions there's an easy way using graph to be able to create a copy of a compliance, ap compliance policy so using the sample script of compliance, export and we'll use the same demos folder.

A

This will go export out all of my compliance policies.

A

So now I've got an android signage compliance policy and we can actually, if we go, let's see, let's go, take a look, so we only have one android signage compliance policy, but now, if we go run the compliance import.

A

Script and we'll put in.

A

A

And we'll just import that you'll notice, here's all of the different settings for our compliance policy, and now we've got with a refresh. We've got a duplicate of our android signage compliance policy. Now this hasn't been deployed to anybody, this new one that we created and you notice I was able to create one with the duplicate name, some of the objects and intune allow duplicate names, some of them. Don't. You may have noticed that I changed. The name of our role and roles are one object that doesn't allow duplicates.

A

So we've got a variety of different ways in which we can make graph calls. We can either use graph explorer and do things basically kind of one by one or you can use powershell to build together a whole set of scripts that enable a complete end to scenario now. One thing that I mentioned was microsoft: 365, dsc, microsoft, 365, dsc or desired.

A

State configuration is a great set of powershell commandlets that are built off the microsoft graph sdk and there are the ability to export azure, active directory teams, security and compliance in tune exchange, all different types of configuration and then monitor those for drifts. So I'd encourage you to take a look at that again. The link is here in the reference material that I'll save, but that's all that I've got for demos today.

A

Hopefully this gives you a good idea of what's possible with the microsoft intune graph apis and a little bit of how you can go about getting started with them today.

A

All right, thank you, dave, really cool, stuff and and awesome awesome demo, so good coverage and cruise reference is really really good. Thank you for this. Thank you.