ESC
Type to search...

Device.Command

Export JSON
Export CSV
Copy URL
Print
Delegated Read User Scope

Allows the app to launch another app or communicate with another app on a user's device on behalf of the signed-in user.

Delegated Access App-Only Access

Permission Details

Delegated Permission User consent allowed

Communicate with user devices

Allows the app to launch another app or communicate with another app on a user's device on behalf of the signed-in user.

Properties

Property Type Description
id string The unique identifier for an entity. Read-only.
description stringNullable The description of the device registration policy. It's always set to Tenant-wide policy that manages intial provisioning controls using quota restrictions, additional authentication and authorization checks. Read-only.
displayName stringNullable The name of the device registration policy. It's always set to Device Registration Policy. Read-only.
userDeviceQuota int32 Specifies the maximum number of devices that a user can have within your organization before blocking new device registrations. The default value is set to 50. If this property isn't specified during the policy update operation, it's automatically reset to 0 to indicate that users aren't allowed to join any devices.
multiFactorAuthConfiguration microsoft.graph.multiFactorAuthConfiguration
localAdminPassword object Specifies the setting for Local Admin Password Solution (LAPS) within your organization.
azureADJoin object Specifies the authorization policy for controlling registration of new devices using Microsoft Entra join within your organization. Required. For more information, see What is a device identity?.
azureADRegistration object Specifies the authorization policy for controlling registration of new devices using Microsoft Entra registered within your organization. Required. For more information, see What is a device identity?.

Relationships

Relationship Type Description
registeredOwners directoryObject collection The user that cloud joined the device or registered their personal device. The registered owner is set at the time of registration. Read-only. Nullable.
registeredUsers directoryObject collection Collection of registered users of the device. For cloud joined devices and registered personal devices, registered users are set to the same value as registered owners at the time of registration. Read-only. Nullable.
memberOf directoryObject collection Groups and administrative units that this device is a member of. Read-only. Nullable. Supports $expand.
transitiveMemberOf directoryObject collection Groups and administrative units that this device is a member of. This operation is transitive. Supports $expand.
extensions extension collection The collection of open extensions defined for the device. Read-only. Nullable.

Graph Methods

Delegated access App-only access

No API methods available for this version.

No API methods available for this version.

No PowerShell cmdlets found for this permission.

No PowerShell cmdlets found for this permission.

Code Examples

C# / .NET SDK
// Install: dotnet add package Microsoft.Graph
// Install: dotnet add package Azure.Identity
using Microsoft.Graph;
using Azure.Identity;

// Delegated permissions - interactive user sign-in
var scopes = new[] { "Device.Command" };
var options = new InteractiveBrowserCredentialOptions
{
    ClientId = "YOUR_CLIENT_ID",
    TenantId = "YOUR_TENANT_ID",
    RedirectUri = new Uri("http://localhost")
};
var credential = new InteractiveBrowserCredential(options);
var graphClient = new GraphServiceClient(credential, scopes);

// Example: GET /me
var result = await graphClient.Me.GetAsync();
Console.WriteLine($"User: {result?.DisplayName}");
JavaScript / TypeScript
// npm install @azure/msal-browser @microsoft/microsoft-graph-client
import { PublicClientApplication } from "@azure/msal-browser";
import { Client } from "@microsoft/microsoft-graph-client";
import { AuthCodeMSALBrowserAuthenticationProvider } from 
    "@microsoft/microsoft-graph-client/authProviders/authCodeMsalBrowser";

const msalConfig = {
    auth: {
        clientId: "YOUR_CLIENT_ID",
        authority: "https://login.microsoftonline.com/YOUR_TENANT_ID"
    }
};

const pca = new PublicClientApplication(msalConfig);
await pca.initialize();

// Delegated: Login with required scope
const loginResponse = await pca.loginPopup({
    scopes: ["Device.Command"]
});

const authProvider = new AuthCodeMSALBrowserAuthenticationProvider(pca, {
    account: loginResponse.account,
    scopes: ["Device.Command"],
    interactionType: "popup"
});

const graphClient = Client.initWithMiddleware({ authProvider });

// Example: GET /me
const result = await graphClient.api("/me").get();
console.log(result);
PowerShell
# Install Microsoft Graph PowerShell module
Install-Module Microsoft.Graph -Scope CurrentUser

# Delegated access - interactive sign-in
Connect-MgGraph -Scopes "Device.Command"

# Verify connection
Get-MgContext | Select-Object Account, TenantId, Scopes

# Example: GET /me
$result = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/me"
$result | ConvertTo-Json -Depth 5


# Always disconnect when done
Disconnect-MgGraph
Python
# pip install msgraph-sdk azure-identity
from azure.identity import InteractiveBrowserCredential, ClientSecretCredential
from msgraph import GraphServiceClient
import asyncio

# Delegated permissions - interactive browser sign-in
credential = InteractiveBrowserCredential(
    client_id="YOUR_CLIENT_ID",
    tenant_id="YOUR_TENANT_ID"
)
scopes = ["Device.Command"]
client = GraphServiceClient(credential, scopes)

async def get_data():
    # Example: GET /me
    result = await client.me.get()
    print(f"User: {result.display_name}")
    return result

asyncio.run(get_data())

App Registration

1

Navigate to Azure Portal

Go to App registrations in Microsoft Entra admin center

2

Add API Permission

Select your app → API permissions → Add a permission → Microsoft Graph

3

Select Permission Type

Choose Delegated permissions and search for Device.Command

4

Grant Admin Consent

Users can consent to this permission themselves during sign-in.