Device.Read
Export JSON
Export CSV
Copy URL
Print
Delegated
Read
User Scope
Allows the app to read a user's list of devices on behalf of the signed-in user.
Delegated Access
App-Only Access
Permission Details
Delegated Permission
User consent allowed
Read user devices
Allows the app to read a user's list of devices on behalf of the signed-in user.
User sees: Allows the app to see your list of devices.
Permission ID:
11d4cd79-5ba5-460f-803f-e22c8ab85ccd
Properties
| Property | Type | Description |
|---|---|---|
id |
string |
The unique identifier for an entity. Read-only. |
description |
stringNullable |
The description of the device registration policy. It's always set to Tenant-wide policy that manages intial provisioning controls using quota restrictions, additional authentication and authorization checks. Read-only. |
displayName |
stringNullable |
The name of the device registration policy. It's always set to Device Registration Policy. Read-only. |
userDeviceQuota |
int32 |
Specifies the maximum number of devices that a user can have within your organization before blocking new device registrations. The default value is set to 50. If this property isn't specified during the policy update operation, it's automatically reset to 0 to indicate that users aren't allowed to join any devices. |
multiFactorAuthConfiguration |
microsoft.graph.multiFactorAuthConfiguration |
|
localAdminPassword |
object |
Specifies the setting for Local Admin Password Solution (LAPS) within your organization. |
azureADJoin |
object |
Specifies the authorization policy for controlling registration of new devices using Microsoft Entra join within your organization. Required. For more information, see What is a device identity?. |
azureADRegistration |
object |
Specifies the authorization policy for controlling registration of new devices using Microsoft Entra registered within your organization. Required. For more information, see What is a device identity?. |
Relationships
| Relationship | Type | Description |
|---|---|---|
registeredOwners |
directoryObject collection |
The user that cloud joined the device or registered their personal device. The registered owner is set at the time of registration. Read-only. Nullable. |
registeredUsers |
directoryObject collection |
Collection of registered users of the device. For cloud joined devices and registered personal devices, registered users are set to the same value as registered owners at the time of registration. Read-only. Nullable. |
memberOf |
directoryObject collection |
Groups and administrative units that this device is a member of. Read-only. Nullable. Supports $expand. |
transitiveMemberOf |
directoryObject collection |
Groups and administrative units that this device is a member of. This operation is transitive. Supports $expand. |
extensions |
extension collection |
The collection of open extensions defined for the device. Read-only. Nullable. |
Graph Methods
Delegated access
App-only access
No API methods available for this version.
No API methods available for this version.
No PowerShell cmdlets found for this permission.
No PowerShell cmdlets found for this permission.
Code Examples
C# / .NET SDK
// Install: dotnet add package Microsoft.Graph
// Install: dotnet add package Azure.Identity
using Microsoft.Graph;
using Azure.Identity;
// Delegated permissions - interactive user sign-in
var scopes = new[] { "Device.Read" };
var options = new InteractiveBrowserCredentialOptions
{
ClientId = "YOUR_CLIENT_ID",
TenantId = "YOUR_TENANT_ID",
RedirectUri = new Uri("http://localhost")
};
var credential = new InteractiveBrowserCredential(options);
var graphClient = new GraphServiceClient(credential, scopes);
// Example: GET /me
var result = await graphClient.Me.GetAsync();
Console.WriteLine($"User: {result?.DisplayName}");
JavaScript / TypeScript
// npm install @azure/msal-browser @microsoft/microsoft-graph-client
import { PublicClientApplication } from "@azure/msal-browser";
import { Client } from "@microsoft/microsoft-graph-client";
import { AuthCodeMSALBrowserAuthenticationProvider } from
"@microsoft/microsoft-graph-client/authProviders/authCodeMsalBrowser";
const msalConfig = {
auth: {
clientId: "YOUR_CLIENT_ID",
authority: "https://login.microsoftonline.com/YOUR_TENANT_ID"
}
};
const pca = new PublicClientApplication(msalConfig);
await pca.initialize();
// Delegated: Login with required scope
const loginResponse = await pca.loginPopup({
scopes: ["Device.Read"]
});
const authProvider = new AuthCodeMSALBrowserAuthenticationProvider(pca, {
account: loginResponse.account,
scopes: ["Device.Read"],
interactionType: "popup"
});
const graphClient = Client.initWithMiddleware({ authProvider });
// Example: GET /me
const result = await graphClient.api("/me").get();
console.log(result);
PowerShell
# Install Microsoft Graph PowerShell module
Install-Module Microsoft.Graph -Scope CurrentUser
# Delegated access - interactive sign-in
Connect-MgGraph -Scopes "Device.Read"
# Verify connection
Get-MgContext | Select-Object Account, TenantId, Scopes
# Example: GET /me
$result = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/me"
$result | ConvertTo-Json -Depth 5
# Always disconnect when done
Disconnect-MgGraph
Python
# pip install msgraph-sdk azure-identity
from azure.identity import InteractiveBrowserCredential, ClientSecretCredential
from msgraph import GraphServiceClient
import asyncio
# Delegated permissions - interactive browser sign-in
credential = InteractiveBrowserCredential(
client_id="YOUR_CLIENT_ID",
tenant_id="YOUR_TENANT_ID"
)
scopes = ["Device.Read"]
client = GraphServiceClient(credential, scopes)
async def get_data():
# Example: GET /me
result = await client.me.get()
print(f"User: {result.display_name}")
return result
asyncio.run(get_data())
App Registration
1
Navigate to Azure Portal
Go to App registrations in Microsoft Entra admin center
2
Add API Permission
Select your app → API permissions → Add a permission → Microsoft Graph
3
Select Permission Type
Choose Delegated permissions and search for Device.Read
4
Grant Admin Consent
Users can consent to this permission themselves during sign-in.