Device.ReadWrite.All
Export JSON
Export CSV
Copy URL
Print
Application
Read/Write
All Resources
Allows the app to read and write all device properties without a signed in user. Does not allow device creation, device deletion or update of device alternative security identifiers.
Delegated Access
App-Only Access
Permission Details
Application Permission
Read and write devices
Allows the app to read and write all device properties without a signed in user. Does not allow device creation, device deletion or update of device alternative security identifiers.
Permission ID:
1138cb37-bd11-4084-a2b7-9f71582aeddb
Properties
| Property | Type | Description |
|---|---|---|
id |
string |
The unique identifier for an entity. Read-only. |
description |
stringNullable |
The description of the device registration policy. It's always set to Tenant-wide policy that manages intial provisioning controls using quota restrictions, additional authentication and authorization checks. Read-only. |
displayName |
stringNullable |
The name of the device registration policy. It's always set to Device Registration Policy. Read-only. |
userDeviceQuota |
int32 |
Specifies the maximum number of devices that a user can have within your organization before blocking new device registrations. The default value is set to 50. If this property isn't specified during the policy update operation, it's automatically reset to 0 to indicate that users aren't allowed to join any devices. |
multiFactorAuthConfiguration |
microsoft.graph.multiFactorAuthConfiguration |
|
localAdminPassword |
object |
Specifies the setting for Local Admin Password Solution (LAPS) within your organization. |
azureADJoin |
object |
Specifies the authorization policy for controlling registration of new devices using Microsoft Entra join within your organization. Required. For more information, see What is a device identity?. |
azureADRegistration |
object |
Specifies the authorization policy for controlling registration of new devices using Microsoft Entra registered within your organization. Required. For more information, see What is a device identity?. |
Relationships
| Relationship | Type | Description |
|---|---|---|
registeredOwners |
directoryObject collection |
The user that cloud joined the device or registered their personal device. The registered owner is set at the time of registration. Read-only. Nullable. |
registeredUsers |
directoryObject collection |
Collection of registered users of the device. For cloud joined devices and registered personal devices, registered users are set to the same value as registered owners at the time of registration. Read-only. Nullable. |
memberOf |
directoryObject collection |
Groups and administrative units that this device is a member of. Read-only. Nullable. Supports $expand. |
transitiveMemberOf |
directoryObject collection |
Groups and administrative units that this device is a member of. This operation is transitive. Supports $expand. |
extensions |
extension collection |
The collection of open extensions defined for the device. Read-only. Nullable. |
Graph Methods
Delegated access
App-only access
Code Examples
C# / .NET SDK
// Install: dotnet add package Microsoft.Graph
// Install: dotnet add package Azure.Identity
using Microsoft.Graph;
using Azure.Identity;
// Application permissions - daemon/service app
var tenantId = "YOUR_TENANT_ID";
var clientId = "YOUR_CLIENT_ID";
var clientSecret = "YOUR_CLIENT_SECRET";
var credential = new ClientSecretCredential(tenantId, clientId, clientSecret);
var graphClient = new GraphServiceClient(credential);
// Example: GET /users/{user-id}
var users = await graphClient.Users.GetAsync();
foreach (var user in users?.Value ?? [])
{
Console.WriteLine($"User: {user.DisplayName}");
}
JavaScript / TypeScript
// npm install @azure/msal-browser @microsoft/microsoft-graph-client
import { PublicClientApplication } from "@azure/msal-browser";
import { Client } from "@microsoft/microsoft-graph-client";
import { AuthCodeMSALBrowserAuthenticationProvider } from
"@microsoft/microsoft-graph-client/authProviders/authCodeMsalBrowser";
const msalConfig = {
auth: {
clientId: "YOUR_CLIENT_ID",
authority: "https://login.microsoftonline.com/YOUR_TENANT_ID"
}
};
const pca = new PublicClientApplication(msalConfig);
await pca.initialize();
// Application: Use client credentials (Node.js backend only)
// npm install @azure/identity @microsoft/microsoft-graph-client
import { ClientSecretCredential } from "@azure/identity";
import { TokenCredentialAuthenticationProvider } from
"@microsoft/microsoft-graph-client/authProviders/azureTokenCredentials";
const credential = new ClientSecretCredential(
"YOUR_TENANT_ID",
"YOUR_CLIENT_ID",
"YOUR_CLIENT_SECRET"
);
const authProvider = new TokenCredentialAuthenticationProvider(credential, {
scopes: ["https://graph.microsoft.com/.default"]
});
const graphClient = Client.initWithMiddleware({ authProvider });
const result = await graphClient.api("/users").get();
console.log(result);
PowerShell
# Install Microsoft Graph PowerShell module
Install-Module Microsoft.Graph -Scope CurrentUser
# Application access with certificate
$params = @{
ClientId = "YOUR_CLIENT_ID"
TenantId = "YOUR_TENANT_ID"
CertificateThumbprint = "YOUR_CERT_THUMBPRINT"
}
Connect-MgGraph @params
# Or with client secret (not recommended for production)
# Connect-MgGraph -ClientSecretCredential $credential
# Example: GET /users
$result = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/users"
$result | ConvertTo-Json -Depth 5
# Always disconnect when done
Disconnect-MgGraph
Python
# pip install msgraph-sdk azure-identity
from azure.identity import InteractiveBrowserCredential, ClientSecretCredential
from msgraph import GraphServiceClient
import asyncio
# Application permissions - client credentials
credential = ClientSecretCredential(
tenant_id="YOUR_TENANT_ID",
client_id="YOUR_CLIENT_ID",
client_secret="YOUR_CLIENT_SECRET"
)
scopes = ["https://graph.microsoft.com/.default"]
client = GraphServiceClient(credential, scopes)
async def get_users():
# Example: GET /users
result = await client.users.get()
for user in result.value:
print(f"User: {user.display_name}")
return result
asyncio.run(get_users())
App Registration
1
Navigate to Azure Portal
Go to App registrations in Microsoft Entra admin center
2
Add API Permission
Select your app → API permissions → Add a permission → Microsoft Graph
3
Select Permission Type
Choose Application permissions and search for Device.ReadWrite.All
4
Grant Admin Consent
Application permissions always require admin consent. Click "Grant admin consent" in the Azure portal.