ESC
Type to search...

WindowsUpdates.ReadWrite.All

Export JSON
Export CSV
Copy URL
Print
ApplicationDelegated Read/Write All Resources

Allows the app to read and write all Windows update deployment settings for the organization without a signed-in user.

Permission data: April 6, 2026 at 4:06 AM UTC
Delegated Access App-Only Access

Permission Details

Application Permission

Read and write all Windows update deployment settings

Allows the app to read and write all Windows update deployment settings for the organization without a signed-in user.

Delegated Permission Admin consent required

Read and write all Windows update deployment settings

Allows the app to read and write all Windows update deployment settings for the organization on behalf of the signed-in user.

Properties

Microsoft Graph v1.0 endpoint-derived-docs

Properties is shown from stable Microsoft Graph v1.0 metadata.

Property Type Description
edge object A container for Microsoft Edge resources. Read-only.
exchange object A container for the Exchange admin functionality. Read-only.
microsoft365Apps object A container for the Microsoft 365 apps admin functionality.
people object Represents a setting to control people-related admin settings in the tenant.
reportSettings object A container for administrative resources to manage reports.
serviceAnnouncement object A container for service communications resources. Read-only.
sharepoint object
teams object A container for Teams administration functionalities, such as Teams telephone number management functionalities, user Teams configurations, and policy assignments.

JSON Representation

Microsoft Graph v1.0 endpoint-derived-docs

JSON representation is shown from stable Microsoft Graph v1.0 metadata.

JSON representation
{
  "@odata.type": "#microsoft.graph.admin"
}

Relationships

Microsoft Graph v1.0 endpoint-derived-docs

Relationships is shown from stable Microsoft Graph v1.0 metadata.

Relationship Type Description
configurationManagement configurationManagement A container for Tenant Configuration Management (TCM) resources. Read-only.
edge edge A container for Microsoft Edge resources. Read-only.
exchange exchangeAdmin A container for the Exchange admin functionality. Read-only.
microsoft365Apps adminMicrosoft365Apps A container for the Microsoft 365 apps admin functionality.
people peopleAdminSettings Represents a setting to control people-related admin settings in the tenant.
reportSettings adminReportSettings A container for administrative resources to manage reports.
serviceAnnouncement serviceAnnouncement A container for service communications resources. Read-only.
sharepointSettings sharepointSettings A container for administrative resources to manage tenant-level settings for SharePoint and OneDrive.
teams teamsAdministration.teamsAdminRoot A container for Teams administration functionalities, such as Teams telephone number management functionalities, user Teams configurations, and policy assignments.

Graph Methods

Delegated access App-only access
Exact Microsoft Learn match

Microsoft Graph v1.0 endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

No API methods available for this version.

Exact Microsoft Learn match

Microsoft Graph beta endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET /admin//windows/updates/deploymentAudiences/{deploymentAudienceId}/exclusions
GET /admin//windows/updates/deploymentAudiences/{deploymentAudienceId}/members
GET /admin/windows/updates/catalog/entries
GET /admin/windows/updates/deploymentAudiences
GET /admin/windows/updates/deploymentAudiences/{deploymentAudienceId}
GET /admin/windows/updates/deployments
GET /admin/windows/updates/deployments/{deploymentId}
GET /admin/windows/updates/policies?$filter=isof('microsoft.graph.windowsUpdates.qualityUpdatePolicy')
GET /admin/windows/updates/policies/{policyId}
GET /admin/windows/updates/policies/{policyId}/applicableContent
GET /admin/windows/updates/policies/{policyId}/approvals
GET /admin/windows/updates/policies/{policyId}/approvals/{policyApprovalId}
GET /admin/windows/updates/policies/{policyId}/rings?$filter=isof('microsoft.graph.windowsUpdates.qualityUpdateRing')
GET /admin/windows/updates/policies/{policyId}/rings/{ringId}
GET /admin/windows/updates/products/{id}/GetKnownIssuesByTimeRange(daysInPast={daysInPast},includeAllActive={includeAllActive})
GET /admin/windows/updates/products/FindByCatalogId(catalogID='catalogID')
GET /admin/windows/updates/products/FindByKbNumber(kbNumber={kbNumber})
GET /admin/windows/updates/resourceConnections
GET /admin/windows/updates/resourceConnections/{operationalInsightsConnectionId}
GET /admin/windows/updates/resourceConnections/{resourceConnectionId}
GET /admin/windows/updates/resourceConnections/microsoft.graph.windowsUpdates.operationalInsightsConnection
GET /admin/windows/updates/updatableAssets
GET /admin/windows/updates/updatableAssets/{azureADDeviceId}
GET /admin/windows/updates/updatableAssets/{updatableAssetGroupId}
GET /admin/windows/updates/updatableAssets/{updatableAssetGroupId}/microsoft.graph.windowsUpdates.updatableAssetGroup/members
GET /admin/windows/updates/updatableAssets/{updatableAssetId}
GET /admin/windows/updates/updatableAssets/microsoft.graph.windowsUpdates.azureADDevice
GET /admin/windows/updates/updatableAssets/microsoft.graph.windowsUpdates.updatableAssetGroup
GET /admin/windows/updates/updatePolicies
GET /admin/windows/updates/updatePolicies/{updatePolicyId}
GET /admin/windows/updates/updatePolicies/{updatePolicyId}/complianceChanges
GET /admin/windows/updates/updatePolicies/{updatePolicyId}/complianceChanges/{complianceChangeId}
GET /admin/windows/updates/updatePolicies/{updatePolicyId}/complianceChanges/microsoft.graph.windowsUpdates.contentApproval
POST /admin/windows/updates/deploymentAudiences
POST /admin/windows/updates/deploymentAudiences/{deploymentAudienceId}/updateAudience
POST /admin/windows/updates/deployments
POST /admin/windows/updates/deployments/{deploymentId}/audience/updateAudienceById
POST /admin/windows/updates/policies
POST /admin/windows/updates/policies/{policyId}/approvals
POST /admin/windows/updates/policies/{policyId}/rings
POST /admin/windows/updates/resourceConnections
POST /admin/windows/updates/updatableAssets
POST /admin/windows/updates/updatableAssets/{updatableAssetGroupId}/addMembers
POST /admin/windows/updates/updatableAssets/{updatableAssetGroupId}/addMembersById
POST /admin/windows/updates/updatableAssets/{updatableAssetGroupId}/removeMembers
POST /admin/windows/updates/updatableAssets/{updatableAssetGroupId}/removeMembersById
POST /admin/windows/updates/updatableAssets/enrollAssets
POST /admin/windows/updates/updatableAssets/enrollAssetsById
POST /admin/windows/updates/updatableAssets/unenrollAssets
POST /admin/windows/updates/updatableAssets/unenrollAssetsById
POST /admin/windows/updates/updatePolicies
POST /admin/windows/updates/updatePolicies/{updatePolicyId}/complianceChanges
PATCH /admin/windows/updates/deployments/{deploymentId}
PATCH /admin/windows/updates/policies/{policyId}
PATCH /admin/windows/updates/policies/{policyId}/approvals/{policyApprovalId}
PATCH /admin/windows/updates/policies/{policyId}/rings/{ringId}
PATCH /admin/windows/updates/updatePolicies/{updatePolicyId}
PATCH /admin/windows/updates/updatePolicies/{updatePolicyId}/complianceChanges/{complianceChangeId}
DELETE /admin/windows/updates/deploymentAudiences/{deploymentAudienceId}
DELETE /admin/windows/updates/deployments/{deploymentId}
DELETE /admin/windows/updates/policies/{policyId}
DELETE /admin/windows/updates/policies/{policyId}/approvals/{policyApprovalId}
DELETE /admin/windows/updates/policies/{policyId}/rings/{ringId}
DELETE /admin/windows/updates/resourceConnections/{operationalInsightsConnectionId}
DELETE /admin/windows/updates/resourceConnections/{resourceConnectionId}
DELETE /admin/windows/updates/updatableAssets/{azureADDeviceId}
DELETE /admin/windows/updates/updatableAssets/{updatableAssetGroupId}
DELETE /admin/windows/updates/updatableAssets/{updatableAssetId}
DELETE /admin/windows/updates/updatePolicies/{updatePolicyId}
DELETE /admin/windows/updates/updatePolicies/{updatePolicyId}/complianceChanges/{complianceChangeId}
Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell v1.0 commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

No deterministic PowerShell command map is available for this permission.

Browse PowerShell docs
Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell beta commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
Add-MgBetaWindowsUpdatesUpdatableAssetMember /admin/windows/updates/updatableAssets/{updatableAssetGroupId}/addMembers
updatableAssetGroup: addMembers
Add-MgBetaWindowsUpdatesUpdatableAssetMemberById /admin/windows/updates/updatableAssets/{updatableAssetGroupId}/addMembersById
updatableAssetGroup: addMembersById
Find-MgBetaWindowsUpdatesProductByCatalogId /admin/windows/updates/products/FindByCatalogId(catalogID='catalogID')
product: findByCatalogId
Find-MgBetaWindowsUpdatesProductByCatalogId /admin/windows/updates/products/FindByKbNumber(kbNumber={kbNumber})
product: findByKbNumber
Get-MgBetaWindowsUpdatesCatalogEntry /admin/windows/updates/catalog/entries
List entries
Get-MgBetaWindowsUpdatesDeployment /admin/windows/updates/deployments
List deployments
Get-MgBetaWindowsUpdatesDeployment /admin/windows/updates/deployments/{deploymentId}
Get deployment
Get-MgBetaWindowsUpdatesPolicy /admin/windows/updates/updatePolicies
List updatePolicies
Get-MgBetaWindowsUpdatesPolicy /admin/windows/updates/updatePolicies/{updatePolicyId}
Get updatePolicy
Get-MgBetaWindowsUpdatesPolicyComplianceChange /admin/windows/updates/updatePolicies/{updatePolicyId}/complianceChanges
List complianceChanges
Get-MgBetaWindowsUpdatesPolicyComplianceChange /admin/windows/updates/updatePolicies/{updatePolicyId}/complianceChanges/{complianceChangeId}
Get complianceChange
Get-MgBetaWindowsUpdatesPolicyComplianceChange /admin/windows/updates/updatePolicies/{updatePolicyId}/complianceChanges/{complianceChangeId}
Get contentApproval
Get-MgBetaWindowsUpdatesPolicyComplianceChange /admin/windows/updates/updatePolicies/{updatePolicyId}/complianceChanges/microsoft.graph.windowsUpdates.contentApproval
List contentApprovals
Get-MgBetaWindowsUpdatesProductKnownIssueByTimeRange /admin/windows/updates/products/{id}/GetKnownIssuesByTimeRange(daysInPast={daysInPast},includeAllActive={includeAllActive})
product: getKnownIssuesByTimeRange
Get-MgBetaWindowsUpdatesResourceConnection /admin/windows/updates/resourceConnections
List resourceConnections
Get-MgBetaWindowsUpdatesResourceConnection /admin/windows/updates/resourceConnections/{operationalInsightsConnectionId}
Get operationalInsightsConnection
Get-MgBetaWindowsUpdatesResourceConnection /admin/windows/updates/resourceConnections/{resourceConnectionId}
Get resourceConnection
Get-MgBetaWindowsUpdatesResourceConnection /admin/windows/updates/resourceConnections/microsoft.graph.windowsUpdates.operationalInsightsConnection
List operationalInsightsConnections
Get-MgBetaWindowsUpdatesUpdatableAsset /admin/windows/updates/updatableAssets
List updatableAssets
Get-MgBetaWindowsUpdatesUpdatableAsset /admin/windows/updates/updatableAssets/{azureADDeviceId}
Get azureADDevice
Get-MgBetaWindowsUpdatesUpdatableAsset /admin/windows/updates/updatableAssets/{updatableAssetGroupId}
Get updatableAssetGroup
Get-MgBetaWindowsUpdatesUpdatableAsset /admin/windows/updates/updatableAssets/{updatableAssetId}
Get updatableAsset
Get-MgBetaWindowsUpdatesUpdatableAsset /admin/windows/updates/updatableAssets/microsoft.graph.windowsUpdates.azureADDevice
List azureADDevice resources
Get-MgBetaWindowsUpdatesUpdatableAsset /admin/windows/updates/updatableAssets/microsoft.graph.windowsUpdates.updatableAssetGroup
List updatableAssetGroup resources
Invoke-MgBetaEnrollWindowsUpdatesUpdatableAsset /admin/windows/updates/updatableAssets/enrollAssets
updatableAsset: enrollAssets
Invoke-MgBetaEnrollWindowsUpdatesUpdatableAssetById /admin/windows/updates/updatableAssets/enrollAssetsById
updatableAsset: enrollAssetsById
Invoke-MgBetaGraphWindowsUpdatesUpdatableAsset /admin/windows/updates/updatableAssets/unenrollAssetsById
updatableAsset: unenrollAssetsById
Invoke-MgBetaUnenrollWindowsUpdatesUpdatableAsset /admin/windows/updates/updatableAssets/unenrollAssets
updatableAsset: unenrollAssets
New-MgBetaWindowsUpdatesDeployment /admin/windows/updates/deployments
Create deployment
New-MgBetaWindowsUpdatesPolicy /admin/windows/updates/updatePolicies
Create updatePolicy
New-MgBetaWindowsUpdatesPolicyComplianceChange /admin/windows/updates/updatePolicies/{updatePolicyId}/complianceChanges
Create contentApproval
New-MgBetaWindowsUpdatesResourceConnection /admin/windows/updates/resourceConnections
Create operationalInsightsConnection
New-MgBetaWindowsUpdatesUpdatableAsset /admin/windows/updates/updatableAssets
Create updatableAssetGroup
Remove-MgBetaWindowsUpdatesDeployment /admin/windows/updates/deployments/{deploymentId}
Delete deployment
Remove-MgBetaWindowsUpdatesPolicy /admin/windows/updates/updatePolicies/{updatePolicyId}
Delete updatePolicy
Remove-MgBetaWindowsUpdatesPolicyComplianceChange /admin/windows/updates/updatePolicies/{updatePolicyId}/complianceChanges/{complianceChangeId}
Delete complianceChange
Remove-MgBetaWindowsUpdatesPolicyComplianceChange /admin/windows/updates/updatePolicies/{updatePolicyId}/complianceChanges/{complianceChangeId}
Delete contentApproval
Remove-MgBetaWindowsUpdatesResourceConnection /admin/windows/updates/resourceConnections/{operationalInsightsConnectionId}
Delete operationalInsightsConnection
Remove-MgBetaWindowsUpdatesResourceConnection /admin/windows/updates/resourceConnections/{resourceConnectionId}
Delete resourceConnection
Remove-MgBetaWindowsUpdatesUpdatableAsset /admin/windows/updates/updatableAssets/{azureADDeviceId}
Delete azureADDevice
Remove-MgBetaWindowsUpdatesUpdatableAsset /admin/windows/updates/updatableAssets/{updatableAssetGroupId}
Delete updatableAssetGroup
Remove-MgBetaWindowsUpdatesUpdatableAsset /admin/windows/updates/updatableAssets/{updatableAssetId}
Delete updatableAsset
Remove-MgBetaWindowsUpdatesUpdatableAssetMember /admin/windows/updates/updatableAssets/{updatableAssetGroupId}/removeMembers
updatableAssetGroup: removeMembers
Remove-MgBetaWindowsUpdatesUpdatableAssetMemberById /admin/windows/updates/updatableAssets/{updatableAssetGroupId}/removeMembersById
updatableAssetGroup: removeMembersById
Update-MgBetaWindowsUpdatesDeployment /admin/windows/updates/deployments/{deploymentId}
Update deployment
Update-MgBetaWindowsUpdatesDeploymentAudienceById /admin/windows/updates/deployments/{deploymentId}/audience/updateAudienceById
deploymentAudience: updateAudienceById
Update-MgBetaWindowsUpdatesPolicy /admin/windows/updates/updatePolicies/{updatePolicyId}
Update updatePolicy
Update-MgBetaWindowsUpdatesPolicyComplianceChange /admin/windows/updates/updatePolicies/{updatePolicyId}/complianceChanges/{complianceChangeId}
Update complianceChange
Update-MgBetaWindowsUpdatesPolicyComplianceChange /admin/windows/updates/updatePolicies/{updatePolicyId}/complianceChanges/{complianceChangeId}
Update contentApproval

Code Examples

C# / .NET SDK
Create contentApproval
// Code snippets are only available for the latest version. Current version is 5.x

// Dependencies
using Microsoft.Graph.Beta.Models.WindowsUpdates;
using Microsoft.Kiota.Abstractions.Serialization;

var requestBody = new ContentApproval
{
	OdataType = "#microsoft.graph.windowsUpdates.contentApproval",
	Content = new CatalogContent
	{
		OdataType = "#microsoft.graph.windowsUpdates.catalogContent",
		CatalogEntry = new FeatureUpdateCatalogEntry
		{
			OdataType = "#microsoft.graph.windowsUpdates.featureUpdateCatalogEntry",
			Id = "6b7e60db-a8e4-426a-9aed-bd12b5c0b9d4",
		},
	},
	DeploymentSettings = new DeploymentSettings
	{
	},
	AdditionalData = new Dictionary<string, object>
	{
		{
			"schedule" , new UntypedObject(new Dictionary<string, UntypedNode>
			{
				{
					"startDateTime", new UntypedString("String (timestamp)")
				},
				{
					"gradualRollout", new UntypedObject(new Dictionary<string, UntypedNode>
					{
						{
							"@odata.type", new UntypedString("#microsoft.graph.windowsUpdates.dateDrivenRolloutSettings")
						},
						{
							"endDateTime", new UntypedString("String (timestamp)")
						},
					})
				},
			})
		},
	},
};

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Admin.Windows.Updates.UpdatePolicies["{updatePolicy-id}"].ComplianceChanges.PostAsync(requestBody);
JavaScript
Create contentApproval
const options = {
	authProvider,
};

const client = Client.init(options);

const complianceChange = {
  '@odata.type': '#microsoft.graph.windowsUpdates.contentApproval',
  content: {
    '@odata.type': '#microsoft.graph.windowsUpdates.catalogContent',
    catalogEntry: {
      '@odata.type': '#microsoft.graph.windowsUpdates.featureUpdateCatalogEntry', 
      id: '6b7e60db-a8e4-426a-9aed-bd12b5c0b9d4'
    }
  },
  deploymentSettings: {},
    schedule: {
      startDateTime: 'String (timestamp)',
      gradualRollout: {
        '@odata.type': '#microsoft.graph.windowsUpdates.dateDrivenRolloutSettings',
        endDateTime: 'String (timestamp)'
      }
   }
};

await client.api('/admin/windows/updates/updatePolicies/a7aa99c1-34a2-850c-5223-7816fde70713/complianceChanges')
	.version('beta')
	.post(complianceChange);
PowerShell
Create contentApproval
Import-Module Microsoft.Graph.Beta.WindowsUpdates

$params = @{
	"@odata.type" = "#microsoft.graph.windowsUpdates.contentApproval"
	content = @{
		"@odata.type" = "#microsoft.graph.windowsUpdates.catalogContent"
		catalogEntry = @{
			"@odata.type" = "#microsoft.graph.windowsUpdates.featureUpdateCatalogEntry"
			id = "6b7e60db-a8e4-426a-9aed-bd12b5c0b9d4"
		}
	}
	deploymentSettings = @{
	}
	schedule = @{
		startDateTime = "String (timestamp)"
		gradualRollout = @{
			"@odata.type" = "#microsoft.graph.windowsUpdates.dateDrivenRolloutSettings"
			endDateTime = "String (timestamp)"
		}
	}
}

New-MgBetaWindowsUpdatesPolicyComplianceChange -UpdatePolicyId $updatePolicyId -BodyParameter $params
Python
Create contentApproval
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.windows_updates.content_approval import ContentApproval
from msgraph_beta.generated.models.windows_updates.catalog_content import CatalogContent
from msgraph_beta.generated.models.windows_updates.feature_update_catalog_entry import FeatureUpdateCatalogEntry
from msgraph_beta.generated.models.windows_updates.deployment_settings import DeploymentSettings
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = ContentApproval(
	odata_type = "#microsoft.graph.windowsUpdates.contentApproval",
	content = CatalogContent(
		odata_type = "#microsoft.graph.windowsUpdates.catalogContent",
		catalog_entry = FeatureUpdateCatalogEntry(
			odata_type = "#microsoft.graph.windowsUpdates.featureUpdateCatalogEntry",
			id = "6b7e60db-a8e4-426a-9aed-bd12b5c0b9d4",
		),
	),
	deployment_settings = DeploymentSettings(
	),
	additional_data = {
			"schedule" : {
					"start_date_time" : "String (timestamp)",
					"gradual_rollout" : {
							"@odata_type" : "#microsoft.graph.windowsUpdates.dateDrivenRolloutSettings",
							"end_date_time" : "String (timestamp)",
					},
			},
	}
)

result = await graph_client.admin.windows.updates.update_policies.by_update_policy_id('updatePolicy-id').compliance_changes.post(request_body)

App Registration

1

Navigate to Azure Portal

Go to App registrations in Microsoft Entra admin center

2

Add API Permission

Select your app → API permissions → Add a permission → Microsoft Graph

3

Select Permission Type

Choose Application permissions or delegated permissions and search for WindowsUpdates.ReadWrite.All

4

Grant Admin Consent

Application permissions always require admin consent.