Get available policies through Graph API

Hey everyone,

I would like to know if anyone has found a way to get all available policies (Compliance, Configuration) in JSON or any other format.

I know we can get all policies that were previously created, but we'd love to find a way to get all available policies.

Since Intune (and all other Microsoft SaaS products nowadays) keeps changing, it's hard for us to establish a static list of policies without constantly updating it. Being able to get the policies dynamically would be great.

Thanks in advance,

Miguel

Graph API

Intune

Oliver Kieselbach
Feb 23, 2018
Hi Miguel

try to implement empty policies and get them via

https://graph.microsoft.com/beta/devicemanagement/deviceConfigurations

or you can even address them directly:

https://graph.microsoft.com/beta/devicemanagement/deviceConfigurations/{id}

The empty policies will have all options listed. So in the end you will have an query for every empty configuration which gives you all available settings. You can archive them and compare them later.

you will get an output like this:

{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceManagement/deviceConfigurations/$entity",
    "@odata.type": "#microsoft.graph.windows10GeneralConfiguration",
    "id": "d15e5d52-b5fc-40ff-8434-ed63f8ed3ab3",
    "lastModifiedDateTime": "2018-01-19T16:44:01.0523964Z",
    "createdDateTime": "2017-11-20T19:58:24.2758957Z",
    "description": "",
    "displayName": "Device Restrictions",
    "version": 12,
    "enableAutomaticRedeployment": true,
    "assignedAccessSingleModeUserName": null,
    "assignedAccessSingleModeAppUserModelId": null,
    "microsoftAccountSignInAssistantSettings": "notConfigured",
    "authenticationAllowSecondaryDevice": false,
    "authenticationAllowFIDODevice": false,
    "cryptographyAllowFipsAlgorithmPolicy": false,
    "displayAppListWithGdiDPIScalingTurnedOn": [],
    "displayAppListWithGdiDPIScalingTurnedOff": [],
    "enterpriseCloudPrintDiscoveryEndPoint": null,
    "enterpriseCloudPrintOAuthAuthority": null,
    "enterpriseCloudPrintOAuthClientIdentifier": null,
    "enterpriseCloudPrintResourceIdentifier": null,
    "enterpriseCloudPrintDiscoveryMaxLimit": null,
    "enterpriseCloudPrintMopriaDiscoveryResourceIdentifier": null,
    "messagingBlockSync": false,
    "messagingBlockMMS": false,
    "messagingBlockRichCommunicationServices": false,
    "searchBlockDiacritics": false,
    "searchDisableAutoLanguageDetection": false,
    "searchDisableIndexingEncryptedItems": false,
    "searchEnableRemoteQueries": false,
    "searchDisableUseLocation": false,
    "searchDisableIndexerBackoff": false,

[...]

best,

Oliver

Oliver Kieselbach
MVP
Feb 22, 2018
Hi Miguel,

did you try the Intune samples?

https://github.com/microsoftgraph/powershell-intune-samples

It seems they are fulfilling your needs.

There we have:

DeviceConfiguration_Get.ps1

This script gets all the device configuration policies from the Intune Service that you have authenticated with.

https://github.com/microsoftgraph/powershell-intune-samples/tree/master/DeviceConfiguration#4-deviceconfiguration_getps1

and

CompliancePolicy_Export.ps1

This script gets all the compliance policies from the Intune Service that you have authenticated with. The script will then export the policy to .json format in the directory of your choice.

https://github.com/microsoftgraph/powershell-intune-samples/tree/master/CompliancePolicy#3-compliancepolicy_exportps1

best,

Oliver
- Miguel Filipe Duarte
  Copper Contributor
  Feb 23, 2018
  Hi Oliver,
  
  First of all thank you for your answer.
  
  I'd already seen those examples, but from what I can understand, those commands retrieve configured policies. That is, it gets all the policies that we've created, not the available options in all those policies.
  
  What I'm looking for is getting all the available options dynamically, since they seem to change too frequently. It's hard to keep a file updated with all available options for each policy.
  
  Thank you,
  
  Miguel
  - Oliver Kieselbach
    MVP
    Feb 23, 2018
    Hi Miguel
    
    try to implement empty policies and get them via
    
    https://graph.microsoft.com/beta/devicemanagement/deviceConfigurations
    
    or you can even address them directly:
    
    https://graph.microsoft.com/beta/devicemanagement/deviceConfigurations/{id}
    
    The empty policies will have all options listed. So in the end you will have an query for every empty configuration which gives you all available settings. You can archive them and compare them later.
    
    you will get an output like this:
    
    {
        "@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceManagement/deviceConfigurations/$entity",
        "@odata.type": "#microsoft.graph.windows10GeneralConfiguration",
        "id": "d15e5d52-b5fc-40ff-8434-ed63f8ed3ab3",
        "lastModifiedDateTime": "2018-01-19T16:44:01.0523964Z",
        "createdDateTime": "2017-11-20T19:58:24.2758957Z",
        "description": "",
        "displayName": "Device Restrictions",
        "version": 12,
        "enableAutomaticRedeployment": true,
        "assignedAccessSingleModeUserName": null,
        "assignedAccessSingleModeAppUserModelId": null,
        "microsoftAccountSignInAssistantSettings": "notConfigured",
        "authenticationAllowSecondaryDevice": false,
        "authenticationAllowFIDODevice": false,
        "cryptographyAllowFipsAlgorithmPolicy": false,
        "displayAppListWithGdiDPIScalingTurnedOn": [],
        "displayAppListWithGdiDPIScalingTurnedOff": [],
        "enterpriseCloudPrintDiscoveryEndPoint": null,
        "enterpriseCloudPrintOAuthAuthority": null,
        "enterpriseCloudPrintOAuthClientIdentifier": null,
        "enterpriseCloudPrintResourceIdentifier": null,
        "enterpriseCloudPrintDiscoveryMaxLimit": null,
        "enterpriseCloudPrintMopriaDiscoveryResourceIdentifier": null,
        "messagingBlockSync": false,
        "messagingBlockMMS": false,
        "messagingBlockRichCommunicationServices": false,
        "searchBlockDiacritics": false,
        "searchDisableAutoLanguageDetection": false,
        "searchDisableIndexingEncryptedItems": false,
        "searchEnableRemoteQueries": false,
        "searchDisableUseLocation": false,
        "searchDisableIndexerBackoff": false,
    
    [...]
    
    best,
    
    Oliver

Forum Discussion

Get available policies through Graph API

Share

Resources