We have an important update to provide on MS Graph Device Registration Policy resource type currently in preview and available in beta API version. We are making some changes to resource type properties that introduce breaking changes. These changes are expected to happen in the week of September 25, 2023. To ensure continued support and functionality, and minimize impact, it’s very important that all customers take note of these changes and prioritize modifying their applications that depend on this resource type accordingly.
Before we make the devcieRegistrationPolicy resource type generally available in our v1.0 API version, we need to align to MS Graph REST API best practices and design patterns. This change will be made to beta endpoint in the week of September 25, 2023, and then generally available to v1.0 endpoint later this year.
The applications will encounter an error (Bad Request) as new properties will be expected when configuring the deviceRegistrationPolicy resource type.
We recommend you modify your application immediately to configure deviceRegistrationPolicy resource type with both new and deprecated properties. The resource type available in beta endpoint today will honor both the deprecated and new properties. It will stop honoring deprecated properties during the week of September 25, 2023. Here’s an example of how you’ll use PUT to configure both new and deprecated properties.
{
"@odata.context": https://graph.microsoft.com/beta/$metadata#policies/deviceRegistrationPolicy/$entity,
"multiFactorAuthConfiguration": "notRequired",
"id": "deviceRegistrationPolicy",
"displayName": "Device Registration Policy",
"description": "Tenant-wide policy that manages initial provisioning controls using quota restrictions, additional authentication and authorization checks",
"userDeviceQuota": 20,
"azureADRegistration": {
"isAdminConfigurable": false,
"allowedToRegister": {
"@odata.type": "#microsoft.graph.allDeviceRegistrationMembership"
},
"appliesTo": "1",
"allowedUsers": [],
"allowedGroups": []
},
"azureADJoin": {
"isAdminConfigurable": true,
"allowedToJoin": {
"@odata.type": "#microsoft.graph.enumeratedDeviceRegistrationMembership",
"users": [
"a6aebac8-1faf-4ebd-9a68-727fa53376f4"
],
"groups": []
},
"appliesTo": "2",
"allowedUsers": [
"a6aebac8-1faf-4ebd-9a68-727fa53376f4"
],
"allowedGroups": [],
},
"localAdminPassword": {
"isEnabled": true
}
}
Notes:
If you follow our above recommendation to configure deviceRegistrationPolicy resource type with both new and deprecated properties, you can remove deprecated properties at any future time of convenience. Once the deviceRegistrationPolicy resource type is deployed with the new properties during the week of September 25, 2023, deprecated properties will be ignored by the resourceType.
Not currently. The API supports PUT operation for update, which means you need to configure all properties of deviceRegistrationPolicy resource type.
The deviceRegistrationPolicy resource type will return the deprecated properties until the week of September 25, 2023, after which the resource type will return the new properties.
Best regards,
Sandeep Deo (@MsftSandeep)
Principal Product Manager
Microsoft Identity Division
Learn more about Microsoft Entra:
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.