Device and Endpoint Management Visibility

Managed Device Visibility

Microsoft Graph Permission:

DeviceManagementManagedDevices.Read.All

This allows us to read properties of devices managed by Microsoft Intune.

We use it to review managed device inventory, device ownership, compliance status, operating system information, and management state.

This is important because managed devices are a key part of Microsoft 365 security. Device visibility helps identify unmanaged, non-compliant, or outdated endpoints.

Device Configuration and Compliance Policy Visibility

Microsoft Graph Permission:

DeviceManagementConfiguration.Read.All

This allows us to read Intune device configuration and compliance policies, including assignments to groups.

We use it to understand what endpoint policies exist and who they apply to.

This is important because configuration and compliance policies control device security settings. Reviewing them helps identify gaps, inconsistent assignments, or missing protections.