Graph API Change Detected: groupPolicyConfigurations deprecated & deviceStatuses endpoint removed

[ugurkocde]

Summary

Two Microsoft Graph Beta API changes directly affect this project:

1. deviceManagement/groupPolicyConfigurations — Deprecated (March 2025)
2. deviceManagement/deviceConfigurations('{id}')/deviceStatuses — Removed (May 2024)

---

1. groupPolicyConfigurations API Deprecated

What changed

As of March 31, 2025 (MC955748), the following Beta APIs no longer support creation and management of Windows Endpoint security policies and Administrative templates:

• deviceManagement/groupPolicyConfigurations
• deviceManagement/groupPolicyCategories
• deviceManagement/groupPolicyDefinitions

Microsoft requires migration to deviceManagement/configurationPolicies.

Affected code locations in IntuneAssignmentChecker.ps1

Lines	Usage
1986, 1988	User assignment check — fetches groupPolicyConfigurations entities and assignments
3483, 3485	Group assignment check — fetches entities and direct assignments
4181, 4183	Device assignment check — fetches entities and assignments
5104, 5106	Policy overview — fetches all admin templates
5735, 5737	Policy overview (additional context)
6438, 6440	Policy overview (additional context)
7196, 7198	Policy overview (additional context)
7652, 7654	Policy overview (additional context)
8237	Direct API call: $GraphEndpoint/beta/deviceManagement/groupPolicyConfigurations
8242	Direct API call: $GraphEndpoint/beta/deviceManagement/groupPolicyConfigurations('{id}')/assignments

Suggested fix

Replace all groupPolicyConfigurations references with configurationPolicies. The new API uses the same pattern:

GET /beta/deviceManagement/configurationPolicies
GET /beta/deviceManagement/configurationPolicies('{id}')/assignments

Note: Administrative templates migrated to the unified settings platform will have new Policy IDs, so any cached/hardcoded IDs would also need updating. The response schema may differ slightly — configurationPolicies uses name instead of displayName in some cases. Testing is required to verify field mappings.

---

2. deviceConfigurations/.../deviceStatuses Endpoint Removed

What changed

As of May 2024, Microsoft removed several Beta APIs from the old Intune reporting framework, including:

• deviceManagement/deviceConfigurations('{id}')/deviceStatuses

Reference: Removal of several Microsoft Graph Beta APIs for Intune device configuration reports

Affected code locations in IntuneAssignmentChecker.ps1

Line	Code
1509	$configPoliciesUri = "https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations"
1513	$statusUri = "https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations('$($policy.id)')/deviceStatuses"

This is used in the "Get Device Configuration Policy Failures" section (lines 1506–1536). Calls to this endpoint may already be failing silently (caught by the try/catch on line 1534).

Suggested fix

Migrate to the newer Intune reporting framework. The replacement endpoint is:

POST /beta/deviceManagement/reports/getConfigurationPolicyDevicesReport

With a JSON body specifying the policy ID and desired columns. Example:

{
  "filter": "(PolicyId eq '{policyId}')",
  "select": ["DeviceName", "UPN", "PolicyStatus", "LastContact"]
}

---

Additional Note: deviceConfigurations Migration

Microsoft is actively migrating device configuration templates from deviceManagement/deviceConfigurations to the unified settings platform (deviceManagement/configurationPolicies). While deviceConfigurations still works for listing and reading policies, newly created policies in Intune may only appear under configurationPolicies. This affects 18+ locations in the script that query deviceConfigurations (lines 1960, 3444, 4156, 5068, 5713, 6416, 7176, 7618, 8166, 8179, etc.).

Consider adding configurationPolicies as an additional source when listing device configuration profiles to ensure full coverage.

---

References

• Updates to Beta APIs for Windows Endpoint security and Administrative templates
• Removal of several Microsoft Graph Beta APIs for Intune device configuration reports
• MC955748 — Updates to Graph Beta APIs
• Migration guidance
• Microsoft Graph API changelog

[ugurkocde]

Analysis & Migration Plan

Verified the full scope of both deprecated endpoints in the codebase.

---

1. groupPolicyConfigurations Deprecation — 11 occurrences

All calls go through the Get-IntuneEntities wrapper except the Compare Groups function which makes direct HTTP calls:

Via Get-IntuneEntities (8 menu options):

Lines	Function
1986, 1988	User assignment check
3483, 3485	Group assignment check
4181, 4183	Device assignment check
5104, 5106	All policies display
5735, 5737	All users assignments
6438, 6440	All devices assignments
7196, 7198	Unassigned policies
7652, 7654	Empty group assignments

Direct HTTP calls (Compare Groups function):

Line	Code
8237	"$GraphEndpoint/beta/deviceManagement/groupPolicyConfigurations"
8242	"$GraphEndpoint/beta/deviceManagement/groupPolicyConfigurations('$templateId')/assignments"

Migration approach: The most efficient fix is to update the Get-IntuneEntities function to translate the entity type internally. This way, changing groupPolicyConfigurations → configurationPolicies in one place covers 8 of the 11 occurrences. The Compare Groups direct calls (lines 8237, 8242) need separate updates.

Important caveat: configurationPolicies uses name instead of displayName in some responses. The script already handles configurationPolicies for Settings Catalog (90+ occurrences), so the display name mapping logic exists — look at how Settings Catalog items are rendered (e.g., line 1973 onwards) for the pattern to follow. You may also need to add a templateFamily filter (e.g., ?$filter=templateReference/templateFamily eq 'none' for administrative templates specifically) to avoid mixing them with other Settings Catalog policies.

---

2. deviceConfigurations/.../deviceStatuses Removal — Lines 1509–1536

This is in the Get-AssignmentFailures function. Two issues compound here:

1. The endpoint is removed — deviceStatuses sub-resource no longer exists
2. Hardcoded URLs — Lines 1509 and 1513 use https://graph.microsoft.com instead of $script:GraphEndpoint (also tracked in Code Quality: Hardcoded Graph URLs break USGov, stale parameter docs, missing error handling #115)

Current code (lines 1509–1514):

$configPoliciesUri = "https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations"
$configPolicies = (Invoke-MgGraphRequest -Uri $configPoliciesUri -Method GET).value
foreach ($policy in $configPolicies) {
    $statusUri = "https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations('$($policy.id)')/deviceStatuses"
    $statuses = (Invoke-MgGraphRequest -Uri $statusUri -Method GET).value

Replacement approach using the new reporting API:

# Replace the per-policy deviceStatuses loop with the reporting endpoint
$reportUri = "$script:GraphEndpoint/beta/deviceManagement/reports/getConfigurationPolicyDevicesReport"
foreach ($policy in $configPolicies) {
    $body = @{
        filter = "(PolicyId eq '$($policy.id)')"
        select = @("DeviceName", "UPN", "PolicyStatus", "LastContact")
    } | ConvertTo-Json
    try {
        $report = Invoke-MgGraphRequest -Uri $reportUri -Method POST -Body $body -ContentType "application/json"
        # Process report.Values — note: response format differs from the old endpoint
    }
    catch {
        Write-Host "  Failed to get status for $($policy.displayName): $_" -ForegroundColor Red
    }
}

Note: The reporting API returns data in a columnar format (Schema + Values arrays) rather than the object-per-device format of the old endpoint. The parsing logic in lines 1515–1536 will need to be adapted accordingly.

---

3. Broader deviceConfigurations Migration (Lower Priority)

The script uses deviceConfigurations in 10+ additional locations (lines 1960, 3444, 4156, 5068, 5713, 6416, 7176, 7618, 8166, 8179) for listing/reading policies — these still work but newly created policies may only appear under configurationPolicies. Consider querying both endpoints and merging results to ensure full coverage, deduplicating by policy ID.

[ugurkocde]

Urgency Update: deviceConfigurationDeviceStatus Formal Deprecation — May 2026

A follow-up scan found an important clarification to item #2 in this issue.

What's new

Microsoft has now added a formal deprecation notice to the deviceConfigurationDeviceStatus entity type documentation for both v1.0 and beta:

"Support for this Entity is being deprecated starting May 2026 & will no longer be supported."

Clarification on timeline

The original issue states the deviceStatuses endpoint was "removed" in May 2024. That May 2024 removal applied specifically to the old Intune reporting framework variants (e.g., the StatelessDeviceConfigurationFEService path). The standard deviceConfigurations('{id}')/deviceStatuses endpoint has continued to function, but Microsoft has now formally scheduled the entire deviceConfigurationDeviceStatus entity for deprecation in May 2026 — less than one month from now.

Impact

This means the code at lines 1513–1514 is not silently failing today, but will break in May 2026:

$statusUri = "https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations('$($policy.id)')/deviceStatuses"
$statuses = (Invoke-MgGraphRequest -Uri $statusUri -Method GET).value

The deviceComplianceDeviceStatus entity (used at line 1545 for compliance policy statuses) does not have a deprecation notice and remains unaffected.

Recommended action

Migration to the reports API (POST /beta/deviceManagement/reports/getConfigurationPolicyDevicesReport) as suggested in the original issue should be prioritized before the May 2026 cutoff.

References

• deviceConfigurationDeviceStatus (v1.0) — deprecation notice
• deviceConfigurationDeviceStatus (beta) — deprecation notice
• deviceComplianceDeviceStatus (beta) — no deprecation

---

Generated by Claude Code