generated: '2026-07-15' method: generated source: openapi/microsoft-endpoint-configuration-management-configmgr-rest-api-openapi.yml, openapi/microsoft-endpoint-configuration-management-intune-data-warehouse-api-openapi.yml, openapi/microsoft-endpoint-configuration-management-intune-graph-api-openapi.yml, openapi/microsoft-endpoint-configuration-management-intune-reporting-export-api-openapi.yml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 71 by_action_class: connected: 40 acting: 31 by_consequence: read: 40 write: 29 safety-critical: 2 human_in_the_loop_required: 2 operations: - path: /wmi/SMS_Device method: get operationId: listDevicesWmi x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /wmi/SMS_R_System method: get operationId: listSystems x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /wmi/SMS_Collection method: get operationId: listCollections x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /wmi/SMS_Collection method: post operationId: createCollection x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /wmi/SMS_Collection('{collectionId}') method: get operationId: getCollection x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /wmi/SMS_Application method: get operationId: listApplications x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /wmi/SMS_Application method: post operationId: createApplication x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /wmi/SMS_Application('{applicationId}') method: get operationId: getApplication x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /wmi/SMS_ApplicationDeployment method: get operationId: listDeployments x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /wmi/SMS_Package method: get operationId: listPackages x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /wmi/SMS_TaskSequence method: get operationId: listTaskSequences x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /wmi/SMS_SoftwareUpdate method: get operationId: listSoftwareUpdates x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /wmi/SMS_Site method: get operationId: listSites x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /wmi/SMS_BaselineAssignment method: get operationId: listBaselineAssignments x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /v1.0/Device method: get operationId: listDevicesV1 x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /v1.0/Device({deviceId}) method: get operationId: getDeviceV1 x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /v1.0/Collections method: get operationId: listCollectionsV1 x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /v1.0/Scripts method: get operationId: listScripts x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /devices method: get operationId: listDevices x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /dates method: get operationId: listDates x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /users method: get operationId: listUsers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /devicePropertyHistories method: get operationId: listDevicePropertyHistories x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /policies method: get operationId: listPolicies x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /policyDeviceActivities method: get operationId: listPolicyDeviceActivities x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /policyUserActivities method: get operationId: listPolicyUserActivities x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /applications method: get operationId: listApplications x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /mobileAppInstallStatuses method: get operationId: listMobileAppInstallStatuses x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /userDeviceAssociations method: get operationId: listUserDeviceAssociations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /intuneManagementExtensions method: get operationId: listIntuneManagementExtensions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /deviceManagement/managedDevices method: get operationId: listManagedDevices x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /deviceManagement/managedDevices method: post operationId: createManagedDevice x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/managedDevices/{managedDeviceId} method: get operationId: getManagedDevice x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /deviceManagement/managedDevices/{managedDeviceId} method: patch operationId: updateManagedDevice x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/managedDevices/{managedDeviceId} method: delete operationId: deleteManagedDevice x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/managedDevices/{managedDeviceId}/retire method: post operationId: retireManagedDevice x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/managedDevices/{managedDeviceId}/wipe method: post operationId: wipeManagedDevice x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/managedDevices/{managedDeviceId}/syncDevice method: post operationId: syncManagedDevice x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/managedDevices/{managedDeviceId}/remoteLock method: post operationId: remoteLockManagedDevice x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/managedDevices/{managedDeviceId}/resetPasscode method: post operationId: resetPasscode x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /deviceManagement/managedDevices/{managedDeviceId}/rebootNow method: post operationId: rebootManagedDevice x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /deviceManagement/deviceCompliancePolicies method: get operationId: listDeviceCompliancePolicies x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /deviceManagement/deviceCompliancePolicies method: post operationId: createDeviceCompliancePolicy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/deviceCompliancePolicies/{deviceCompliancePolicyId} method: get operationId: getDeviceCompliancePolicy x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /deviceManagement/deviceCompliancePolicies/{deviceCompliancePolicyId} method: patch operationId: updateDeviceCompliancePolicy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/deviceCompliancePolicies/{deviceCompliancePolicyId} method: delete operationId: deleteDeviceCompliancePolicy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/deviceCompliancePolicies/{deviceCompliancePolicyId}/assign method: post operationId: assignDeviceCompliancePolicy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceAppManagement/mobileApps method: get operationId: listMobileApps x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /deviceAppManagement/mobileApps method: post operationId: createMobileApp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceAppManagement/mobileApps/{mobileAppId} method: get operationId: getMobileApp x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /deviceAppManagement/mobileApps/{mobileAppId} method: patch operationId: updateMobileApp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceAppManagement/mobileApps/{mobileAppId} method: delete operationId: deleteMobileApp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceAppManagement/mobileApps/{mobileAppId}/assign method: post operationId: assignMobileApp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceAppManagement/mobileApps/{mobileAppId}/deviceStatuses method: get operationId: listMobileAppDeviceStatuses x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /deviceManagement/deviceConfigurations method: get operationId: listDeviceConfigurations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /deviceManagement/deviceConfigurations method: post operationId: createDeviceConfiguration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/deviceConfigurations/{deviceConfigurationId} method: get operationId: getDeviceConfiguration x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /deviceManagement/deviceConfigurations/{deviceConfigurationId} method: patch operationId: updateDeviceConfiguration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/deviceConfigurations/{deviceConfigurationId} method: delete operationId: deleteDeviceConfiguration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/deviceConfigurations/{deviceConfigurationId}/assign method: post operationId: assignDeviceConfiguration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/deviceCompliancePolicyDeviceStateSummary method: get operationId: getDeviceCompliancePolicyDeviceStateSummary x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /users/{userId}/ownedDevices method: get operationId: listUserOwnedDevices x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /deviceManagement/reports/exportJobs method: get operationId: listExportJobs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /deviceManagement/reports/exportJobs method: post operationId: createExportJob x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/reports/exportJobs/{deviceManagementExportJobId} method: get operationId: getExportJob x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /deviceManagement/reports/exportJobs/{deviceManagementExportJobId} method: delete operationId: deleteExportJob x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/reports/getDeviceNonComplianceReport method: post operationId: getDeviceNonComplianceReport x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/reports/getCompliancePolicyNonComplianceReport method: post operationId: getCompliancePolicyNonComplianceReport x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/reports/getComplianceSettingNonComplianceReport method: post operationId: getComplianceSettingNonComplianceReport x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/reports/getConfigurationPolicyNonComplianceReport method: post operationId: getConfigurationPolicyNonComplianceReport x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/reports/getHistoricalReport method: post operationId: getHistoricalReport x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deviceManagement/reports/getCachedReport method: post operationId: getCachedReport x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required