Question

You are building an unattended PowerShell script that runs nightly on a server to export all managed device compliance states from Intune via the Microsoft Graph API. The script must run without any interactive sign-in. You register an application in Microsoft Entra ID and need to configure the correct permission type so the script can read device data. Which permission configuration should you use?

Accepted Answer

Grant the DeviceManagementManagedDevices.Read.All application permission with admin consent and authenticate using a client secret or certificate

Answer

Grant the DeviceManagementManagedDevices.Read.All delegated permission and sign in interactively the first time to cache a refresh token

Answer

Add the app to the Intune Administrator role and authenticate with the signed-in user's credentials

Answer

Grant the User.Read delegated permission and rely on the device's Primary Refresh Token for silent authentication