MSGraph deviceManagement/Intents not showing in Endpoint Security when created via POST

Geeves 16 Reputation points
2022-12-20T23:04:47.677+00:00

Hopefully not too much of a complex question this.
When using the API. Creating a new Device Management Intent using POST and the below JSON, the policy will create, and give me an Id via the Graph Explorer. To which it can be assigned to a group and will apply, however this is never visible within Endpoint Manager -> Endpoint Security.

POST https://graph.microsoft.com/beta/deviceManagement/intents/

{
"@odata.type": "#microsoft.graph.deviceManagementIntent",
"displayName": "Bitlocker drive encryption policy.",
"description": "Bitlocker Drive Encryption policy for company owned devices.",
"roleScopeTagIds": [
"0"
],
"settings": [
{
"@odata.type": "#microsoft.graph.deviceManagementBooleanSettingInstance",
"definitionId": "deviceConfiguration--windows10EndpointProtectionConfiguration_bitLockerEncryptDevice",
"valueJson": "true",
"value": true
},
{
"@odata.type": "#microsoft.graph.deviceManagementComplexSettingInstance",
"definitionId": "deviceConfiguration--windows10EndpointProtectionConfiguration_bitLockerFixedDrivePolicy",
"valueJson": "{\"recoveryOptions\":{\"recoveryKeyUsage\":\"allowed\",\"recoveryInformationToStore\":\"passwordAndKey\",\"enableRecoveryInformationSaveToStore\":true,\"recoveryPasswordUsage\":\"required\",\"hideRecoveryOptions\":false,\"enableBitLockerAfterRecoveryInformationToStore\":true,\"blockDataRecoveryAgent\":false},\"requireEncryptionForWriteAccess\":false,\"encryptionMethod\":null}"
},
{
"@odata.type": "#microsoft.graph.deviceManagementBooleanSettingInstance",
"definitionId": "deviceConfiguration--windows10EndpointProtectionConfiguration_bitLockerAllowStandardUserEncryption",
"valueJson": "true",
"value": true
},
{
"@odata.type": "#microsoft.graph.deviceManagementComplexSettingInstance",
"definitionId": "deviceConfiguration--windows10EndpointProtectionConfiguration_bitLockerSystemDrivePolicy",
"valueJson": "{\"startupAuthenticationRequired\":true,\"startupAuthenticationTpmUsage\":\"required\",\"startupAuthenticationTpmPinUsage\":null,\"startupAuthenticationTpmKeyUsage\":\"blocked\",\"startupAuthenticationTpmPinAndKeyUsage\":null,\"startupAuthenticationBlockWithoutTpmChip\":true,\"prebootRecoveryEnableMessageAndUrl\":false,\"prebootRecoveryMessage\":null,\"prebootRecoveryUrl\":null,\"recoveryOptions\":{\"recoveryKeyUsage\":\"notConfigured\",\"recoveryInformationToStore\":\"passwordAndKey\",\"enableRecoveryInformationSaveToStore\":true,\"recoveryPasswordUsage\":\"allowed\",\"hideRecoveryOptions\":true,\"enableBitLockerAfterRecoveryInformationToStore\":true,\"blockDataRecoveryAgent\":false},\"encryptionMethod\":null,\"minimumPinLength\":10}"
},
{
"@odata.type": "#microsoft.graph.deviceManagementBooleanSettingInstance",
"definitionId": "deviceConfiguration--windows10EndpointProtectionConfiguration_bitLockerDisableWarningForOtherDiskEncryption",
"valueJson": "true",
"value": true
},
{
"@odata.type": "#microsoft.graph.deviceManagementComplexSettingInstance",
"definitionId": "deviceConfiguration--windows10EndpointProtectionConfiguration_bitLockerRemovableDrivePolicy",
"valueJson": "{\"encryptionMethod\":null,\"requireEncryptionForWriteAccess\":false,\"blockCrossOrganizationWriteAccess\":false}"
},
{
"@odata.type": "#microsoft.graph.deviceManagementStringSettingInstance",
"definitionId": "deviceConfiguration--windows10EndpointProtectionConfiguration_bitLockerRecoveryPasswordRotation",
"valueJson": "\"enabledForAzureAdAndHybrid\"",
"value": "enabledForAzureAdAndHybrid"
},
{
"@odata.type": "#microsoft.graph.deviceManagementBooleanSettingInstance",
"definitionId": "deviceConfiguration--windows10EndpointProtectionConfiguration_bitLockerEnableStorageCardEncryptionOnMobile",
"valueJson": "false",
"value": false
}
]
}

If you then run a GET on https://graph.microsoft.com/beta/deviceManagement/intents - It will pull the policy.

Has anyone experienced this?

Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
11,226 questions
Microsoft Intune Security
Microsoft Intune Security
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
370 questions
Microsoft Intune
Microsoft Intune
A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.
4,655 questions
{count} votes