Category: Integrations

Using Microsoft Graph for IT Asset Tracking

For organisations invested in the Microsoft ecosystem, Microsoft Graph is the single most valuable API for asset tracking. It exposes data from Intune, Entra ID, and Microsoft 365 through one consistent endpoint, giving you a real-time view of devices, users, applications, and compliance state without deploying additional agents. This article explains what Microsoft Graph is, which endpoints matter for asset management, and how to authenticate and query it in practice.

What is Microsoft Graph?

Microsoft Graph is the unified REST API gateway for Microsoft 365 services. Rather than maintaining separate APIs for Intune, Entra ID, Exchange, Teams, and SharePoint, Microsoft Graph consolidates them behind a single endpoint (`https://graph.microsoft.com`). A single OAuth2 access token can authorise calls across multiple services, and the data model links entities together – a device is connected to its registered user, its applied policies, and its installed applications.

For asset tracking, this is significant. It means you can answer questions like “who owns this laptop”, “is this device compliant”, and “what applications are assigned to this user” without joining data from multiple disconnected systems. The relationships are already modelled in the graph.

Relevant Endpoints for Asset Tracking

### Devices

The `/devices` endpoint returns all devices registered in Entra ID. Each device object includes hardware identifiers (device ID, deviceInstanceId), operating system details (operatingSystem, operatingSystemVersion), display name, registration state, and the approximate last sign-in time.

“`http GET https://graph.microsoft.com/v1.0/devices “`

For Intune-managed devices, the `/deviceManagement/managedDevices` endpoint provides richer detail, including compliance state, enrolment type, manufacturer, model, serial number, and the user assigned to the device.

“`http GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices “`

### Users

The `/users` endpoint returns all user objects in Entra ID. Each user has a unique ID, display name, user principal name, job title, department, and usage location. For asset tracking, this lets you tie devices and licences to real people rather than opaque identifiers.

“`http GET https://graph.microsoft.com/v1.0/users?$select=id,displayName,userPrincipalName,jobTitle,department “`

The relationship between users and devices is queryable in both directions. To find all devices registered to a specific user:

“`http GET https://graph.microsoft.com/v1.0/users/{id}/registeredDevices “`

### Applications and Licences

Software asset management depends on knowing which applications and service plans are assigned to each user. Microsoft Graph exposes this through several endpoints:

• `/users/{id}/ownedDevices` – devices a user owns
• `/users/{id}/assignedLicenses` – Microsoft 365 licence assignments
• `/subscribedSkus` – tenant-level licence inventory and consumption

The `/subscribedSkus` endpoint is particularly useful for licence optimisation, as it reports both the number of licences purchased and the number currently enabled for each service plan.

“`http GET https://graph.microsoft.com/v1.0/subscribedSkus “`

### Device Compliance

For organisations subject to compliance frameworks, device compliance state is critical. The `/deviceManagement/managedDevices/{id}` response includes a `complianceState` property with values such as `compliant`, `noncompliant`, and `unknown`. You can also query compliance directly:

“`http GET https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicySettingStateSummaries “`

This returns aggregated compliance status across policies, useful for reporting dashboards and audit evidence.

Authentication

Microsoft Graph uses OAuth2 with Azure AD (Entra ID). For automated asset tracking, the recommended approach is to register an application in Entra ID and grant it application permissions, then authenticate using the client credentials flow.

The flow is straightforward:

1. Register an application in the Entra ID portal and note the application (client) ID and tenant ID. 2. Create a client secret or, preferably, a certificate for authentication. 3. Grant the application the required permissions, such as `Device.Read.All`, `User.Read.All`, and `DeviceManagementManagedDevices.Read.All`. 4. Request a token from the token endpoint:

“`http POST https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token Content-Type: application/x-www-form-urlencoded

client_id={clientId} &scope=https://graph.microsoft.com/.default &client_secret={clientSecret} &grant_type=client_credentials “`

5. Use the returned access token in the Authorization header of subsequent Graph calls:

“`http GET https://graph.microsoft.com/v1.0/devices Authorization: Bearer {accessToken} “`

Application permissions run without a signed-in user, which is ideal for scheduled polling. Always follow the principle of least privilege – grant only the read permissions your tracking workload requires.

Common Queries

### Find all non-compliant devices

“`http GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?$filter=complianceState eq ‘noncompliant’ “`

### List devices not seen recently

Stale devices are a common source of asset register inaccuracy. The `lastSyncDateTime` property on managed devices indicates the last time the device checked in with Intune:

“`http GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?$filter=lastSyncDateTime lt 2026-07-01T00:00:00Z&$select=deviceName,lastSyncDateTime,userDisplayName “`

### Identify unused licences

Combining `/subscribedSkus` (total purchased) with `/users/{id}/assignedLicenses` (consumed) lets you calculate how many licences are unassigned and therefore potentially reclaimable.

Pagination and Rate Limits

Microsoft Graph returns large result sets in pages. Most collection endpoints return 100 or 1000 items per page with a `@odata.nextLink` URL pointing to the next page. Your polling code must follow these links until the collection is exhausted.

Graph enforces per-application and per-tenant throttling limits. For typical asset tracking workloads – polling device and user lists every few hours – these limits are unlikely to be a problem. If you are pulling large volumes, add small delays between pages and implement exponential backoff when you receive HTTP 429 responses.

Practical Considerations

Not every device in your estate will appear in Microsoft Graph. Devices managed purely by a third-party MDM, on-premises servers not joined to Entra ID, and cloud instances in non-Microsoft providers will not be represented. Microsoft Graph is most powerful as one source within a multi-source asset discovery strategy, combined with EDR, cloud provider, and other MDM APIs.

Despite this, for any organisation standardised on Microsoft 365, Graph is the natural starting point. It covers the majority of endpoints, users, and licences in a single, well-documented API, and the data it returns is authoritative – it reflects exactly what Microsoft’s management platforms believe to be true. That makes it an ideal foundation for an automated, continuously updated asset register.