Intune device query and Graph API

In this post I will show how works the Graph API when you use the Intune device query.

Context

Microsoft recently implemented the Deice query part in Intune.

It's an awesome feature allowing you to run on-demand query on Intune devices.

See here more information about this feature.

I won't show you in details how to use it because there are already a loooooot of posts about it. 

Run query through the portal

One week ago Microsoft implemented the AWESOME feature allowing you to run a query on demand on a specific device.

You can do this through the Intune portal as below:

1. Go to Intune

2. Search a device

3. Click on the device 

4. Go to Device query

5. Type your query. Here the query is really simple

Process | order by TotalSizeBytes | take 5

6. Click on Run

7. See below result

Do this with MS Graph

When a new feature comes in Intune I always try to look to MS Graph in order to understand how to automate the action.

To do this I always use the developer mode from my browser.

I think every people who want to play with Graph should use this trick.

You can find here a post I did about this.

So now let's use just our browser to understand how to use Graph to get results we want.

For this we will proceed as below:

1. Go to the Intune

2. Type a specific device name

3. Click on the device 

4. Go to Device query

5. Type your query

6. Press F12 to open developer mode

7. Select the Network tab

8. Click on Run

9. Click on the Stop recording button

10. Then you will find two resources called createQuery

11. Click on the first one

12. You will find the URL resource

13. Go to Payload to see the body to pass, as below:

14. The query here is encoded to Base64

15. Open this site to decode it 

16. Type the Base64 code

17. Click on Decode

18. Here we have our query

See below full resource for device query:

deviceManagement/managedDevices('DeviceID')/createQuery

The query itself is sent as below: