Managing Windows Settings at Scale: New Microsoft Graph Permissions and Delete Operations for Cross-Device Experiences

WHAT JUST CHANGED: Expanded Windows Settings Management in Microsoft Graph

Effective Date: June 2024 (Public Preview)

Microsoft has released several enhancements to the windowsSetting and windowsSettingInstance resources in the Microsoft Graph Beta endpoint:

• Delete Operation: You can now delete individual Windows settings via Graph API.
• New Delegated Permissions:
  • UserWindowsSettings.Read.All allows delegated access to get/list user Windows settings and instances.
  • UserWindowsSettings.ReadWrite.All enables delegated access to edit/list settings.
• These capabilities are available for all Entra tenants with Microsoft Graph Beta enabled and are rolling out to tenants globally.

Rollout Status: Public Preview (Beta endpoint)

Affected Tenants: All tenants leveraging Microsoft Graph for device and user settings management, especially those with delegated app permissions (interactive user sessions).

WHAT’S NEXT ON THE ROADMAP

• General Availability: Expect these capabilities to move to v1.0 endpoint later in 2024, requiring admins to update scripts and apps for production use.
• Cross-device Policy Harmonization: Microsoft is signaling deeper integration between Entra ID, Microsoft Endpoint Manager (Intune), and Graph API for unified device settings—watch for more granular device lifecycle and settings controls.
• External ID/B2B/B2C Co-management: With Windows settings increasingly exposed via Graph, expect tighter cross-tenant device policy controls, especially for guest and hybrid users.
• Modern Authentication Method Expansion: Windows Hello, FIDO2, and passwordless settings are expected to surface more as configurable resources—prepare to audit and enforce them using the new permissions.

WHY THIS DIRECTION IS BETTER

• Granular Delegated Access: Prior to this update, admins could only manage settings at a coarse level. Now, delegated permissions allow safe, audit-friendly access for helpdesk and support scenarios without over-provisioning.
• Delete Operation: Previously, cleaning up obsolete settings required manual intervention or full resets. This new delete endpoint enables targeted remediation and lifecycle management on a per-setting basis.
• Unified Device Experience: By surfacing Windows settings in Graph, Microsoft leads over competing IdPs (Okta, Ping) by enabling richer device orchestration, automation, and policy enforcement from a central API.
• Audit and Compliance: These new endpoints allow admins to report, review, and manage settings for compliance (e.g., managed devices, passwordless configuration) and respond to regulatory requirements.
• Adjacent Changes: Recent Entra admin center improvements now surface per-device and per-user settings in a single pane, and Intune integration allows policy assignment directly from Entra workflows.

ADMIN ACTIONS: Step-by-Step

1. Review App Permissions: Ensure your apps (or service principals) request the new delegated permissions (UserWindowsSettings.Read.All and UserWindowsSettings.ReadWrite.All).
2. Enable Microsoft Graph Beta Endpoint: Use only for testing or pilot—production tenants should wait for GA.
3. Audit User Windows Settings: Use Graph PowerShell to enumerate settings across users (see below).
4. Test Delete Operation: Run non-destructive test deletes using -WhatIf in PowerShell to validate workflow.
5. Update Documentation: Document new delegated permission requirements for helpdesk and compliance teams.
6. Prepare for v1.0 Rollout: Track Microsoft roadmap and plan migration of scripts/apps to v1.0 endpoint when GA.

CHECK IT YOURSELF: PowerShell Audit and Validation

These scripts use the Microsoft.Graph module. Ensure you’ve updated to the latest version.

List All User Windows Settings (Paginated, with Error Handling)

# Requires Microsoft.Graph 1.27+ and delegated permissions
Import-Module Microsoft.Graph.Users

function Get-AllUserWindowsSettings {
    [CmdletBinding()]
    param (
        [int]$PageSize = 50
    )
    $users = Get-MgUser -PageSize $PageSize -ConsistencyLevel eventual -CountVariable userCount
    foreach ($user in $users) {
        try {
            $response = Invoke-MgGraphRequest -Method GET -Uri "/beta/users/$($user.Id)/settings/windows" -ErrorAction Stop
            if ($response.value) {
                foreach ($setting in $response.value) {
                    Write-Output "User: $($user.UserPrincipalName) | Setting: $($setting.id) | Name: $($setting.displayName)"
                }
            }
        } catch {
            Write-Warning "Failed to retrieve settings for $($user.UserPrincipalName): $($_.Exception.Message)"
        }
    }
}

Test Delete Operation (Dry Run)

# Dry run: Only outputs intended delete URI, does NOT delete
function Test-DeleteWindowsSetting {
    param (
        [string]$UserId,
        [string]$SettingId
    )
    $uri = "/beta/users/$UserId/settings/windows/$SettingId"
    Write-Output "Would DELETE: $uri (use -WhatIf or remove call for actual delete)"
    # Uncomment below to perform actual delete (for testing only)
    # Invoke-MgGraphRequest -Method DELETE -Uri $uri -WhatIf
}

Portal Path

• Entra Admin Center:
  • Go to Devices > Windows Settings to view per-user device settings.
  • For permissions, navigate to Identity > App registrations > [Your App] > API permissions and add the new delegated permissions.

BOTTOM LINE

1. Update apps and scripts to leverage new delegated permissions for Windows settings management.
2. Begin auditing device settings for user accounts—especially for compliance and hybrid scenarios.
3. Test delete operation with dry runs; do not bulk delete until endpoint is GA.
4. Monitor Microsoft Graph roadmap for v1.0 endpoint release, and plan migration accordingly.
5. Document access and workflow changes for support and compliance teams.

Priority: High for tenants managing large fleets of Windows devices or hybrid users. Early adopters gain improved audit and control capabilities—prepare now for full GA.