Windows Updates API Restructuring: What Entra Admins Need to Know for DeploymentAudience and ApplicableContent Changes

WHAT JUST CHANGED

Effective June 2024, Microsoft has restructured several properties and relationships in the Windows Updates API within the Microsoft Graph Beta endpoint. The following changes are now live for all tenants using Windows Update management via Microsoft Graph:

• deploymentAudience resource: The applicableContent property has been removed and replaced by an applicableContent relationship.
• applicableContent resource: The matchedDevices property has been removed and replaced by a matchedDevices relationship. Also, a new catalogEntryId property has been added.
• applicablecontentdevicematch resource: The device property has been deleted and replaced with a deviceId navigation property.

These changes are currently in Public Preview and affect tenants leveraging Windows Updates orchestration via Graph API, especially those integrating with MDM/Intune or custom update workflows.

WHAT’S NEXT ON THE ROADMAP

Microsoft is rapidly modernizing its update management and device lifecycle APIs. Key upcoming items include:

• Transition of Windows Updates API from Beta to GA: Expected in late 2024, with stricter validation and improved error handling.
• Device lifecycle APIs in Entra: Enhanced automation for device onboarding and offboarding, currently in Public Preview.
• Expanded Graph support for conditional access on device types: Already in preview, with planned GA in Q3/Q4 2024.
• Integration with Microsoft Entra admin center for update reporting: Coming soon, allowing direct visualization and audit of update deployments.

Admins should review their automation scripts and workflows for compatibility, especially if using properties that have been deprecated or replaced.

WHY THIS DIRECTION IS BETTER

• Improved Data Consistency: Moving from properties to relationships (navigation links) aligns with RESTful design and reduces schema ambiguity.
• Scalability: Relationships allow for larger, more complex audiences and content matching—critical for enterprises with thousands of devices.
• Cleaner API Surface: Deleting redundant properties (e.g., device in applicablecontentdevicematch) reduces the risk of desynchronization between object references and navigation links.
• Better Interoperability: The addition of catalogEntryId enables faster cross-referencing with Windows Update Catalog, streamlining reporting and troubleshooting.
• Alignment with Microsoft Entra’s broader device management roadmap: These changes pave the way for advanced update targeting, conditional access, and device compliance workflows in Entra ID.

Compared to competing IdP solutions (e.g., Okta, Google Workspace), these improvements support deeper integration with Windows device ecosystems and enable richer automation scenarios.

Adjacent Entra ID Changes Relevant to Device and Update Management

• Conditional Access for Devices: Microsoft is rolling out device-based CA policies that leverage dynamic device groups and compliance states.
• Intune device lifecycle events in Entra: New preview APIs for device registration, compliance, and retirement.
• PowerShell Entra module enhancements: The Microsoft.Graph module now supports device-based queries for update compliance reporting.

WHAT TO DO: STEP-BY-STEP ADMIN ACTIONS

1. Audit your current API usage: Identify scripts, automations, or integrations that reference deprecated properties.
2. Update scripts to leverage new relationships: Switch any direct property access to navigation relationships in API calls.
3. Review device update reporting logic: Incorporate catalogEntryId for improved traceability and reporting.
4. Test in preview tenants: Validate changes in a non-production environment before rolling out to your main tenant.
5. Monitor for upcoming GA announcements: Subscribe to Entra ID and Windows Updates API release notes for production readiness.

CHECK IT YOURSELF: POWERFUL GRAPH POWERSHELL AUDIT

The following script uses the Microsoft.Graph module to enumerate Windows Updates deployment audiences and applicable content, reporting on deprecated vs. new relationships. It includes error handling and pagination, and is safe for production (dry-run mode only).

# Requires: Microsoft.Graph (>=2.x), Connect-MgGraph with DeviceManagement.Read.All
param(
  [string]$TenantId = "",
  [switch]$WhatIf
)
function Get-WindowsUpdatesDeploymentAudiences {
  try {
    $audiences = Invoke-MgGraphRequest -Method GET -Uri 'https://graph.microsoft.com/beta/admin/windowsUpdates/deploymentAudiences' -ErrorAction Stop
    if ($audiences.value) {
      foreach ($audience in $audiences.value) {
        Write-Output "DeploymentAudience ID: $($audience.id)"
        # Check for new applicableContent relationship
        $applicableContentRelUri = "https://graph.microsoft.com/beta/admin/windowsUpdates/deploymentAudiences/$($audience.id)/applicableContent"
        $applicableContent = Invoke-MgGraphRequest -Method GET -Uri $applicableContentRelUri -ErrorAction Stop
        if ($applicableContent.value) {
          Write-Output " - ApplicableContent relationship present: $($applicableContent.value.count) items"
        } else {
          Write-Output " - ApplicableContent relationship EMPTY"
        }
      }
    } else {
      Write-Warning "No deployment audiences found."
    }
  } catch {
    Write-Error $_
  }
}
function Get-WindowsUpdatesApplicableContent {
  try {
    $contents = Invoke-MgGraphRequest -Method GET -Uri 'https://graph.microsoft.com/beta/admin/windowsUpdates/applicableContent' -ErrorAction Stop
    foreach ($content in $contents.value) {
      Write-Output "ApplicableContent ID: $($content.id)"
      Write-Output " - catalogEntryId: $($content.catalogEntryId)"
      # Check new matchedDevices relationship
      $matchedDevicesUri = "https://graph.microsoft.com/beta/admin/windowsUpdates/applicableContent/$($content.id)/matchedDevices"
      $matchedDevices = Invoke-MgGraphRequest -Method GET -Uri $matchedDevicesUri -ErrorAction Stop
      if ($matchedDevices.value) {
        Write-Output " - MatchedDevices relationship present: $($matchedDevices.value.count) items"
        foreach ($deviceMatch in $matchedDevices.value) {
          Write-Output "   - deviceId: $($deviceMatch.deviceId)"
        }
      } else {
        Write-Output " - MatchedDevices relationship EMPTY"
      }
    }
  } catch {
    Write-Error $_
  }
}
if (-not $WhatIf) {
  Get-WindowsUpdatesDeploymentAudiences
  Get-WindowsUpdatesApplicableContent
} else {
  Write-Output "DRY RUN: No API calls made. Set -WhatIf:$false to query live data."
}

How this helps: You can directly verify whether your tenant has transitioned to the new relationship-based schema, and check for any missing or empty relationships that could indicate broken workflows or reporting gaps.

PORTAL PATH: WHERE TO VERIFY IN ENTRA ADMIN CENTER

• Go to Microsoft Entra admin center → Devices → Windows Update deployment.
• Review Deployment Audiences and Applicable Content sections.
• Look for relationship-based navigation (not property fields) in UI for audience-to-content and device matches.

BOTTOM LINE

Priority: Update all scripts and API integrations to use relationships instead of deprecated properties for Windows Updates management. Start auditing your deployment audiences and applicable content today. Monitor upcoming GA transition and roadmap items for device lifecycle and conditional access. Do not rely on property-based access for update targeting or device match reporting going forward.