Add metadata for deviceManagement/inventoryPolicies and clarify app-only permissions

[Cr0m3]

Summary

The Microsoft Graph beta endpoint POST /deviceManagement/inventoryPolicies is used by the Microsoft Intune admin center for Properties catalog policies, including Windows app inventory. The endpoint does not appear in the published Microsoft Graph metadata or REST API documentation. This makes its supported request schema and authentication requirements impossible to determine.

Calls using an application token consistently return 403 Forbidden, even when the service principal has the relevant effective Microsoft Graph app-role assignments.

Reproduction

POST https://graph.microsoft.com/beta/deviceManagement/inventoryPolicies
Content-Type: application/json
Authorization: Bearer <application-token>

{
  "name": "TEST - Win - Default - App Inventory - v1.0",
  "description": "Application inventory test",
  "platforms": "windows10",
  "technologies": "extensibility",
  "roleScopeTagIds": ["0"],
  "settings": [...]
}

The same authorization failure also occurs for a read request:

GET https://graph.microsoft.com/beta/deviceManagement/inventoryPolicies?$select=id,name

Authentication configuration

The workload uses an Entra service principal authenticated through GitHub Actions workload identity federation. Admin consent and the effective appRoleAssignments were independently verified for these application permissions:

• DeviceManagementConfiguration.ReadWrite.All
• DeviceManagementScripts.ReadWrite.All
• DeviceManagementServiceConfig.ReadWrite.All

The POST was issued by the microsoft/msgraph Terraform provider v0.4.0, but the failure is returned by the Graph/Intune service rather than by the provider. Other Intune operations using the same identity succeed.

Actual result

HTTP 403 Forbidden
error.code: Forbidden
Backend: DeviceConfigV2/DCV2GraphService
Activity ID: 7cb0a62b-bb01-46d2-bf91-4b6facc31354
Request time: 2026-07-27T07:55:24Z

The backend message contains only An error has occurred and does not identify a missing permission or unsupported authentication mode.

Workflow reproduction: https://github.com/Workplace-Foundation/workplace-foundation-7hhtqg/actions/runs/30247477402/job/89918094870

Expected result

One of the following should be available:

1. Add deviceManagement/inventoryPolicies, its settings and assignment operations to the beta metadata and REST API documentation, including supported application/delegated permissions and request schemas.
2. If application authentication is supported, allow the request when the documented app roles are present or return an actionable authorization error.
3. If the endpoint supports delegated authentication only, document that restriction explicitly.

Related operations

The Intune admin center appears to use these operations:

• GET/POST /beta/deviceManagement/inventoryPolicies
• GET/PUT/DELETE /beta/deviceManagement/inventoryPolicies/{id}
• GET /beta/deviceManagement/inventoryPolicies/{id}/settings
• GET /beta/deviceManagement/inventoryPolicies/{id}/assignments
• POST /beta/deviceManagement/inventoryPolicies/{id}/assign

Official Intune documentation describes creating Properties catalog and app inventory policies in the portal, but no corresponding Graph REST documentation or metadata is currently discoverable.