Intune Data Warehouse API endpoint

Article
12/04/2023

You can use the Intune Data Warehouse API with an account with specific role-based access controls and Microsoft Entra credentials. You will then authorize your REST client with Microsoft Entra ID using OAuth 2.0. And finally, you will form a meaningful URL to call a data warehouse resource.

Microsoft Entra ID and Intune credential requirements

Authentication and authorization are based on Microsoft Entra credentials and Intune role-based access control (RBAC). All global administrators and Intune service administrators for your tenant have access to the Data warehouse by default. Use Intune roles to provide access for more users by giving them access to the Intune data warehouse resource.

Requirements for accessing the Intune Data Warehouse (including the API) are:

User must be one of:
- Microsoft Entra Global Administrator
- An Intune service administrator
- User with role-based access to Intune data warehouse resource
- User-less authentication using application-only authentication

Important

To be assigned an Intune role and access the Intune Data Warehouse, the user must have an Intune license. For more information, see Role-based access control (RBAC) with Microsoft Intune and Microsoft Intune licensing.

Authorization

Microsoft Entra ID uses OAuth 2.0 to enable you to authorize access to web applications and web APIs in your Microsoft Entra tenant. This guide is language independent, and describes how to send and receive HTTP messages without using any open-source libraries. The OAuth 2.0 authorization code flow is described in section 4.1 of the OAuth 2.0 specification.

For more information, see Authorize access to web applications using OAuth 2.0 and Microsoft Entra ID.

API URL structure

The Data Warehouse API endpoints read the entities for each set. The API supports a GET HTTP verb, and a subset of query options.

The URL for Intune uses the following format:
https://fef.{location}.manage.microsoft.com/ReportingService/DataWarehouseFEService/{entity-collection}?api-version={api-version}

Note

In the above URL, replace {location}, {entity-collection}, and {api-version} based on the details provided in the table below.

The URL contains the following elements:

Element	Example	Description
location	msua06	The base URL can be found by viewing the Data Warehouse API blade in the Microsoft Intune admin center.
entity-collection	devicePropertyHistories	The name of the OData entity collection. For more information on collections and entities in the data model, see Data Model.
api-version	beta	Version is the version of the API to access. For more information, see Version.
maxhistorydays	7	(Optional) The maximum number of days of history to retrieve. This parameter can be supplied to any collection, but will only take effect for collections that include `dateKey` as a part of their key property. See DateKey Range Filters for more information.

API version information

You can now use the v1.0 version of the Intune Data Warehouse by setting the query parameter api-version=v1.0. Updates to collections in the Data Warehouse are additive in nature and do not break existing scenarios.

You can try out the latest functionality of the Data Warehouse by using the beta version. To use the beta version, your URL must contain the query parameter api-version=beta. The beta version offers features before they are made generally available as a supported service. As Intune adds new features, the beta version may change behavior and data contracts. Any custom code or reporting tools dependent on the beta version may break with ongoing updates.

OData query options

The current version supports the following OData query parameters: $filter, $select, $skip, and $top. In $filter, only DateKey or RowLastModifiedDateTimeUTC may be supported when the columns are applicable, and other properties would trigger a bad request.

DateKey Range Filters

DateKey range filters may be used to limit the amount of data to download for some of the collections with dateKey as a key property. The DateKey filter can be used to optimize service performance by providing the following $filter query parameter:

DateKey alone in the $filter, supporting the lt/le/eq/ge/gt operators and joining with the logic operator and, where they can be mapped to a begin date and/or end date.
maxhistorydays is supplied as custom query option.

Filter examples