Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Namespace: microsoft.graph
Important
APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.
Provision a device on behalf of an approved Virtual Desktop Infrastructure (VDI) provider.
This action wraps the Zero Touch Deployment (ZTD) protocol to create a device in a pending state in the customer's directory. The device can't be used for authentication until it completes its registration. The created device is stamped with a system label that identifies the approved VDI provider.
Only VDI applications on Microsoft's approved list of VDI providers can successfully call this action. Calls from other applications are blocked even when the application is granted the required permission.
Permissions
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.
| Permission type | Least privileged permissions | Higher privileged permissions |
|---|---|---|
| Delegated (work or school account) | Device.ProvisionForVDI | Not available. |
| Delegated (personal Microsoft account) | Not supported. | Not supported. |
| Application | Not supported. | Not supported. |
Important
For delegated access using work or school accounts, the signed-in user must be assigned a supported Microsoft Entra role or a custom role that grants the permissions required for this operation. Cloud Device Administrator is the least privileged role supported for this operation.
In addition to the permission, the calling application must be on Microsoft's approved list of VDI providers.
HTTP request
POST /devices/provision
Request headers
| Name | Description |
|---|---|
| Authorization | Bearer {token}. Required. Learn more about authentication and authorization. |
| Content-Type | application/json. Required. |
Request body
In the request body, supply a JSON representation of the parameters.
The following table shows the parameters that you can use with this action.
| Parameter | Type | Description |
|---|---|---|
| provisioningBlob | String | An opaque blob, generated by the Microsoft Entra device identity runtime library and shared with approved VDI providers, that contains the information required to provision the device. Required. |
Response
If successful, this action returns a 201 Created response code and a provisionResponse in the response body. The response also includes a Location header that contains the URI of the created device object.
Examples
Request
The following example shows a request.
POST https://graph.microsoft.com/beta/devices/provision
Content-Type: application/json
{
"provisioningBlob": "eyJ2ZXIiOiIxLjAiLCJub25jZSI6IjJkZjg1ZTdmYTk0ZjQ3In0"
}
Response
The following example shows the response.
Note: The response object shown here might be shortened for readability.
HTTP/1.1 201 Created
Content-Type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#microsoft.graph.provisionResponse",
"challenge": "Y2hhbGxlbmdlVmFsdWVFeGFtcGxl",
"deviceId": "2ec25e3b-9243-4f3c-8c83-2e2a9b8a4f1a"
}