Intune policies through JSON (oData) template - azure-active-directory

Question

I am trying to create a JSON template to create the Intune (based on Office 365) policies through Graph api. I am able to create policies for some of the URIs like terms and conditions but others. I tried creating for odata
microsoft.graph.iosEasEmailProfileConfiguration
it failed giving error 400.
i would like to know if it is working for anyone and how

Answer 1

If you get 400 errors in MS Graph API you can crete a case with Azure support.
I haven't tried the one you mention. But I have figured out a couple of them, after banging my head in the wall for some weeks with the poor Microsoft Graph API documentation.
Compliance policies:
POST https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies
{
"#odata.type": "microsoft.graph.androidCompliancePolicy",
"displayName": "Android",
"passwordRequired": true,
"passwordMinimumLength": 4,
"passwordRequiredType": "numericComplex",
"passwordMinutesOfInactivityBeforeLock": 15,
"storageRequireEncryption": true,
"scheduledActionsForRule":[{"ruleName":"Mark device noncompliaant","scheduledActionConfigurations":[{"actionType":"block","gracePeriodHours":72,"notificationTemplateId":""}]}]
}
Device Configuration policies:
POST https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations
{
"#odata.type": "#microsoft.graph.androidGeneralDeviceConfiguration",
"description": "",
"displayName": "Device restriction - Android",
"passwordBlockFingerprintUnlock": false,
"passwordBlockTrustAgents": false,
"passwordExpirationDays": null,
"passwordMinimumLength": 4,
"passwordMinutesOfInactivityBeforeScreenTimeout": 15,
"passwordPreviousPasswordBlockCount": null,
"passwordSignInFailureCountBeforeFactoryReset": 11,
"passwordRequiredType": "numericComplex",
"passwordRequired": true,
"storageRequireDeviceEncryption": true
}
I have also figured out branding, groups, setting MDM authority, setting update ring and adding windows hello settings.
But I cannot figure out how to assign compliance policies to groups.
The examples in the MS Graph API documentation just throws an error.
I also cannot find where in Graph API i can do condidtional access in Intune and how I control device settings in Azure AD.

Answer 2

You can do a POST to deviceManagement/deviceConfigurations with following sample payload:
{
"id": "00000000-0000-0000-0000-000000000000",
"displayName": "profile name",
"description": "profile description",
"scopeTags": [],
"#odata.type": "#microsoft.graph.iosEasEmailProfileConfiguration",
"blockMovingMessagesToOtherEmailAccounts": false,
"blockSendingEmailFromThirdPartyApps": false,
"blockSyncingRecentlyUsedEmailAddresses": false,
"durationOfEmailToSync": "userDefined",
"requireSmime": false,
"requireSsl": true,
"hostName": "outlook.microsoft.com",
"accountName": "Account name",
"usernameSource": "userPrincipalName",
"emailAddressSource": "userPrincipalName",
"authenticationMethod": "usernameAndPassword"
}