WindowsUpdates.ReadWrite.All
DeviceManagementManagedDevices.Read.All
— application permissions, granted to the app registration with admin consent.
Licence: Windows Enterprise E3/E5 (or equivalent) for the Windows Update deployment service.
Endpoints:
GET /beta/admin/windows/updates/catalog/entries (quality updates) · GET /beta/admin/windows/updates/products/FindByCatalogId(catalogID='...')?$expand=knownIssues
The Windows Updates API defines no read-only permission - WindowsUpdates.ReadWrite.All also allows managing update deployments. This report only reads. Products are discovered from the three newest quality updates.
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Windows Known Issues Affecting Our Builds
Microsoft's Windows release-health known issues (the ones behind update safeguard holds), matched to the Windows versions running in your fleet. An active issue on a version you run explains helpdesk calls after Patch Tuesday before anyone has to troubleshoot.
No known issues were returned for the current Windows releases.