From 2c3ba6c57d2500c0ee62a750f7b32065c4ad9e54 Mon Sep 17 00:00:00 2001
From: Egor Sidorenko <esidorenko@getnerdio.com>
Date: Wed, 26 Aug 2026 15:10:45 +0500
Subject: [PATCH 1/3] Add FilterRestrictions annotation to managedDevice

The entity description says filtering is only supported on a subset of
properties, but there was no FilterRestrictions annotation, so the
metadata advertised the whole collection as filterable.

Lists the 35 properties that are not filterable in either v1.0 or beta.
The two that are filterable in beta only, deviceType and ownerType, are
left out so the same annotation stays correct for both versions.
---
 transforms/csdl/preprocess_csdl.xsl           | 69 +++++++++++++++++++
 .../csdl/preprocess_csdl_test_input.xml       |  3 +
 .../csdl/preprocess_csdl_test_output.xml      | 47 +++++++++++++
 3 files changed, 119 insertions(+)

diff --git a/transforms/csdl/preprocess_csdl.xsl b/transforms/csdl/preprocess_csdl.xsl
index d44fe2c93..88ca4776c 100644
--- a/transforms/csdl/preprocess_csdl.xsl
+++ b/transforms/csdl/preprocess_csdl.xsl
@@ -1400,6 +1400,57 @@
             </xsl:element>
         </xsl:element>
     </xsl:template>
+    <xsl:template name="ManagedDeviceFilterRestrictionsTemplate">
+        <xsl:element name="Annotation">
+            <xsl:attribute name="Term">Org.OData.Capabilities.V1.FilterRestrictions</xsl:attribute>
+            <xsl:element name="Record" namespace="{namespace-uri()}">
+                <xsl:element name="PropertyValue">
+                    <xsl:attribute name="Property">Filterable</xsl:attribute>
+                    <xsl:attribute name="Bool">true</xsl:attribute>
+                </xsl:element>
+                <xsl:element name="PropertyValue">
+                    <xsl:attribute name="Property">NonFilterableProperties</xsl:attribute>
+                    <xsl:element name="Collection">
+                        <xsl:element name="PropertyPath">activationLockBypassCode</xsl:element>
+                        <xsl:element name="PropertyPath">androidSecurityPatchLevel</xsl:element>
+                        <xsl:element name="PropertyPath">azureADRegistered</xsl:element>
+                        <xsl:element name="PropertyPath">configurationManagerClientEnabledFeatures</xsl:element>
+                        <xsl:element name="PropertyPath">deviceActionResults</xsl:element>
+                        <xsl:element name="PropertyPath">deviceEnrollmentType</xsl:element>
+                        <xsl:element name="PropertyPath">deviceHealthAttestationState</xsl:element>
+                        <xsl:element name="PropertyPath">deviceRegistrationState</xsl:element>
+                        <xsl:element name="PropertyPath">easActivated</xsl:element>
+                        <xsl:element name="PropertyPath">easActivationDateTime</xsl:element>
+                        <xsl:element name="PropertyPath">easDeviceId</xsl:element>
+                        <xsl:element name="PropertyPath">enrollmentProfileName</xsl:element>
+                        <xsl:element name="PropertyPath">ethernetMacAddress</xsl:element>
+                        <xsl:element name="PropertyPath">exchangeAccessStateReason</xsl:element>
+                        <xsl:element name="PropertyPath">exchangeLastSuccessfulSyncDateTime</xsl:element>
+                        <xsl:element name="PropertyPath">freeStorageSpaceInBytes</xsl:element>
+                        <xsl:element name="PropertyPath">iccid</xsl:element>
+                        <xsl:element name="PropertyPath">isEncrypted</xsl:element>
+                        <xsl:element name="PropertyPath">isSupervised</xsl:element>
+                        <xsl:element name="PropertyPath">managedDeviceName</xsl:element>
+                        <xsl:element name="PropertyPath">managedDeviceOwnerType</xsl:element>
+                        <xsl:element name="PropertyPath">managementCertificateExpirationDate</xsl:element>
+                        <xsl:element name="PropertyPath">meid</xsl:element>
+                        <xsl:element name="PropertyPath">notes</xsl:element>
+                        <xsl:element name="PropertyPath">partnerReportedThreatState</xsl:element>
+                        <xsl:element name="PropertyPath">physicalMemoryInBytes</xsl:element>
+                        <xsl:element name="PropertyPath">remoteAssistanceSessionErrorDetails</xsl:element>
+                        <xsl:element name="PropertyPath">remoteAssistanceSessionUrl</xsl:element>
+                        <xsl:element name="PropertyPath">requireUserEnrollmentApproval</xsl:element>
+                        <xsl:element name="PropertyPath">subscriberCarrier</xsl:element>
+                        <xsl:element name="PropertyPath">totalStorageSpaceInBytes</xsl:element>
+                        <xsl:element name="PropertyPath">udid</xsl:element>
+                        <xsl:element name="PropertyPath">userDisplayName</xsl:element>
+                        <xsl:element name="PropertyPath">userId</xsl:element>
+                        <xsl:element name="PropertyPath">wiFiMacAddress</xsl:element>
+                    </xsl:element>
+                </xsl:element>
+            </xsl:element>
+        </xsl:element>
+    </xsl:template>
     <xsl:template name="ExpandRestrictionsTemplate">
         <xsl:param name = "expandable" />
             <xsl:attribute name="Term">Org.OData.Capabilities.V1.ExpandRestrictions</xsl:attribute>
@@ -1792,6 +1843,16 @@
                 </xsl:when>
             </xsl:choose>
 
+            <!-- Add FilterRestrictions to managedDevice entity type -->
+            <xsl:choose>
+                <xsl:when test="not(edm:Annotations[@Target='microsoft.graph.managedDevice'])">
+                    <xsl:element name="Annotations">
+                       <xsl:attribute name="Target">microsoft.graph.managedDevice</xsl:attribute>
+                       <xsl:call-template name="ManagedDeviceFilterRestrictionsTemplate"/>
+                    </xsl:element>
+                </xsl:when>
+            </xsl:choose>
+
             <!-- Remove Updatability for organization/certificateBasedAuthConfiguration containment navigation property -->
             <xsl:choose>
                 <xsl:when test="not(edm:Annotations[@Target='microsoft.graph.organization/certificateBasedAuthConfiguration'])">
@@ -2185,6 +2246,14 @@
        </xsl:copy>
     </xsl:template>
 
+    <!-- Add FilterRestrictions to managedDevice entity type -->
+     <xsl:template match="edm:Schema[@Namespace='microsoft.graph']/edm:Annotations[@Target='microsoft.graph.managedDevice']">
+       <xsl:copy>
+         <xsl:copy-of select="@*|node()"/>
+         <xsl:call-template name="ManagedDeviceFilterRestrictionsTemplate"/>
+       </xsl:copy>
+    </xsl:template>
+
     <!-- Add ExpandRestrictions to events,mailfolders and messages entity type -->
     <xsl:template match="edm:Schema[@Namespace='microsoft.graph']/edm:Annotations[@Target='microsoft.graph.user/events']/edm:Annotation[@Term='Org.OData.Capabilities.V1.ExpandRestrictions']|
                         edm:Schema[@Namespace='microsoft.graph']/edm:Annotations[@Target='microsoft.graph.group/events']/edm:Annotation[@Term='Org.OData.Capabilities.V1.ExpandRestrictions']|
diff --git a/transforms/csdl/preprocess_csdl_test_input.xml b/transforms/csdl/preprocess_csdl_test_input.xml
index 524bea0c5..2368ebaa4 100644
--- a/transforms/csdl/preprocess_csdl_test_input.xml
+++ b/transforms/csdl/preprocess_csdl_test_input.xml
@@ -276,6 +276,9 @@
                     </Record>
                 </Annotation>
             </Annotations>
+            <Annotations Target="microsoft.graph.managedDevice">
+                <Annotation Term="Org.OData.Core.V1.Description" String="Devices that are managed or pre-enrolled through Intune. Limited support for $filter: Only properties whose descriptions mention support for $filter may be used, and combinations of those filtered properties must use 'and', not 'or'." />
+            </Annotations>
             <Annotations Target="microsoft.graph.managedDevice/users">
                 <Annotation Term="Org.OData.Capabilities.V1.ChangeTracking">
                     <Record>
diff --git a/transforms/csdl/preprocess_csdl_test_output.xml b/transforms/csdl/preprocess_csdl_test_output.xml
index 1a0265333..f55f7f55f 100644
--- a/transforms/csdl/preprocess_csdl_test_output.xml
+++ b/transforms/csdl/preprocess_csdl_test_output.xml
@@ -934,6 +934,53 @@
           </Record>
         </Annotation>
       </Annotations>
+      <Annotations Target="microsoft.graph.managedDevice">
+        <Annotation Term="Org.OData.Core.V1.Description" String="Devices that are managed or pre-enrolled through Intune. Limited support for $filter: Only properties whose descriptions mention support for $filter may be used, and combinations of those filtered properties must use 'and', not 'or'." />
+        <Annotation Term="Org.OData.Capabilities.V1.FilterRestrictions">
+          <Record>
+            <PropertyValue Property="Filterable" Bool="true" />
+            <PropertyValue Property="NonFilterableProperties">
+              <Collection>
+                <PropertyPath>activationLockBypassCode</PropertyPath>
+                <PropertyPath>androidSecurityPatchLevel</PropertyPath>
+                <PropertyPath>azureADRegistered</PropertyPath>
+                <PropertyPath>configurationManagerClientEnabledFeatures</PropertyPath>
+                <PropertyPath>deviceActionResults</PropertyPath>
+                <PropertyPath>deviceEnrollmentType</PropertyPath>
+                <PropertyPath>deviceHealthAttestationState</PropertyPath>
+                <PropertyPath>deviceRegistrationState</PropertyPath>
+                <PropertyPath>easActivated</PropertyPath>
+                <PropertyPath>easActivationDateTime</PropertyPath>
+                <PropertyPath>easDeviceId</PropertyPath>
+                <PropertyPath>enrollmentProfileName</PropertyPath>
+                <PropertyPath>ethernetMacAddress</PropertyPath>
+                <PropertyPath>exchangeAccessStateReason</PropertyPath>
+                <PropertyPath>exchangeLastSuccessfulSyncDateTime</PropertyPath>
+                <PropertyPath>freeStorageSpaceInBytes</PropertyPath>
+                <PropertyPath>iccid</PropertyPath>
+                <PropertyPath>isEncrypted</PropertyPath>
+                <PropertyPath>isSupervised</PropertyPath>
+                <PropertyPath>managedDeviceName</PropertyPath>
+                <PropertyPath>managedDeviceOwnerType</PropertyPath>
+                <PropertyPath>managementCertificateExpirationDate</PropertyPath>
+                <PropertyPath>meid</PropertyPath>
+                <PropertyPath>notes</PropertyPath>
+                <PropertyPath>partnerReportedThreatState</PropertyPath>
+                <PropertyPath>physicalMemoryInBytes</PropertyPath>
+                <PropertyPath>remoteAssistanceSessionErrorDetails</PropertyPath>
+                <PropertyPath>remoteAssistanceSessionUrl</PropertyPath>
+                <PropertyPath>requireUserEnrollmentApproval</PropertyPath>
+                <PropertyPath>subscriberCarrier</PropertyPath>
+                <PropertyPath>totalStorageSpaceInBytes</PropertyPath>
+                <PropertyPath>udid</PropertyPath>
+                <PropertyPath>userDisplayName</PropertyPath>
+                <PropertyPath>userId</PropertyPath>
+                <PropertyPath>wiFiMacAddress</PropertyPath>
+              </Collection>
+            </PropertyValue>
+          </Record>
+        </Annotation>
+      </Annotations>
       <Annotations Target="microsoft.graph.managedDevice/users">
         <Annotation Term="Org.OData.Capabilities.V1.ChangeTracking">
           <Record>

From 298e34aa598254b872dbc41c9347df8c0c03b1b2 Mon Sep 17 00:00:00 2001
From: Egor Sidorenko <esidorenko@getnerdio.com>
Date: Thu, 27 Aug 2026 15:08:58 +0500
Subject: [PATCH 2/3] Skip the managedDevice FilterRestrictions transform when
 the annotation already exists

---
 transforms/csdl/preprocess_csdl.xsl | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/transforms/csdl/preprocess_csdl.xsl b/transforms/csdl/preprocess_csdl.xsl
index 88ca4776c..0d0ddaa1e 100644
--- a/transforms/csdl/preprocess_csdl.xsl
+++ b/transforms/csdl/preprocess_csdl.xsl
@@ -2247,10 +2247,13 @@
     </xsl:template>
 
     <!-- Add FilterRestrictions to managedDevice entity type -->
+    <!-- Skip if the annotation is already present, so upstream metadata gaining it does not produce a duplicate -->
      <xsl:template match="edm:Schema[@Namespace='microsoft.graph']/edm:Annotations[@Target='microsoft.graph.managedDevice']">
        <xsl:copy>
          <xsl:copy-of select="@*|node()"/>
-         <xsl:call-template name="ManagedDeviceFilterRestrictionsTemplate"/>
+         <xsl:if test="not(edm:Annotation[@Term='Org.OData.Capabilities.V1.FilterRestrictions'])">
+           <xsl:call-template name="ManagedDeviceFilterRestrictionsTemplate"/>
+         </xsl:if>
        </xsl:copy>
     </xsl:template>
 

From 939bab8c415e20517f0349d0fc45b3e8045a7d06 Mon Sep 17 00:00:00 2001
From: Egor Sidorenko <esidorenko@getnerdio.com>
Date: Thu, 27 Aug 2026 19:58:10 +0500
Subject: [PATCH 3/3] Add id to managedDevice NonFilterableProperties

The service rejects $filter=id eq '<value>' against managedDevice with
HTTP 400 "Unsupported parameter found in query", the same failure
cited in #1193, so id belongs in the NonFilterableProperties list this
PR adds even though managedDevice inherits id from entity rather than
declaring it itself. microsoft.graph.security.intelligenceProfile,
also BaseType="graph.entity", already lists its inherited id the same
way in this schema, and the OData spec's own-properties restriction
only applies to RequiredProperties, not NonFilterableProperties.
---
 transforms/csdl/preprocess_csdl.xsl             | 1 +
 transforms/csdl/preprocess_csdl_test_output.xml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/transforms/csdl/preprocess_csdl.xsl b/transforms/csdl/preprocess_csdl.xsl
index 0d0ddaa1e..b6b282769 100644
--- a/transforms/csdl/preprocess_csdl.xsl
+++ b/transforms/csdl/preprocess_csdl.xsl
@@ -1428,6 +1428,7 @@
                         <xsl:element name="PropertyPath">exchangeLastSuccessfulSyncDateTime</xsl:element>
                         <xsl:element name="PropertyPath">freeStorageSpaceInBytes</xsl:element>
                         <xsl:element name="PropertyPath">iccid</xsl:element>
+                        <xsl:element name="PropertyPath">id</xsl:element>
                         <xsl:element name="PropertyPath">isEncrypted</xsl:element>
                         <xsl:element name="PropertyPath">isSupervised</xsl:element>
                         <xsl:element name="PropertyPath">managedDeviceName</xsl:element>
diff --git a/transforms/csdl/preprocess_csdl_test_output.xml b/transforms/csdl/preprocess_csdl_test_output.xml
index f55f7f55f..f12198e14 100644
--- a/transforms/csdl/preprocess_csdl_test_output.xml
+++ b/transforms/csdl/preprocess_csdl_test_output.xml
@@ -958,6 +958,7 @@
                 <PropertyPath>exchangeLastSuccessfulSyncDateTime</PropertyPath>
                 <PropertyPath>freeStorageSpaceInBytes</PropertyPath>
                 <PropertyPath>iccid</PropertyPath>
+                <PropertyPath>id</PropertyPath>
                 <PropertyPath>isEncrypted</PropertyPath>
                 <PropertyPath>isSupervised</PropertyPath>
                 <PropertyPath>managedDeviceName</PropertyPath>