From 87fd496ca024f549bdacaa40ca80a443698f7838 Mon Sep 17 00:00:00 2001
From: Marco Wende <marco.wende@wende.it>
Date: Wed, 16 Sep 2026 11:41:10 +0200
Subject: [PATCH] Setup-Skript: DeviceManagementServiceConfig.Read.All bei
 -IncludeDeviceActions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Der Autopilot-Status im Geräte-Detail (Profil-Zuweisung / letzter Kontakt)
braucht DeviceManagementServiceConfig.Read.All. Das Flag -IncludeDeviceActions
fügt den Scope jetzt hinzu (Read/Write und Read-Only). Ist ohnehin Offboarding
aktiv, wird die ReadWrite-Variante bevorzugt und die Read-Variante entfernt.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 docs/Setup-AppRegistration.ps1 | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/docs/Setup-AppRegistration.ps1 b/docs/Setup-AppRegistration.ps1
index f9d2a97..5dcd861 100644
--- a/docs/Setup-AppRegistration.ps1
+++ b/docs/Setup-AppRegistration.ps1
@@ -33,7 +33,9 @@
 
 .PARAMETER IncludeDeviceActions
     Nimmt zusaetzlich die Berechtigungen fuer den Geraete-Tab auf
-    (Read + ReadWrite + PrivilegedOperations = Sync/Reboot/Lock/Wipe/Retire).
+    (Read + ReadWrite + PrivilegedOperations = Sync/Reboot/Lock/Wipe/Retire)
+    sowie DeviceManagementServiceConfig.Read.All fuer den Autopilot-Status
+    im Detail-Panel.
 
 .PARAMETER GrantAdminConsent
     Erteilt direkt tenantweiten Admin-Consent fuer die gesetzten Scopes.
@@ -78,12 +80,16 @@ $perms = if ($ReadOnly) {
       'DeviceManagementApps.ReadWrite.All','DeviceManagementConfiguration.ReadWrite.All','offline_access')
 }
 if ($IncludeDeviceActions) {
+    # DeviceManagementServiceConfig.Read.All: Autopilot-Status im Geraete-Detail
+    # (Profil-Zuweisung / letzter Kontakt) — ansonsten bleibt das Feld leer.
     $perms += if ($ReadOnly) {
-        @('DeviceManagementManagedDevices.Read.All')
+        @('DeviceManagementManagedDevices.Read.All',
+          'DeviceManagementServiceConfig.Read.All')
     } else {
         @('DeviceManagementManagedDevices.Read.All',
           'DeviceManagementManagedDevices.ReadWrite.All',
-          'DeviceManagementManagedDevices.PrivilegedOperations.All')
+          'DeviceManagementManagedDevices.PrivilegedOperations.All',
+          'DeviceManagementServiceConfig.Read.All')
     }
 }
 if ($IncludeOffboarding) {
@@ -99,6 +105,11 @@ if ($IncludeOffboarding) {
     )
 }
 $perms = $perms | Select-Object -Unique
+# ServiceConfig: ReadWrite (Offboarding) schliesst Read (Autopilot-Anzeige) ein
+# -> die Read-Variante nicht zusaetzlich anfordern.
+if ($perms -contains 'DeviceManagementServiceConfig.ReadWrite.All') {
+    $perms = @($perms | Where-Object { $_ -ne 'DeviceManagementServiceConfig.Read.All' })
+}
 
 # --- Verbinden ----------------------------------------------------------------
 Write-Host "[1/6] Mit Microsoft Graph verbinden (Admin noetig)..." -ForegroundColor Cyan