Troubleshoot the upload as a pipeline.

Understand the two-stage outcome

The Microsoft Graph create operation and the downstream Autopilot import are related but not identical outcomes. A successful create request returns HTTP 201 and an imported device object. That confirms Graph accepted the object. The object’s state then reports the import status and any device-directory error information.

This distinction prevents a common troubleshooting mistake: treating the initial 201 as proof that the device is fully registered, or treating a later import failure as if the HTTP request itself never succeeded.

1. Verify the tenant and Intune prerequisite

The Intune Microsoft Graph API requires an active Intune license for the tenant. Confirm that the account or application is operating in the customer tenant you intend—not merely a tenant in which the operator can authenticate. Record the tenant ID alongside the upload batch so later evidence does not depend on memory.

If your workflow uses delegated authentication, confirm the signed-in work or school account and the administrative role needed for the operation. Personal Microsoft accounts are not supported for this API.

2. Verify the permission actually present in the token

The documented least-to-most permission for creating imported Autopilot device identities is DeviceManagementServiceConfig.ReadWrite.All for either delegated work/school or application access. The configured app registration, the consent grant, the token claims, and the Intune role context must align. Seeing the permission on an app-registration screen is not enough if consent was not granted or the current token predates the grant.

For an HTTP 403 response, check all four layers: tenant licensing, configured permission, consent, and operator/application authorization. Capture the Graph error body and request ID before requesting a new token or changing permissions.

3. Validate the endpoint and payload

POST https://graph.microsoft.com/v1.0/deviceManagement/importedWindowsAutopilotDeviceIdentities
Authorization: Bearer {token}
Content-Type: application/json

The payload represents an importedWindowsAutopilotDeviceIdentity. Operationally important fields include the serial number, hardware identifier, group tag, assigned-user UPN, and import state. The hardware identifier is binary data represented in JSON as a base64 string. Do not pass the CSV row, a file path, or a truncated display value in its place.

Before sending a batch, validate:

• The serial number and hardware identifier came from the same source record.
• The hardware identifier decodes as base64 without modification.
• The group tag and assigned user belong to the target tenant.
• JSON serialization did not insert line breaks or escape the value incorrectly.
• Logs redact tokens and sensitive device data while retaining request IDs and timestamps.

4. Read the imported-device state

After a successful POST, retain the returned object ID and inspect the imported identity. Microsoft exposes deviceImportStatus, deviceRegistrationId, deviceErrorCode, and deviceErrorName through the state object. Those fields tell you whether the downstream import is pending, completed, or failed.

A reliable tool should distinguish “request accepted,” “import pending,” “import completed,” and “import failed.” Avoid an endless tight polling loop. Use a bounded wait, show the current state to the operator, and preserve enough evidence to resume the check.

5. Handle HTTP failures by category

6. Make retries safe

Microsoft recommends honoring the Retry-After response header for 429 responses. If that header is absent, use exponential backoff. Never retry every failure automatically: a 400 caused by a damaged payload will remain a 400, and repeated create attempts can make reconciliation harder when the original request actually succeeded but the client lost the response.

Before retrying a create after an ambiguous network failure, query the imported-device collection or your recorded operation state. Use a stable correlation value in your own job log and reconcile by serial number, batch, and time window.

Minimum evidence for support or escalation

• UTC timestamp and target tenant ID.
• HTTP method and endpoint.
• HTTP status, Graph error code, request ID, and client request ID.
• Sanitized payload shape and source CSV identifier.
• Returned imported-device object ID, if created.
• Import status, device error code, and device error name.
• Serial number and proof of ownership when another-tenant assignment is suspected.

Authoritative sources

• Microsoft Graph: Create importedWindowsAutopilotDeviceIdentity
• Microsoft Graph: Imported Autopilot device state
• Microsoft Intune: Configure Microsoft Graph access
• Microsoft Graph throttling guidance