From 2c3ba6c57d2500c0ee62a750f7b32065c4ad9e54 Mon Sep 17 00:00:00 2001
From: Egor Sidorenko <esidorenko@getnerdio.com>
Date: Wed, 26 Aug 2026 15:10:45 +0500
Subject: [PATCH] Add FilterRestrictions annotation to managedDevice

The entity description says filtering is only supported on a subset of
properties, but there was no FilterRestrictions annotation, so the
metadata advertised the whole collection as filterable.

Lists the 35 properties that are not filterable in either v1.0 or beta.
The two that are filterable in beta only, deviceType and ownerType, are
left out so the same annotation stays correct for both versions.
---
 transforms/csdl/preprocess_csdl.xsl           | 69 +++++++++++++++++++
 .../csdl/preprocess_csdl_test_input.xml       |  3 +
 .../csdl/preprocess_csdl_test_output.xml      | 47 +++++++++++++
 3 files changed, 119 insertions(+)

diff --git a/transforms/csdl/preprocess_csdl.xsl b/transforms/csdl/preprocess_csdl.xsl
index d44fe2c93..88ca4776c 100644
--- a/transforms/csdl/preprocess_csdl.xsl
+++ b/transforms/csdl/preprocess_csdl.xsl
@@ -1400,6 +1400,57 @@
             </xsl:element>
         </xsl:element>
     </xsl:template>
+    <xsl:template name="ManagedDeviceFilterRestrictionsTemplate">
+        <xsl:element name="Annotation">
+            <xsl:attribute name="Term">Org.OData.Capabilities.V1.FilterRestrictions</xsl:attribute>
+            <xsl:element name="Record" namespace="{namespace-uri()}">
+                <xsl:element name="PropertyValue">
+                    <xsl:attribute name="Property">Filterable</xsl:attribute>
+                    <xsl:attribute name="Bool">true</xsl:attribute>
+                </xsl:element>
+                <xsl:element name="PropertyValue">
+                    <xsl:attribute name="Property">NonFilterableProperties</xsl:attribute>
+                    <xsl:element name="Collection">
+                        <xsl:element name="PropertyPath">activationLockBypassCode</xsl:element>
+                        <xsl:element name="PropertyPath">androidSecurityPatchLevel</xsl:element>
+                        <xsl:element name="PropertyPath">azureADRegistered</xsl:element>
+                        <xsl:element name="PropertyPath">configurationManagerClientEnabledFeatures</xsl:element>
+                        <xsl:element name="PropertyPath">deviceActionResults</xsl:element>
+                        <xsl:element name="PropertyPath">deviceEnrollmentType</xsl:element>
+                        <xsl:element name="PropertyPath">deviceHealthAttestationState</xsl:element>
+                        <xsl:element name="PropertyPath">deviceRegistrationState</xsl:element>
+                        <xsl:element name="PropertyPath">easActivated</xsl:element>
+                        <xsl:element name="PropertyPath">easActivationDateTime</xsl:element>
+                        <xsl:element name="PropertyPath">easDeviceId</xsl:element>
+                        <xsl:element name="PropertyPath">enrollmentProfileName</xsl:element>
+                        <xsl:element name="PropertyPath">ethernetMacAddress</xsl:element>
+                        <xsl:element name="PropertyPath">exchangeAccessStateReason</xsl:element>
+                        <xsl:element name="PropertyPath">exchangeLastSuccessfulSyncDateTime</xsl:element>
+                        <xsl:element name="PropertyPath">freeStorageSpaceInBytes</xsl:element>
+                        <xsl:element name="PropertyPath">iccid</xsl:element>
+                        <xsl:element name="PropertyPath">isEncrypted</xsl:element>
+                        <xsl:element name="PropertyPath">isSupervised</xsl:element>
+                        <xsl:element name="PropertyPath">managedDeviceName</xsl:element>
+                        <xsl:element name="PropertyPath">managedDeviceOwnerType</xsl:element>
+                        <xsl:element name="PropertyPath">managementCertificateExpirationDate</xsl:element>
+                        <xsl:element name="PropertyPath">meid</xsl:element>
+                        <xsl:element name="PropertyPath">notes</xsl:element>
+                        <xsl:element name="PropertyPath">partnerReportedThreatState</xsl:element>
+                        <xsl:element name="PropertyPath">physicalMemoryInBytes</xsl:element>
+                        <xsl:element name="PropertyPath">remoteAssistanceSessionErrorDetails</xsl:element>
+                        <xsl:element name="PropertyPath">remoteAssistanceSessionUrl</xsl:element>
+                        <xsl:element name="PropertyPath">requireUserEnrollmentApproval</xsl:element>
+                        <xsl:element name="PropertyPath">subscriberCarrier</xsl:element>
+                        <xsl:element name="PropertyPath">totalStorageSpaceInBytes</xsl:element>
+                        <xsl:element name="PropertyPath">udid</xsl:element>
+                        <xsl:element name="PropertyPath">userDisplayName</xsl:element>
+                        <xsl:element name="PropertyPath">userId</xsl:element>
+                        <xsl:element name="PropertyPath">wiFiMacAddress</xsl:element>
+                    </xsl:element>
+                </xsl:element>
+            </xsl:element>
+        </xsl:element>
+    </xsl:template>
     <xsl:template name="ExpandRestrictionsTemplate">
         <xsl:param name = "expandable" />
             <xsl:attribute name="Term">Org.OData.Capabilities.V1.ExpandRestrictions</xsl:attribute>
@@ -1792,6 +1843,16 @@
                 </xsl:when>
             </xsl:choose>
 
+            <!-- Add FilterRestrictions to managedDevice entity type -->
+            <xsl:choose>
+                <xsl:when test="not(edm:Annotations[@Target='microsoft.graph.managedDevice'])">
+                    <xsl:element name="Annotations">
+                       <xsl:attribute name="Target">microsoft.graph.managedDevice</xsl:attribute>
+                       <xsl:call-template name="ManagedDeviceFilterRestrictionsTemplate"/>
+                    </xsl:element>
+                </xsl:when>
+            </xsl:choose>
+
             <!-- Remove Updatability for organization/certificateBasedAuthConfiguration containment navigation property -->
             <xsl:choose>
                 <xsl:when test="not(edm:Annotations[@Target='microsoft.graph.organization/certificateBasedAuthConfiguration'])">
@@ -2185,6 +2246,14 @@
        </xsl:copy>
     </xsl:template>
 
+    <!-- Add FilterRestrictions to managedDevice entity type -->
+     <xsl:template match="edm:Schema[@Namespace='microsoft.graph']/edm:Annotations[@Target='microsoft.graph.managedDevice']">
+       <xsl:copy>
+         <xsl:copy-of select="@*|node()"/>
+         <xsl:call-template name="ManagedDeviceFilterRestrictionsTemplate"/>
+       </xsl:copy>
+    </xsl:template>
+
     <!-- Add ExpandRestrictions to events,mailfolders and messages entity type -->
     <xsl:template match="edm:Schema[@Namespace='microsoft.graph']/edm:Annotations[@Target='microsoft.graph.user/events']/edm:Annotation[@Term='Org.OData.Capabilities.V1.ExpandRestrictions']|
                         edm:Schema[@Namespace='microsoft.graph']/edm:Annotations[@Target='microsoft.graph.group/events']/edm:Annotation[@Term='Org.OData.Capabilities.V1.ExpandRestrictions']|
diff --git a/transforms/csdl/preprocess_csdl_test_input.xml b/transforms/csdl/preprocess_csdl_test_input.xml
index 524bea0c5..2368ebaa4 100644
--- a/transforms/csdl/preprocess_csdl_test_input.xml
+++ b/transforms/csdl/preprocess_csdl_test_input.xml
@@ -276,6 +276,9 @@
                     </Record>
                 </Annotation>
             </Annotations>
+            <Annotations Target="microsoft.graph.managedDevice">
+                <Annotation Term="Org.OData.Core.V1.Description" String="Devices that are managed or pre-enrolled through Intune. Limited support for $filter: Only properties whose descriptions mention support for $filter may be used, and combinations of those filtered properties must use 'and', not 'or'." />
+            </Annotations>
             <Annotations Target="microsoft.graph.managedDevice/users">
                 <Annotation Term="Org.OData.Capabilities.V1.ChangeTracking">
                     <Record>
diff --git a/transforms/csdl/preprocess_csdl_test_output.xml b/transforms/csdl/preprocess_csdl_test_output.xml
index 1a0265333..f55f7f55f 100644
--- a/transforms/csdl/preprocess_csdl_test_output.xml
+++ b/transforms/csdl/preprocess_csdl_test_output.xml
@@ -934,6 +934,53 @@
           </Record>
         </Annotation>
       </Annotations>
+      <Annotations Target="microsoft.graph.managedDevice">
+        <Annotation Term="Org.OData.Core.V1.Description" String="Devices that are managed or pre-enrolled through Intune. Limited support for $filter: Only properties whose descriptions mention support for $filter may be used, and combinations of those filtered properties must use 'and', not 'or'." />
+        <Annotation Term="Org.OData.Capabilities.V1.FilterRestrictions">
+          <Record>
+            <PropertyValue Property="Filterable" Bool="true" />
+            <PropertyValue Property="NonFilterableProperties">
+              <Collection>
+                <PropertyPath>activationLockBypassCode</PropertyPath>
+                <PropertyPath>androidSecurityPatchLevel</PropertyPath>
+                <PropertyPath>azureADRegistered</PropertyPath>
+                <PropertyPath>configurationManagerClientEnabledFeatures</PropertyPath>
+                <PropertyPath>deviceActionResults</PropertyPath>
+                <PropertyPath>deviceEnrollmentType</PropertyPath>
+                <PropertyPath>deviceHealthAttestationState</PropertyPath>
+                <PropertyPath>deviceRegistrationState</PropertyPath>
+                <PropertyPath>easActivated</PropertyPath>
+                <PropertyPath>easActivationDateTime</PropertyPath>
+                <PropertyPath>easDeviceId</PropertyPath>
+                <PropertyPath>enrollmentProfileName</PropertyPath>
+                <PropertyPath>ethernetMacAddress</PropertyPath>
+                <PropertyPath>exchangeAccessStateReason</PropertyPath>
+                <PropertyPath>exchangeLastSuccessfulSyncDateTime</PropertyPath>
+                <PropertyPath>freeStorageSpaceInBytes</PropertyPath>
+                <PropertyPath>iccid</PropertyPath>
+                <PropertyPath>isEncrypted</PropertyPath>
+                <PropertyPath>isSupervised</PropertyPath>
+                <PropertyPath>managedDeviceName</PropertyPath>
+                <PropertyPath>managedDeviceOwnerType</PropertyPath>
+                <PropertyPath>managementCertificateExpirationDate</PropertyPath>
+                <PropertyPath>meid</PropertyPath>
+                <PropertyPath>notes</PropertyPath>
+                <PropertyPath>partnerReportedThreatState</PropertyPath>
+                <PropertyPath>physicalMemoryInBytes</PropertyPath>
+                <PropertyPath>remoteAssistanceSessionErrorDetails</PropertyPath>
+                <PropertyPath>remoteAssistanceSessionUrl</PropertyPath>
+                <PropertyPath>requireUserEnrollmentApproval</PropertyPath>
+                <PropertyPath>subscriberCarrier</PropertyPath>
+                <PropertyPath>totalStorageSpaceInBytes</PropertyPath>
+                <PropertyPath>udid</PropertyPath>
+                <PropertyPath>userDisplayName</PropertyPath>
+                <PropertyPath>userId</PropertyPath>
+                <PropertyPath>wiFiMacAddress</PropertyPath>
+              </Collection>
+            </PropertyValue>
+          </Record>
+        </Annotation>
+      </Annotations>
       <Annotations Target="microsoft.graph.managedDevice/users">
         <Annotation Term="Org.OData.Capabilities.V1.ChangeTracking">
           <Record>