Role required: Tenant Administrator, Endpoint Group Creator, or Endpoint Group User

Role required: Tenant Administrator

Setup properties:

TenantId: This field is not required for this operation. If provided, it will be ignored.

PSK: This value, if provided, must be an OctetString (convertible to a byte array).

ProtectedAccessCredential: This value, if provided, must be an OctetString (convertible to a byte array).

AuthenticationProtocol: Currently, only the 0=EAP_TLS option is fully supported.

ClientAuthenticationSettings.DesignatedSubjectCN: The default value for this property is 4=UserPrincipalName. This is the Subject set in the client certificate and the user name required by the Network Policy Server (NPS), which is the RADIUS implementation by Microsoft.

Role required: Tenant Administrator, Endpoint Group Creator, or Endpoint Group User

Role required: Tenant Administrator

Setup properties:

TenantId: This field is not required for this operation. If provided, it will be ignored.

PSK: This value, if provided, must be an OctetString (convertible to a byte array).

ProtectedAccessCredential: This value, if provided, must be an OctetString (convertible to a byte array).

AuthenticationProtocol: Currently, only the 0=EAP_TLS option is fully supported.

ClientAuthenticationSettings.DesignatedSubjectCN: The default value for this property is 4=UserPrincipalName. This is the Subject set in the client certificate and the user name required by the Network Policy Server (NPS), which is the RADIUS implementation by Microsoft.

Role required: Tenant Administrator

Role required: Tenant Administrator

Role required: Global Administrator, Tenant Administrator, Account Manager, Endpoint Group Creator, or Endpoint Group User.

This method provides Users the means to obtain a new Access Token before their current one expires.

Role required: Global Administrator, Tenant Administrator, Account Manager, Endpoint Group Creator, or Endpoint Group User

This method will only grant an Access Token under the following conditions:

1. EMA must be installed with Windows Domain Authentication mode.
2. The EMA server must be joined to an Active Directory domain.
3. The caller must have an EMA account with a username that maps to a User Principal Name in Active Directory.

Role required: Global Administrator, Tenant Administrator, Account Manager, Endpoint Group Creator, or Endpoint Group User. This method provides Users the means to obtain a new Access Token using Windows username and password. This method will only grant an Access Token under the following conditions:

1. EMA must be installed with Windows Domain Authentication mode.
2. The caller must have an EMA account with a username that maps to a User Principal Name in Active Directory.

Role required: Global Administrator, Tenant Administrator, Account Manager, Endpoint Group Creator, or Endpoint Group User

Role required: Global Administrator, Tenant Administrator, Account Manager, Endpoint Group Creator, or Endpoint Group User.

This method provides Users the means to get new CSRF token pair set in cookies.

Role required: Global Administrator, Tenant Administrator, Account Manager, Endpoint Group Creator, or Endpoint Group User

Role required: Global Administrator, Tenant Administrator, Account Manager, Endpoint Group Creator, or Endpoint Group User

Role required: Global Administrator, Tenant Administrator, Account Manager, Endpoint Group Creator, or Endpoint Group User

Role required: Global Administrator, Tenant Administrator, Account Manager, Endpoint Group Creator, or Endpoint Group User

Role required: Global Administrator, Tenant Administrator, Account Manager, Endpoint Group Creator, or Endpoint Group User

Roles required: Tenant Administrator, Endpoint Group Creator or Endpoint Group User with execute right to the endpoint

When returning MEBx password, the username field in AMT credentials is always null

Role required: Tenant Administrator, Endpoint Group Creator, or Endpoint Group User

Role required: Tenant Administrator or Endpoint Group Creator

The following defines the profile object's optional parameters and their default values. If no argument is provided for an optional parameter, then its default value is used.

1. TlsAuthType: 1 = TlsNoAuth. If this is set to NoTLS, you need to specify the CIRASettings.
2. PowerPackageSettings.PowerActiveOn: 1 = AlwaysOnInAc.
3. PowerPackageSettings.PowerStateIdleTimeoutInMinutes: 1.
4. ManagementInterfacesSettings.WebUIServiceEnabledState: 2 = Enabled.
5. ManagementInterfacesSettings.KVMInterfaceState: 2 = Enabled.
6. ManagementInterfacesSettings.UserConsentRequired: 4294967295 = All.
7. ManagementInterfacesSettings.SOLEnabled: true.
8. ManagementInterfacesSettings.IDEREnabled: true.
9. ManagementInterfacesSettings.RedirectionServiceState: SOLEnabled=true and [IDEREnabled=true: 32771(IderOnSolOn); IDEREnabled=false: 32770(IderOffSolOn)]; SOLEnabled=false and [IDEREnabled=true: 32769(IderOnSolOff); IDEREnabled=false: 32768(Disabled)].
10. FqdnSettings.FqdnSource: 0 = SharedWithHostOS.
11. IpSettings.DHCPEnabled: true.
12. IpSettings.SharedStaticIp: false.
13. IpSettings.Source: 0 = DHCP.
14. WiFiConnectionSettings.WiFiSetups: Empty collection (it is optional only if WiFiConnectionSettings.WiFiConnectionEnabledConfiguration=0)
15. Wired802_1XSettings: An object containing _802_1Setup_DBLookupKey=null.
16. CIRASettings (the whole object): null.
17. CIRASettings.CIRATunnel: false.
18. CIRASettings.EnvironmentDetectionDomainSuffix: Value to disable CIRA when the target system is in this network domain when CIRATunnel=true; Empty string when CIRATunnel=false.
19. CIRASettings.CIRAProxies (the whole object): Empty collection.

Role required: Tenant Administrator, Endpoint Group Creator, or Endpoint Group User

Role required: Tenant Administrator or Endpoint Group Creator

The properties AmtProfileId and TenantId are readonly and cannot be updated.

The following list defines the default values that would be used for any optional parameters if they are omitted from the profile object:

1. TlsAuthType: 1 = TlsNoAuth. If this is set to NoTLS, you need to specify the CIRASettings.
2. PowerPackageSettings.PowerActiveOn: 1 = AlwaysOnInAc.
3. PowerPackageSettings.PowerStateIdleTimeoutInMinutes: 1.
4. ManagementInterfacesSettings.WebUIServiceEnabledState: 2 = Enabled.
5. ManagementInterfacesSettings.KVMInterfaceState: 2 = Enabled.
6. ManagementInterfacesSettings.UserConsentRequired: 4294967295 = All.
7. ManagementInterfacesSettings.SOLEnabled: true.
8. ManagementInterfacesSettings.IDEREnabled: true.
9. ManagementInterfacesSettings.RedirectionServiceState: SOLEnabled=true and [IDEREnabled=true: 32771(IderOnSolOn); IDEREnabled=false: 32770(IderOffSolOn)]; SOLEnabled=false and [IDEREnabled=true: 32769(IderOnSolOff); IDEREnabled=false: 32768(Disabled)].
10. FqdnSettings.FqdnSource: 0 = SharedWithHostOS.
11. IpSettings.DHCPEnabled: true.
12. IpSettings.SharedStaticIp: false.
13. IpSettings.Source: 0 = DHCP.
14. WiFiConnectionSettings.WiFiSetups: Empty collection (it is optional only if WiFiConnectionSettings.WiFiConnectionEnabledConfiguration=0)
15. Wired802_1XSettings: An object containing _802_1Setup_DBLookupKey=null.
16. CIRASettings (the whole object): null.
17. CIRASettings.CIRATunnel: false.
18. CIRASettings.EnvironmentDetectionDomainSuffix: Value to disable CIRA when the target system is in this network domain when CIRATunnel=true; Empty string when CIRATunnel=false.
19. CIRASettings.CIRAProxies (the whole object): Empty collection.

Role required: Tenant Administrator or Endpoint Group Creator

Role required: Tenant Administrator, Endpoint Group Creator, or Endpoint Group User

404 will be returned if AmtProfileId is not found.

Role required: Tenant Administrator, Account Manager, Endpoint Group Creator, or Endpoint Group User

Role required: Tenant Administrator, Account Manager, Endpoint Group Creator, or Endpoint Group User

Role required: Tenant Administrator

Role required: Tenant Administrator, Account Manager, Endpoint Group Creator, or Endpoint Group User

The filename of the .CER file will will be specified in the "filename" parameter of the "Content-Disposition" header.

Role required: Tenant Administrator

To import an AMT provisioning certificate, POST with enctype "multipart/form-data", the .PFX file attached, and the following parameters:
name: certificate nickname
password: password for the .PFX file

Role required: Tenant Administrator

To import an certificate, POST with enctype "multipart/form-data", the .PFX file attached, and the following parameters:
name: certificate nickname
password: password for the .PFX file

Role required: Tenant Administrator, or Endpoint Group Creator or Endpoint Group User with View right to the resource.

Role required: Tenant Administrator, or Endpoint Group Creator or Endpoint Group User with Execute right to the endpoint.

Role required: Tenant Administrator, or Endpoint Group Creator or Endpoint Group User with View right to the resource.

Role required: Tenant Administrator, or Endpoint Group Creator or Endpoint Group User with Execute right to the endpoint.

Role required: Tenant Administrator, or Endpoint Group Creator or Endpoint Group User with Execute right to the endpoint.

Certificate provisioning will be requested only if an AMTProvisioningCertificateId is provided, otherwise host-based-provisioning will be requested.

AdminCredential.Password requirements:

between 8 and 31 characters
contains at least one number
contains both lowercase and uppercase alpha characters
contains at least one special character: '!', '@', '#', '$', '%', '^', '&', '*', '(', ')', '-', '+'

CiraIntranetSuffix is applicable only when UsesCira is set to true. The value is a string of up to four comma separated domain name suffixes.

UsesTLS and UsesCira cannot be both true or both false. You need to choose one.

Role required: Tenant Administrator, or Endpoint Group Creator or Endpoint Group User with Execute right to the endpoint.

Warning: This operation will reset the AMT device to factory settings!

The AMT admin password is optional and should only be used to unprovision an AMT endpoint that was provisioned outside of EMA, or that has no AmtSetup (or Provisioning Record) in the database.

If the AMT Endpoint was provisioned with EMA, and the corresponding AmtSetup record is in the database, then the AMT admin password is unnecessary.

AdminCredential.Password requirements:

--between 8 and 32 characters
--contains at least one number
--contains both lowercase and uppercase alpha characters
--contains at least one special character

Role required: Tenant Administrator, or Endpoint Group Creator or Endpoint Group User with Execute right to the endpoint.

For certificate provisioning, provide an AmtCertificateId in the request, otherwise Host-based-provisioning will be set.

To unset auto-provisioning, delete the AmtSetup record using the EndpointGroupId as AmtSetupId.