Solution GetManagedDevices

Intune Managed Devices report

Solution Code: GetManagedDevices

Description

This report lists every device enrolled in Microsoft Intune, together with hardware, management, compliance and security details. For non-compliant Windows devices it also performs a compliance assessment (see How this Solution works).

Two tables are produced: a Report table (one row per device) and a Summary table (one row per platform).

Report

Column Title	Description
DeviceName	Name of the device
SerialNumber	Hardware serial number
AzureAdDeviceId	Entra ID (Azure AD) device object ID
IntuneDeviceId	Intune managed device ID
DeviceCategory	Intune device category
Manufacturer	Device manufacturer
Model	Device model
OperatingSystem	OS family (Windows, macOS, Linux, Android, iOS…)
OsVersion	OS build/version
TotalStorageGb / FreeStorageGb / StorageUsedPct	Storage capacity, free space and used percentage
PhysicalMemoryGb	Installed RAM
PrimaryUser	UPN (or display name) of the primary user
OwnerType	Company / Personal / Unknown
ManagementState	Managed, Retire Pending, Wipe Pending, etc.
ManagementAgent	MDM, Intune Client, Configuration Manager, Jamf, etc.
EnrollmentType	How the device was enrolled
EnrollmentProfile	Enrollment profile name
EnrolledDate	Enrollment date/time
LastSyncDate	Last Intune check-in date/time
DaysSinceLastSync	Days since the last check-in
ManagementCertExpiration	None / Valid / Expiring <date> / Expired
ComplianceState	Compliant, Non-Compliant, In Grace Period, Error, Unknown, Not Applicable
ComplianceGracePeriodExpiration	End of the compliance grace period, when set
IsEncrypted	Whether disk encryption is on
JailBroken	Jailbroken / rooted status
IsSupervised	Supervised mode (Apple)
AzureAdRegistered	Whether the device is registered in Entra ID
PartnerReportedThreatState	Threat state reported by a mobile threat defense partner
AndroidSecurityPatchLevel	Android security patch level
DeviceNotes	Free-text notes stored on the device object
NonComplianceAssessment	Assessment result for non-compliant Windows devices (see below)
Remarks	Remarks/errors captured while building the row

Summary

Column Title	Description
Platform	Windows / macOS / Linux / Android / iOS / Other
Total	Total devices on that platform
Compliant	Devices reported as compliant
Retired	Windows devices assessed as Retired – No user or Retired – Inactive
FalsePositive	Devices reporting non-compliant but with no failing (non-default) policy
MissingPolicy	Devices with no compliance policy assigned
NotCompliant	Devices with a genuine policy failure

Requirements

API	Delegated	Application
Microsoft Graph	DeviceManagementManagedDevices.Read.All	DeviceManagementManagedDevices.Read.All
RBAC	Intune Administrator*	NA

Global Reader or another admin role that can read Intune managed devices.

Parameters

This Solution has no parameters.

How this Solution works

1. Retrieves all managed devices from Intune.
2. For each Windows device that is not compliant, retrieves its compliance policy states and computes a NonComplianceAssessment:
   • Retired – No user — no primary user assigned.
   • Retired – Inactive — last sync older than 30 days.
   • No Compliance policy assigned — only the built-in default policy applies.
   • False Positive — a policy is assigned but none is actually failing.
   • Otherwise a Policy > Setting: reason list of the failing settings.
3. Writes one row per device to the Report table and aggregates per-platform counters into the Summary table.

Notes

The compliance assessment (step 2) is only performed for Windows devices that report as non-compliant; other platforms are reported as-is.