KBY Technologies Logo
Microsoft Intune · PowerShell 7.6

Which compliance policy each device fails

For each Intune compliance policy, which devices report it as non-compliant, in error or in conflict? Answers "why is this device non-compliant?" at policy level.

Script

#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.DeviceManagement
# Devices reported as non-compliant, in error or in conflict, per Intune compliance policy. Read-only.

Connect-MgGraph -Scopes 'DeviceManagementConfiguration.Read.All' -NoWelcome

$failing = 'nonCompliant', 'error', 'conflict'

Get-MgDeviceManagementDeviceCompliancePolicy -All -Property 'id', 'displayName' |
    ForEach-Object {
        $policy = $_
        Get-MgDeviceManagementDeviceCompliancePolicyDeviceStatus -DeviceCompliancePolicyId $policy.Id -All |
            Where-Object { $failing -contains "$($_.Status)" } |
            ForEach-Object {
                [pscustomobject]@{
                    Policy          = $policy.DisplayName
                    Device          = $_.DeviceDisplayName
                    User            = $_.UserPrincipalName
                    Status          = "$($_.Status)"
                    GracePeriodEnds = $_.ComplianceGracePeriodExpirationDateTime
                    LastReported    = $_.LastReportedDateTime
                }
            }
    } |
    Sort-Object Policy, Device

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

  • Reads each compliance policy's device statuses (deviceComplianceDeviceStatus) and keeps nonCompliant, error and conflict. A device that fails several policies appears once per policy.
  • This shows the failing policy, not the failing setting inside it. The device's compliance page in the Intune admin centre shows the individual settings.
  • Makes one request per compliance policy (plus paging), so it is quick even in large tenants.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.

Connect-MgGraph (Microsoft.Graph.Authentication)Get-MgDeviceManagementDeviceCompliancePolicy (Microsoft.Graph.DeviceManagement)Get-MgDeviceManagementDeviceCompliancePolicyDeviceStatus (Microsoft.Graph.DeviceManagement)List deviceCompliancePolicies: permissionsList deviceComplianceDeviceStatuses: permissionsdeviceComplianceDeviceStatus resource type: status valuesForEach-Object (Microsoft.PowerShell.Core)Where-Object (Microsoft.PowerShell.Core)Sort-Object (Microsoft.PowerShell.Utility)
All scripts