KBY Technologies Logo
Microsoft Intune · PowerShell 7.6

Intune devices reporting no encryption

Which Intune-managed devices report that their storage is not encrypted?

Script

#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.DeviceManagement
# Intune managed devices whose reported encryption status is not encrypted. Read-only.
param(
    [string]$OperatingSystem
)

Connect-MgGraph -Scopes 'DeviceManagementManagedDevices.Read.All' -NoWelcome

Get-MgDeviceManagementManagedDevice -All -Property 'id', 'deviceName', 'userPrincipalName', 'operatingSystem', 'osVersion', 'isEncrypted', 'complianceState', 'managedDeviceOwnerType', 'lastSyncDateTime' |
    Where-Object { -not $_.IsEncrypted } |
    Where-Object { -not $OperatingSystem -or $_.OperatingSystem -eq $OperatingSystem } |
    Sort-Object OperatingSystem, DeviceName |
    Select-Object DeviceName, UserPrincipalName, OperatingSystem, OsVersion, IsEncrypted, ComplianceState, ManagedDeviceOwnerType, LastSyncDateTime

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

  • Uses the managedDevice isEncrypted property, the encryption status the device reports to Intune. It is only as current as the device's last sync, shown in LastSyncDateTime.
  • Pass -OperatingSystem Windows (or iOS, Android, macOS) to limit the list to one platform.
  • For Windows devices, the BitLocker scripts in this library show the volume detail and whether a recovery key is stored in Entra ID.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.

Connect-MgGraph (Microsoft.Graph.Authentication)Get-MgDeviceManagementManagedDevice (Microsoft.Graph.DeviceManagement)List managedDevices (Intune): permissionsmanagedDevice resource type: isEncrypted, lastSyncDateTimeWhere-Object (Microsoft.PowerShell.Core)Sort-Object (Microsoft.PowerShell.Utility)Select-Object (Microsoft.PowerShell.Utility)
All scripts