KBY Technologies Logo
Microsoft Intune · PowerShell 7.6

Intune devices that are not compliant

Which Intune-managed devices are non-compliant, in their compliance grace period, or reporting a compliance error or conflict right now?

Script

#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.DeviceManagement
# Intune managed devices that are non-compliant, in grace period, or in error or conflict. Read-only.

Connect-MgGraph -Scopes 'DeviceManagementManagedDevices.Read.All' -NoWelcome

$filter = "complianceState eq 'noncompliant' or complianceState eq 'inGracePeriod' or complianceState eq 'error' or complianceState eq 'conflict'"

Get-MgDeviceManagementManagedDevice -All -Filter $filter -Property 'id', 'deviceName', 'userPrincipalName', 'operatingSystem', 'osVersion', 'complianceState', 'complianceGracePeriodExpirationDateTime', 'lastSyncDateTime', 'managedDeviceOwnerType' |
    Sort-Object ComplianceState, DeviceName |
    Select-Object DeviceName, UserPrincipalName, OperatingSystem, OsVersion, ComplianceState,
        @{ Name = 'GracePeriodEnds'; Expression = { $_.ComplianceGracePeriodExpirationDateTime } },
        LastSyncDateTime, ManagedDeviceOwnerType

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

  • Filters on complianceState: noncompliant (blocked from corporate resources), inGracePeriod (non-compliant but still has access until GracePeriodEnds), error and conflict.
  • This shows the device's overall state. To see which compliance policy each device fails, use the compliance policy failures script.
  • LastSyncDateTime is the last successful sync with Intune. A device that hasn't synced for weeks may be reporting an old state.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.

Connect-MgGraph (Microsoft.Graph.Authentication)Get-MgDeviceManagementManagedDevice (Microsoft.Graph.DeviceManagement)List managedDevices (Intune): permissionsmanagedDevice resource type: complianceState ($filter eq and or), complianceGracePeriodExpirationDateTimecomplianceState enum type: noncompliant, inGracePeriod, error, conflictSort-Object (Microsoft.PowerShell.Utility)Select-Object (Microsoft.PowerShell.Utility)
All scripts