Intune Noncompliant Device Audit

Read-only PowerShell script that lists Intune devices that are non-compliant or in their grace period, with the failing setting and who your policies notify.

Send me the scriptView on GitHub

What it does

  • Reads every Intune device that is non-compliant, in its grace period, or in error, through Microsoft Graph with your own account
  • Looks up the compliance policy and the setting each device fails, in plain words, such as BitLocker not on
  • Puts grace period devices first, with the hours left before Conditional Access treats them as non-compliant
  • Flags users with no email address on their profile, because Intune's email action can't reach them
  • Shows what each compliance policy does on failure: the grace period, user emails, and whether anyone in IT is copied
  • Exports a CSV with a next step per device and exits 1 when anything is found
  • Read-only: it fixes, syncs and changes nothing

Configuration

You edit one block:

PowerShell
Preview snippet. The full, tested script lives in the vault.
# ===== CONFIG =====
$OutputPath    = Join-Path $env:USERPROFILE 'Desktop\Atliso-NoncompliantDevices.csv'
$CheckSettings = $true   # look up the failing setting per device: one extra Graph call per failing policy
$ShowPolicies  = $true   # list what each compliance policy does on failure, and who it tells
$LogPath       = Join-Path $env:LOCALAPPDATA 'Atliso\NoncompliantDeviceAudit.log'
# ==================

Run it

It runs on your own workstation, not on devices, with Windows PowerShell 5.1 or PowerShell 7:

PowerShell
Preview snippet. The full, tested script lives in the vault.
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
Install-Script Atliso-NoncompliantDeviceAudit -Scope CurrentUser   # from the PowerShell Gallery
Atliso-NoncompliantDeviceAudit.ps1
# MSPs: run once per customer tenant
Atliso-NoncompliantDeviceAudit.ps1 -TenantId contoso.onmicrosoft.com

Full walkthrough, including how grace periods and notification emails really work: Intune non-compliant devices: find them before users call

Get Intune Noncompliant Device Audit

We'll send the script, and updates when Microsoft changes how compliance works. No spam.