How to check remediation results in Microsoft Intune

Before you start

Use an Intune Administrator, or an account with an Intune role that has permissions under the Device configurations category. The PowerShell example requests DeviceManagementScripts.Read.All; your organisation may require administrator consent. Remediations need the devices' users to hold Windows Enterprise E3 or E5, Windows Education A3 or A5, or Windows Virtual Desktop Access, and the devices to be joined or hybrid joined to Microsoft Entra ID.

Know how fresh the counts are. A device collects its script packages every 8 hours. For a recurring package it reports only when something changes in the first 6 days, and every 7 days even when nothing has. The run summaries are in the beta version of Microsoft Graph. The examples read and export and change nothing.

Option 1

Check remediation results with PowerShell

Install the modules once, then connect, read each script package's run summary and export them.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication,
    Microsoft.Graph.Beta.DeviceManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'DeviceManagementScripts.Read.All' -NoWelcome
try {
    $properties = 'id', 'displayName', 'publisher', 'isGlobalScript'
    $packages = @(Get-MgBetaDeviceManagementDeviceHealthScript -All -Property $properties)
    $report = foreach ($package in $packages) {
        $id = $package.Id
        $run = Get-MgBetaDeviceManagementDeviceHealthScriptRunSummary -DeviceHealthScriptId $id
        [pscustomobject]@{
            Package = $package.DisplayName
            BuiltIn = $package.IsGlobalScript
            NoIssue = $run.NoIssueDetectedDeviceCount
            IssueDetected = $run.IssueDetectedDeviceCount
            Remediated = $run.IssueRemediatedDeviceCount
            Reoccurred = $run.IssueReoccurredDeviceCount
            DetectionErrors = $run.DetectionScriptErrorDeviceCount
            RemediationErrors = $run.RemediationScriptErrorDeviceCount
            Pending = $run.DetectionScriptPendingDeviceCount
            LastRun = $run.LastScriptRunDateTime
        }
    }
    $report = @($report | Sort-Object Package)
    if ($report.Count -eq 0) {
        Write-Output 'The tenant has no remediation script packages.'
    } else {
        $report | Export-Csv -Path './remediation-results.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) script packages written to remediation-results.csv."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The CSV has 1 row for each script package, the built-in ones included, with its device counts and the last time it ran on any device. Reoccurred counts devices where the remediation script ran without an error but didn't fix the issue, and Pending counts devices that haven't yet run the latest version. To keep only your own packages, add Where-Object { -not $_.BuiltIn } before the sort.

Option 2

Check remediation status in the admin centre

1. Sign in to the Microsoft Intune admin centre for the correct tenant.
2. Go to Devices > Manage devices > Scripts and remediations and select the Remediations tab.
3. Select the script package to see its overview of detection and remediation status.
4. Select Device status for the result on each device, and Export to save it as a CSV. Leave the package's settings and assignments alone.

This suits checking 1 package after a change. Microsoft says a filter or export on the list of packages covers only the packages already loaded, so scroll to the end first. For every package's counts in 1 file, use PowerShell or a report.

Common questions

Why does a device still have the issue after it was remediated?

Look at the reoccurred count. Microsoft counts a device there when the remediation script ran without an error but the issue was still found afterwards. Check the remediation script against what the detection script looks for: it runs, but it doesn't change what detection finds.

Why haven't the counts changed since yesterday's run?

The device may not have reported yet. Microsoft says a recurring package reports only on a change in its first 6 days and every 7 days after that, and a device collects new packages every 8 hours, after a restart or when a user signs in.

Are platform scripts in the same results?

Not in Microsoft Graph: platform scripts have run summaries of their own, so the script above leaves them out. To find the ones that failed, see how to find failed PowerShell scripts in Microsoft Intune.