How to find non-compliant devices in Microsoft Intune

Before you start

Use an account that can read Intune devices and reports; Microsoft names Read Only Operator as the least privileged built-in Intune role for the reports. The tenant needs an active Intune licence, and a device must be enrolled to receive a compliance policy. The PowerShell example requests DeviceManagementManagedDevices.Read.All; your organisation may require administrator consent.

Reports update when a device checks in, and Microsoft says a device that is online can take up to 24 hours to appear in a policy's status. The examples read and export; they change no device or policy.

Option 1

Find non-compliant devices with PowerShell

Install the modules once, then connect and export the devices marked noncompliant. The filter runs in Microsoft Graph, so only those devices come back.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.DeviceManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'DeviceManagementManagedDevices.Read.All' -NoWelcome
try {
    $filter = "complianceState eq 'noncompliant'"
    $devices = Get-MgDeviceManagementManagedDevice -All -Filter $filter
    $report = @($devices | Sort-Object OperatingSystem, DeviceName |
        Select-Object DeviceName,UserPrincipalName,OperatingSystem,OsVersion,ComplianceState,
            LastSyncDateTime,Id)
    if ($report.Count -eq 0) {
        Write-Output 'No devices are marked noncompliant.'
    } else {
        $report | Export-Csv -Path './noncompliant-devices.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) devices are marked noncompliant."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The script keeps devices whose state is exactly noncompliant. To add other states, extend the filter with or, for example complianceState eq 'noncompliant' or complianceState eq 'inGracePeriod'; error and conflict are also values. LastSyncDateTime is the device's last successful sync, so an old date means the state may be out of date. The list says that a device fails, not which setting: for the reasons, use Option 2 or 3.

Option 2

Review non-compliant devices in the admin centre

1. Sign in to the Microsoft Intune admin centre for the correct tenant.
2. Go to Reports > Device compliance and select the Reports tab.
3. Select Noncompliant devices and settings, then Generate report.
4. Filter by compliance state, OS platform or setting compliance state, or search any column.
5. Read Noncompliant setting, Noncompliant policy, Setting compliance state and Setting error code for each row. Export the report data if you want to keep it.

The report has 1 row per device and noncompliant setting, so a device failing 4 settings appears 4 times. This method suits 1 tenant or 1 device. It does not compare tenants or keep a report for each run.

Common questions

Why is a device with no compliance policy not listed?

The tenant-wide setting Mark devices with no compliance policy assigned as marks them compliant by default, and Microsoft recommends changing it to not compliant. To find them, open Reports > Device compliance, select the Reports tab and choose Devices without compliance policy.

Why are devices in the grace period or in error missing from the list?

The filter in Option 1 matches noncompliant only. A device in the grace period is non-compliant but still has access, and a setting in an error state leaves the device's state unchanged for up to 7 days. To include those states, add them to the filter.

Why is a device non-compliant when every policy says compliant?

Intune also checks a built-in policy: the device needs a policy assigned, must have been in contact with Intune, and its enrolled user must exist with a valid Intune licence. To check who holds licences, see how to export licensed users.