Question

Your organization requires a weekly automated report that lists every managed Windows device currently in a noncompliant state, along with the specific compliance policy settings each device failed. You need to build an unattended script that runs on a schedule and outputs the data to a CSV file. Which approach correctly retrieves the per-setting failure details programmatically?

Accepted Answer

Call the Microsoft Graph endpoint deviceManagement/managedDevices to get device compliance state, then for each noncompliant device call deviceManagement/managedDevices/{id}/deviceCompliancePolicyStates and expand the setting states.

Answer

Use the Get-IntuneManagedDevice cmdlet with the -Filter parameter set to complianceState eq 'noncompliant' and export the returned object directly, which already includes each failed setting.

Answer

Query the Intune Data Warehouse OData feed for the devices entity, which returns the failed compliance settings for each device in the same response.

Answer

Run the Get-MgDeviceManagementDeviceConfiguration cmdlet and filter on the compliance status field to list the noncompliant settings per device.