📱 Recipe · Intune & Device Management
Audit an Intune-Managed Device and Trigger a Remote Sync
Diagnose device health, compliance, and check-in status, then force a policy refresh to remediate common issues
Complexity
Intermediate
Impact
device-support + endpoint-management + user-productivity + low-risk
Context
Why This Matters
When a user reports a performance issue, connectivity problem, or that a policy or app isn't applying correctly, the first step is almost always to audit the device's current state in Intune and force a check-in. A device that hasn't synced recently may be running stale policies, missing app assignments, or reporting outdated compliance — all of which can manifest as slowness, login errors, or failed installs.
This recipe walks through the standard triage workflow: resolve the user, enumerate their managed devices, inspect health (storage, compliance, last sync, configuration profile state), and trigger a remote sync. It's a safe, non-destructive first-response procedure that resolves a surprising number of tickets on its own and produces the diagnostic data needed to escalate the rest.
Expected Outcomes
- A clear snapshot of the user's device: OS, model, storage, compliance state, and last check-in time
- Visibility into which compliance policies and configuration profiles are applied — and which are in an error state
- A remote sync command delivered to the device to refresh policies and update Intune reporting
- Documented findings you can share with the user or attach to the ticket
- A decision point: sync resolved it, or escalate to reboot / deeper investigation
Risks & Considerations
Safe operations (low risk)
- Sync is non-destructive — it just forces the MDM client to check in. Safe to run any time.
- Read operations on managedDevices and compliance states are always safe.
Watch out for
- Beta endpoints: This recipe uses
/betafor richer device metadata. Beta APIs can change without notice; for production automation prefer/v1.0where the fields you need are available. - Invalid $select fields: Field availability differs between
/v1.0and/betaand across OS types. If a$selectreturns HTTP 400, drop the offending field and retry. - Compliance "error" state: Often a reporting lag rather than a real failure. Always sync first and re-check before declaring the device non-compliant.
- Reboot vs sync: A reboot disrupts the user's session. Only escalate to a remote reboot after sync fails and the user agrees.
- User Experience Analytics: The
userExperienceAnalyticsDevicePerformanceendpoint requires the UXA feature to be enabled and licensed; expect 400s in tenants without it.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| User.Read.All | Resolve the reporting user's account by name or UPN |
| DeviceManagementManagedDevices.Read.All | Read device inventory, compliance state, and last check-in data |
| DeviceManagementManagedDevices.PrivilegedOperations.All | Trigger remote sync (and reboot, if escalated) |
| DeviceManagementConfiguration.Read.All | Read device configuration and compliance policy states |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
For End Users
How an employee would ask Dex for help
Audit and sync a device from the Intune admin center
Step 1 — Locate the user's device
- Sign in to the Microsoft Intune admin center.
- Navigate to and search for the user (e.g.
Alex W). - Open the user and click in the left blade to see all Intune-managed devices associated with that account.
Step 2 — Review device health
- Click the device name to open its overview page.
- Review the Overview tab: Compliance, Last check-in, OS version, Primary user, and Storage (under Hardware).
- Click to see per-policy state. Look for policies in Error or Non-compliant status.
- Click to see configuration profile results.
- Optional: for app deployment state, for UXA performance scores (if licensed).
Step 3 — Trigger a remote sync
- From the device overview page, click the Sync action in the top toolbar.
- Confirm the prompt. Intune queues the command; the device will check in on its next network opportunity (usually within a few minutes).
- Refresh the page after ~5–10 minutes and verify Last check-in has updated.
Step 4 — Escalate if needed
- If sync doesn't resolve the issue and the user consents, use the Restart action (Windows) to force a reboot.
- For deeper hardware signals, check .
Audit and sync with Microsoft Graph
1. Resolve the user
GET https://graph.microsoft.com/v1.0/users?$filter=startswith(displayName,'Alex W')&$select=id,displayName,userPrincipalNameCapture the id from the response for subsequent calls.
2. List the user's managed devices
GET https://graph.microsoft.com/beta/users/{userId}/managedDevices?$select=id,deviceName,operatingSystem,osVersion,complianceState,lastSyncDateTime,model,manufacturer,totalStorageSpaceInBytes,freeStorageSpaceInBytes,azureADRegisteredExample response:
{
"value": [{
"id": "db25e629-e2f8-4a8e-ad4c-18d27cfa68c3",
"deviceName": "DESKTOP-PHSSKAD",
"complianceState": "compliant",
"lastSyncDateTime": "2026-02-18T10:37:45Z",
"freeStorageSpaceInBytes": 41588621312
}]
}Note: isRooted is not a valid $select field on managedDevice. If a field causes a 400, drop it and retry.
3. Inspect compliance and configuration state
GET /beta/deviceManagement/managedDevices/{deviceId}/deviceCompliancePolicyStates
GET /beta/deviceManagement/managedDevices/{deviceId}/deviceConfigurationStatesLook for entries with "state": "error" or "nonCompliant".
4. Trigger a remote sync
POST https://graph.microsoft.com/beta/deviceManagement/managedDevices/{deviceId}/syncDeviceA 204 No Content indicates the command was queued. The device picks it up on its next check-in channel (typically within minutes for online devices).
5. (Optional) Escalate to reboot
POST /beta/deviceManagement/managedDevices/{deviceId}/rebootNowAudit and sync with PowerShell
Uses the Microsoft.Graph module. Install once with Install-Module Microsoft.Graph -Scope CurrentUser.
1. Connect with the right scopes
Connect-MgGraph -Scopes "User.Read.All","DeviceManagementManagedDevices.Read.All","DeviceManagementManagedDevices.PrivilegedOperations.All","DeviceManagementConfiguration.Read.All"2. Resolve user and list devices
$user = Get-MgUser -Filter "startswith(displayName,'Alex W')" | Select-Object -First 1
$devices = Get-MgUserManagedDevice -UserId $user.Id
$devices | Select-Object DeviceName,OperatingSystem,ComplianceState,LastSyncDateTime,@{n='FreeGB';e={[math]::Round($_.FreeStorageSpaceInBytes/1GB,1)}}3. Inspect compliance policy states
$deviceId = $devices[0].Id
Invoke-MgGraphRequest -Method GET -Uri "/beta/deviceManagement/managedDevices/$deviceId/deviceCompliancePolicyStates"4. Trigger the sync
Sync-MgDeviceManagementManagedDevice -ManagedDeviceId $deviceIdThe downloadable script below wraps all of this into a single audit-and-sync function with parameters, error handling, and a formatted report.
Next steps