📱 Recipe · Intune & Device Management
Generate a Fleet-Level Intune Device Performance and UX Summary
Produce a cross-platform fleet health report covering slow devices, storage pressure, stale sync, policy conflicts, and prioritized remediations from Microsoft Intune and Endpoint Analytics.
Complexity
Intermediate
Impact
fleet-health + reporting + endpoint-analytics + device-compliance + remediation-planning
Context
Why This Matters
Why this matters
IT leadership and device support teams regularly need a single, defensible view of fleet health — not one device at a time, but the whole estate. Endpoint Analytics and Intune expose dozens of signals (boot time, app reliability, storage, compliance state, policy conflicts), but the data is scattered across different Graph endpoints and the Intune UI. This recipe stitches those signals together into one fleet-level summary with a ranked remediation list.
When to run this
- Monthly or quarterly device health review
- Before a Windows feature update or major OS upgrade wave
- When leadership asks "how is our fleet doing?" and you need a real answer
- After a large enrollment event (M&A, new office, refresh cycle)
- When user-reported performance complaints start trending up
What it solves
Replaces ad-hoc spreadsheet pulls and GUI spelunking with a repeatable, data-driven fleet summary that surfaces the highest-impact issues (low storage, unencrypted devices, stale sync, policy conflicts) and turns them into prioritized actions.
Expected Outcomes
After completing this recipe you will have
- A fleet-wide inventory summary (total devices, OS breakdown, ownership split)
- Compliance health: compliant / non-compliant / grace-period / unknown counts with a sample of offenders
- Configuration policy health: success / error / conflict / not-applicable counts per policy, with failing policies ranked by impact
- Endpoint Analytics performance data (where enrolled): device scores, boot-time outliers, startup performance
- A list of low-storage devices (<10% free) — often the biggest real-world UX killer
- A list of stale devices (30+ and 90+ days since last sync) for retirement/cleanup
- A count of unencrypted devices for security remediation
- A ranked, actionable remediation plan (Critical / High / Medium) that you can hand to a tech lead or leadership
Risks & Considerations
Warnings & gotchas
- Endpoint Analytics may not be enrolled. Several endpoints (
userExperienceAnalyticsBaselines,userExperienceAnalyticsDeviceScores,userExperienceAnalyticsDeviceStartupHistory) return empty arrays or 400/500 errors if the tenant has not onboarded Endpoint Analytics or if devices haven't yet uploaded telemetry. The script falls back to managed-device data when this happens — don't assume an empty result means a healthy fleet. - Android work-profile storage reporting is quirky. Many Android Enterprise work-profile devices report 0 GB free because the number reflects only the work-profile partition, not the actual device. Validate a sample before creating tickets for 100+ "out of storage" Android devices.
- "Not applicable" is not a failure. A config policy showing 265 not-applicable devices usually means platform-scoped (Windows-only policy on iOS devices). Don't flag these as broken.
- Stale-sync can mean retired hardware. Before taking remedial action on 90+ day stale devices, check whether they've been formally decommissioned. Retiring an active-but-misconfigured device will surprise users.
- Do not auto-wipe based on this report. This is a read-only audit. Wipes and retires should be a separate, deliberate workflow with approval.
- Permissions scope. You need at least
DeviceManagementManagedDevices.Read.AllandDeviceManagementConfiguration.Read.All. For Endpoint Analytics, addDeviceManagementManagedDevices.Read.All(already covered) — Microsoft has historically rebranded these, so consent prompts may list additional scopes.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| DeviceManagementManagedDevices.Read.All | Read managed device inventory, compliance state, storage, encryption status, and Endpoint Analytics device data |
| DeviceManagementConfiguration.Read.All | Read device configuration policies and their device-state summaries to identify conflicts and failures |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
Manual walkthrough — Microsoft Intune admin center
Use this path when you want a visual read and are happy clicking through several blades. Budget ~45 minutes for a 500–1000 device fleet.
1. Fleet overview
Microsoft Intune admin center → Devices → Overview
Capture: total enrolled devices, enrollment failures, platform breakdown, compliance status donut.
2. Endpoint Analytics scores
Reports → Endpoint analytics → Overview
Capture the top-level score and subscores for Startup performance, Application reliability, and Work from anywhere. If the page says "Not enrolled" or "Not enough data", skip Endpoint Analytics sections and note it in your report.
3. Startup performance (boot times)
Reports → Endpoint analytics → Startup performance → Device performance
Sort by Boot time descending. Export the top 50 slowest devices to CSV.
4. Application reliability
Reports → Endpoint analytics → Application reliability
Identify apps with the highest crash/hang counts across the fleet.
5. Device compliance
Devices → Monitor → Device compliance
Note compliant vs non-compliant counts. Click into non-compliant to export the list.
6. Configuration profile health
Devices → Monitor → Assignment failures
Lists every profile with failed or conflicted assignments and the device counts. This is where policy conflicts surface.
7. Devices with issues
Devices → Monitor → Devices with restart issues / Noncompliant devices / Devices without compliance policy
Each blade gives you a focused slice of problem devices.
8. Storage & stale sync
Devices → All devices → (add columns) Free storage space, Last check-in
Sort by Free storage ascending and Last check-in ascending to surface low-storage and stale devices. Export to CSV.
9. Build the summary
In Excel/Sheets, combine the exports into one workbook and produce: OS breakdown, compliance %, top-10 slowest boot devices, top-25 low-storage devices, stale devices 30/90+ days, top failing policies, and a prioritized remediation list (Critical / High / Medium).
Graph API recipe
The fastest way to assemble the summary is a handful of Graph calls to Intune's deviceManagement namespace. All examples use the beta endpoint because many Endpoint Analytics resources are only exposed there.
1. Request the scopes
Scopes: DeviceManagementManagedDevices.Read.All, DeviceManagementConfiguration.Read.All2. Fleet overview
GET https://graph.microsoft.com/beta/deviceManagement/managedDeviceOverviewReturns enrolledDeviceCount, mdmEnrolledCount, dualEnrolledDeviceCount, and a deviceOperatingSystemSummary object with per-OS counts.
3. All managed devices (paginated)
GET https://graph.microsoft.com/beta/deviceManagement/managedDevices?$top=100&$select=id,deviceName,userPrincipalName,userDisplayName,operatingSystem,osVersion,complianceState,managedDeviceOwnerType,model,manufacturer,totalStorageSpaceInBytes,freeStorageSpaceInBytes,lastSyncDateTime,isEncryptedFollow @odata.nextLink until exhausted. Compute: OS counts, compliance counts, storage %, stale-sync buckets, encryption status.
4. Config policy health summary
GET https://graph.microsoft.com/beta/deviceManagement/deviceConfigurationDeviceStateSummariesReturns fleet-wide totals: compliantDeviceCount, nonCompliantDeviceCount, errorDeviceCount, conflictDeviceCount, notApplicableDeviceCount.
5. Per-policy config status
GET https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations?$select=id,displayName
GET https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations/{id}/deviceStatusOverviewIterate policies and pull the overview for each. Flag any with failedCount, errorCount, or conflictCount > 0.
6. Compliance policies
GET https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies?$select=id,displayName
GET https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies/{id}/deviceStatusOverview7. Endpoint Analytics (if enrolled)
GET https://graph.microsoft.com/beta/deviceManagement/userExperienceAnalyticsBaselines
GET https://graph.microsoft.com/beta/deviceManagement/userExperienceAnalyticsDeviceScores?$top=50&$orderby=endpointAnalyticsScore asc
GET https://graph.microsoft.com/beta/deviceManagement/userExperienceAnalyticsDeviceStartupHistory?$top=100&$orderby=totalBootTimeInMs descThese may return empty arrays or 400/500 errors if Endpoint Analytics is not onboarded. Handle that gracefully and fall back to device-derived performance signals (low storage, stale sync).
8. Detected apps (optional)
GET https://graph.microsoft.com/beta/deviceManagement/detectedApps?$top=20&$orderby=deviceCount descUseful for identifying fleet-wide outdated or suspect software.
Example response fragment — managedDeviceOverview
{
"enrolledDeviceCount": 600,
"mdmEnrolledCount": 321,
"deviceOperatingSystemSummary": {
"windowsCount": 287,
"iosCount": 166,
"androidCount": 147
}
}PowerShell recipe — Microsoft Graph SDK
The script below authenticates with Microsoft Graph PowerShell, pulls everything the API recipe covers, and emits a structured summary object (plus optional CSV exports).
Prerequisites
Microsoft.GraphPowerShell module installed (Install-Module Microsoft.Graph -Scope CurrentUser)- Permission to consent to
DeviceManagementManagedDevices.Read.AllandDeviceManagementConfiguration.Read.All - PowerShell 7+ recommended
What the script does
- Connects to Graph with the required scopes
- Pulls the managed-device overview and every managed device (paginated)
- Pulls config & compliance policies and each policy's device-status overview
- Attempts Endpoint Analytics calls and handles "not enrolled" errors gracefully
- Computes: OS breakdown, compliance %, low-storage devices (<10% free), stale devices (30d & 90d), unencrypted devices, failing policies
- Writes a fleet summary to the console and optional CSVs to
-OutputPath
Run it
.\Get-IntuneFleetHealthReport.ps1 -OutputPath "C:\Reports\IntuneFleet" -StaleDays 30 -LowStoragePct 10On first run you'll be prompted to consent to the two scopes. The script writes FleetSummary.json, NonCompliantDevices.csv, LowStorageDevices.csv, StaleDevices.csv, and FailingPolicies.csv to the output path.
Next steps