Investigate a User's Device Health and Performance via Intune

Investigate a device via the Intune admin center

1. Sign in to the Microsoft Intune admin center:

   https://intune.microsoft.com

2. In the left nav, go to:

   Users → All users

   Search for the affected user (e.g. Alex Wilber) and open their profile.

3. In the user's profile, select Devices from the left nav. Note the Device name, OS, and Last check-in for each managed device.

4. Click the specific device name to open its blade. Review the Overview tab for:

   • Hardware model / manufacturer
   • OS version
   • Primary user
   • Compliance state
   • Last check-in

5. Click Hardware in the left nav of the device blade. This is the most important view for performance triage. Review:

   • Total physical memory (RAM) — flag anything below 8 GB for knowledge workers.
   • Total / free storage — flag less than 15% free.
   • BitLocker / encryption status.
   • Processor and architecture.

6. Click Device compliance to see which compliance policies are applied and their state. Look for any policy in an Error state (not just Not compliant).

7. Click Device configuration to see applied configuration profiles and their state.

8. Click Discovered apps to see the full list of installed software. Sort by size or look for known resource-intensive apps.

9. For deeper performance data, go to:

   Reports → Endpoint analytics → Startup performance / Application reliability / Resource performance

   Find the device by name and review startup time, crash rate, CPU and RAM spike history.

10. Summarize findings in the ticket and, if needed, trigger a Sync or Restart action from the top of the device blade.

Investigate a device via Microsoft Graph

Run these calls in sequence. Replace placeholder values as noted.

1. Resolve the user

GET https://graph.microsoft.com/v1.0/users?$filter=userPrincipalName eq '{user_upn}'&$select=id,displayName,userPrincipalName

Capture id from the response — this is your {user_id}.

2. List the user's managed devices

GET https://graph.microsoft.com/v1.0/users/{user_id}/managedDevices?$select=id,deviceName,operatingSystem,complianceState,lastSyncDateTime,model,manufacturer,totalStorageSpaceInBytes,freeStorageSpaceInBytes

Example response:

{
  "value": [{
    "id": "db25e629-e2f8-4a8e-ad4c-18d27cfa68c3",
    "deviceName": "DESKTOP-PHSSKAD",
    "operatingSystem": "Windows",
    "complianceState": "compliant",
    "lastSyncDateTime": "2026-02-21T10:37:45Z",
    "model": "VMware7,1",
    "totalStorageSpaceInBytes": 85248180224,
    "freeStorageSpaceInBytes": 42253418496
  }]
}

Capture id as {device_id}.

3. Pull the full hardware/security profile (beta)

GET https://graph.microsoft.com/beta/deviceManagement/managedDevices/{device_id}?$select=id,deviceName,operatingSystem,osVersion,complianceState,lastSyncDateTime,managementAgent,model,manufacturer,enrolledDateTime,totalStorageSpaceInBytes,freeStorageSpaceInBytes,isEncrypted,managedDeviceOwnerType,deviceEnrollmentType,physicalMemoryInBytes

The physicalMemoryInBytes and isEncrypted fields are only on the /beta endpoint — you need them.

4. Check compliance policy states

GET https://graph.microsoft.com/beta/deviceManagement/managedDevices/{device_id}/deviceCompliancePolicyStates

Flag any entry where state != "compliant". An error state often indicates a broken policy assignment or missing platform setting.

5. Check configuration profile states

GET https://graph.microsoft.com/beta/deviceManagement/managedDevices/{device_id}/deviceConfigurationStates

6. Enumerate detected apps (paginated)

GET https://graph.microsoft.com/beta/deviceManagement/managedDevices/{device_id}/detectedApps?$top=50

Follow @odata.nextLink to get all pages.

Interpreting the result

• physicalMemoryInBytes < 8589934592 (8 GB) → likely RAM-bound on Windows 10/11.
• freeStorageSpaceInBytes / totalStorageSpaceInBytes < 0.15 → low disk, will slow swap and updates.
• isEncrypted == false on a corporate device → security gap, enable BitLocker.
• lastSyncDateTime older than 24h → data may be stale; POST a syncDevice action.

Investigate a device with PowerShell

The Microsoft Graph PowerShell SDK wraps the Graph calls above into cmdlets. This approach is ideal when you want a reusable script you can run from a helpdesk console.

Prerequisites

# Install the SDK (one time)
Install-Module Microsoft.Graph -Scope CurrentUser

# Sign in with the required scopes
Connect-MgGraph -Scopes "User.Read.All","DeviceManagementManagedDevices.Read.All","DeviceManagementConfiguration.Read.All","DeviceManagementApps.Read.All"

Walkthrough

1. Resolve the user from UPN or display name:

   $user = Get-MgUser -Filter "userPrincipalName eq 'AlexW@contoso.com'"

2. List their managed devices:

   $devices = Get-MgUserManagedDevice -UserId $user.Id

3. Pull the full device profile from the beta endpoint (needed for physicalMemoryInBytes and isEncrypted):

   $deviceDetail = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/deviceManagement/managedDevices/$($devices[0].Id)"

4. Check compliance and configuration states, then enumerate detected apps (handling pagination).

5. Apply thresholds to produce a findings summary: RAM < 8 GB, free storage < 15%, encryption off, stale sync, compliance errors.

The downloadable script below automates all of this and prints a formatted report.