๐Ÿ“ฑ Recipe ยท Intune & Device Management

List All Intune Managed Devices in the Tenant

Inventory every Intune-enrolled device with owner, OS, and compliance state

Complexity

Beginner

Impact

read-only + reporting + no-user-impact + inventory

Context

Why This Matters

A current inventory of Intune-managed devices is the foundation of almost every device-support workflow: compliance auditing, OS upgrade planning, lost/stolen investigations, license reconciliation, and offboarding. Microsoft Intune exposes every enrolled device through the deviceManagement/managedDevices endpoint in Microsoft Graph.

Run this recipe when you need a point-in-time snapshot of the fleet โ€” for example, before a compliance policy rollout, when preparing an executive health report, or when triaging a help-desk ticket that asks "how many devices does {user} have?". The same query also backs ad-hoc filters like "show me all non-compliant Android devices" or "which Macs haven't synced in 30 days?".

Expected Outcomes

  • A complete list of every device enrolled in Intune, including personal and corporate-owned.
  • Per-device metadata: device name, primary user (UPN), operating system and version, manufacturer, model, serial number, compliance state, encryption status, and last sync time.
  • An exportable dataset (CSV/JSON) you can pivot on for reporting, filter by compliance state, or feed into downstream automation.
  • A baseline device count for the tenant that can be compared over time.

Risks & Considerations

Things to watch for

  • Large tenants paginate. Graph returns 1,000 devices per page by default. Always follow @odata.nextLink until it is absent, or you will silently undercount.
  • Beta endpoint. The /beta/ endpoint exposes richer fields but is not covered by Microsoft's production SLA. Use /v1.0/ for anything automated or alert-driven.
  • PII considerations. The result set contains user principal names, serial numbers, IMEIs, and MAC addresses. Treat exports as sensitive and store them according to your data-handling policy.
  • Stale records. Devices that were retired or wiped may linger for up to 30 days. Filter on lastSyncDateTime if you need an "active" list.
  • Throttling. Very large tenants (50k+ devices) may hit Graph throttling. Use $select to reduce payload size and respect Retry-After headers.

Required Permissions

PermissionWhy It's Needed
DeviceManagementManagedDevices.Read.AllRequired to read managed device inventory from Intune via Microsoft Graph.
Directory.Read.AllOptional โ€” needed if you want to resolve device primary-user details beyond the UPN returned in the managed device record.

The fastest way to get this done โ€” just ask Dex. Copy the prompt below and paste it into your Dex conversation.

For IT Admins

Paste into Dex CoAdmin

List every Intune-managed device in the tenant. Include device name, primary user, OS and version, manufacturer, model, and compliance state. Summarize totals by OS and by compliance status, and flag anything that hasn't synced in the last 30 days.
Try in Dex CoAdmin