📱 Recipe · Intune & Device Management
List All Intune Managed Devices in the Tenant
Inventory every Intune-enrolled device with owner, OS, and compliance state
Complexity
Beginner
Impact
read-only + reporting + no-user-impact + inventory
Context
Why This Matters
A current inventory of Intune-managed devices is the foundation of almost every device-support workflow: compliance auditing, OS upgrade planning, lost/stolen investigations, license reconciliation, and offboarding. Microsoft Intune exposes every enrolled device through the deviceManagement/managedDevices endpoint in Microsoft Graph.
Run this recipe when you need a point-in-time snapshot of the fleet — for example, before a compliance policy rollout, when preparing an executive health report, or when triaging a help-desk ticket that asks "how many devices does {user} have?". The same query also backs ad-hoc filters like "show me all non-compliant Android devices" or "which Macs haven't synced in 30 days?".
Expected Outcomes
- A complete list of every device enrolled in Intune, including personal and corporate-owned.
- Per-device metadata: device name, primary user (UPN), operating system and version, manufacturer, model, serial number, compliance state, encryption status, and last sync time.
- An exportable dataset (CSV/JSON) you can pivot on for reporting, filter by compliance state, or feed into downstream automation.
- A baseline device count for the tenant that can be compared over time.
Risks & Considerations
Things to watch for
- Large tenants paginate. Graph returns 1,000 devices per page by default. Always follow
@odata.nextLinkuntil it is absent, or you will silently undercount. - Beta endpoint. The
/beta/endpoint exposes richer fields but is not covered by Microsoft's production SLA. Use/v1.0/for anything automated or alert-driven. - PII considerations. The result set contains user principal names, serial numbers, IMEIs, and MAC addresses. Treat exports as sensitive and store them according to your data-handling policy.
- Stale records. Devices that were retired or wiped may linger for up to 30 days. Filter on
lastSyncDateTimeif you need an "active" list. - Throttling. Very large tenants (50k+ devices) may hit Graph throttling. Use
$selectto reduce payload size and respectRetry-Afterheaders.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| DeviceManagementManagedDevices.Read.All | Required to read managed device inventory from Intune via Microsoft Graph. |
| Directory.Read.All | Optional — needed if you want to resolve device primary-user details beyond the UPN returned in the managed device record. |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
List managed devices in the Intune admin center
- Sign in to the Microsoft Intune admin center as a Global Administrator, Intune Administrator, or custom role with read access to devices.
- In the left navigation, go to
Devices › All devices
- The All devices blade lists every enrolled device with columns for Name, Managed by, Ownership, Compliance, OS, OS version, Last check-in, and Primary user.
- Use the Columns button to add optional fields such as Serial number, Model, Manufacturer, or Device category.
- Use the Filter pane to narrow the list by OS, compliance state, ownership, or enrollment type.
- Click Export at the top of the grid to download the current (filtered) view as a CSV file. The export is capped at the Intune portal's row limit — for full-tenant exports use the API or PowerShell recipe below.
Viewing a single device
Click any row to open the device blade. The Overview tab shows hardware details, compliance, and primary user. The Properties tab shows scope tags, category, and notes.
List managed devices via Microsoft Graph
Endpoint
GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices
For richer fields (e.g. managedDeviceOwnerType, isEncrypted, azureADDeviceId), use the beta endpoint:
GET https://graph.microsoft.com/beta/deviceManagement/managedDevices
Recommended query with $select
GET /beta/deviceManagement/managedDevices?$select=id,deviceName,userPrincipalName,operatingSystem,osVersion,complianceState,model,manufacturer,serialNumber,lastSyncDateTime,isEncrypted
Example response (truncated)
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceManagement/managedDevices",
"@odata.nextLink": "https://graph.microsoft.com/beta/deviceManagement/managedDevices?$skiptoken=...",
"value": [
{
"id": "9f420691-1c67-4b46-b154-0e1b1342f4c4",
"deviceName": "DESKTOP-EXOTIC-SUBSIDY891",
"userPrincipalName": "user@contoso.com",
"operatingSystem": "Windows",
"complianceState": "nonCompliant",
"model": "Surface Laptop 5",
"manufacturer": "Microsoft"
}
]
}Common filters
- Non-compliant only:
?$filter=complianceState eq 'nonCompliant' - macOS only:
?$filter=operatingSystem eq 'macOS' - Stale (not synced in 30 days):
?$filter=lastSyncDateTime le 2024-01-01T00:00:00Z - Single user:
?$filter=userPrincipalName eq '{user}'
Pagination
When the response contains @odata.nextLink, issue a GET against that URL to retrieve the next page. Repeat until the property is absent.
List managed devices with PowerShell (Microsoft Graph SDK)
Prerequisites
Install-Module Microsoft.Graph -Scope CurrentUser Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"
Simple listing
Get-MgDeviceManagementManagedDevice -All | Select-Object DeviceName, UserPrincipalName, OperatingSystem, OsVersion, ComplianceState, Manufacturer, Model
Export to CSV
Get-MgDeviceManagementManagedDevice -All | Select-Object DeviceName, UserPrincipalName, OperatingSystem, OsVersion, ComplianceState, Manufacturer, Model, SerialNumber, LastSyncDateTime | Export-Csv -Path "IntuneDevices.csv" -NoTypeInformation
The cmdlet handles pagination automatically when -All is supplied.
Use the downloadable script below for a production-ready version with parameters for output path, OS filter, compliance filter, and a summary report.
Next steps