๐ฑ Recipe ยท Intune & Device Management
List All Intune Managed Devices in the Tenant
Inventory every Intune-enrolled device with owner, OS, and compliance state
Complexity
Beginner
Impact
read-only + reporting + no-user-impact + inventory
Context
Why This Matters
A current inventory of Intune-managed devices is the foundation of almost every device-support workflow: compliance auditing, OS upgrade planning, lost/stolen investigations, license reconciliation, and offboarding. Microsoft Intune exposes every enrolled device through the deviceManagement/managedDevices endpoint in Microsoft Graph.
Run this recipe when you need a point-in-time snapshot of the fleet โ for example, before a compliance policy rollout, when preparing an executive health report, or when triaging a help-desk ticket that asks "how many devices does {user} have?". The same query also backs ad-hoc filters like "show me all non-compliant Android devices" or "which Macs haven't synced in 30 days?".
Expected Outcomes
- A complete list of every device enrolled in Intune, including personal and corporate-owned.
- Per-device metadata: device name, primary user (UPN), operating system and version, manufacturer, model, serial number, compliance state, encryption status, and last sync time.
- An exportable dataset (CSV/JSON) you can pivot on for reporting, filter by compliance state, or feed into downstream automation.
- A baseline device count for the tenant that can be compared over time.
Risks & Considerations
Things to watch for
- Large tenants paginate. Graph returns 1,000 devices per page by default. Always follow
@odata.nextLinkuntil it is absent, or you will silently undercount. - Beta endpoint. The
/beta/endpoint exposes richer fields but is not covered by Microsoft's production SLA. Use/v1.0/for anything automated or alert-driven. - PII considerations. The result set contains user principal names, serial numbers, IMEIs, and MAC addresses. Treat exports as sensitive and store them according to your data-handling policy.
- Stale records. Devices that were retired or wiped may linger for up to 30 days. Filter on
lastSyncDateTimeif you need an "active" list. - Throttling. Very large tenants (50k+ devices) may hit Graph throttling. Use
$selectto reduce payload size and respectRetry-Afterheaders.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| DeviceManagementManagedDevices.Read.All | Required to read managed device inventory from Intune via Microsoft Graph. |
| Directory.Read.All | Optional โ needed if you want to resolve device primary-user details beyond the UPN returned in the managed device record. |
The fastest way to get this done โ just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex CoAdmin