📱 Recipe · Intune & Device Management

List Intune managed devices for a specific user

Retrieve all Intune-enrolled devices assigned to a user, including OS, model, serial number, and compliance state

Complexity

Beginner

Impact

read-only + device-management + user-lookup + audit

Context

Why This Matters

When supporting an end user — whether troubleshooting a device issue, preparing for offboarding, or auditing hardware — IT admins frequently need to quickly answer the question: What devices does this person have enrolled in Intune?

Intune (Microsoft Endpoint Manager) tracks every enrolled device and associates it with a primary user (the user who enrolled it or was assigned via Autopilot). Listing those devices gives you a consolidated view of the user's mobile phones, laptops, and tablets, along with each device's compliance posture and identifying hardware details.

Common triggers for running this recipe:

User reports a problem and you need to identify which device to investigate
Offboarding — you need to wipe or retire every device the user owns
Compliance audit — confirming a user's devices meet policy
Hardware inventory / asset reconciliation
Investigating suspicious sign-ins from an unknown device

Expected Outcomes

After completing this recipe you will have:

A list of every Intune managed device where the target user is the primary user
For each device: device name, operating system and version, model, serial number, enrollment date, last check-in, and compliance state
The device ID (used as input to downstream actions like wipe, retire, sync, or remove primary user)
A reusable script you can rerun for any UPN on demand

Risks & Considerations

Things to watch for

Primary user vs. registered user: managedDevices filtered by userPrincipalName returns devices where the user is the primary user. A device shared across multiple users may not appear for every sign-in user. Use the users/{id}/managedDevices or registeredOwners/registeredUsers relationships if you need a different view.
Stale records: A device may appear even if it hasn't checked in for weeks. Always inspect lastSyncDateTime before taking destructive actions.
Permissions scope: DeviceManagementManagedDevices.Read.All is tenant-wide. Only grant it to accounts or apps that genuinely need Intune visibility.
PII: Device serial numbers and names can identify individuals. Treat exports as sensitive and store them accordingly.
Do not trigger a wipe or retire from this recipe — it is read-only. Use a dedicated, reviewed workflow for destructive device actions.

Required Permissions

Permission	Why It's Needed
DeviceManagementManagedDevices.Read.All	Required to read Intune managed device records tenant-wide, including the devices associated with a specific user.
User.Read.All	Required to resolve the target user's UPN to a directory object and confirm display name before listing their devices.

The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.

For IT Admins

Paste into Dex Pro

List all Intune managed devices for {user}. Include device name, OS and version, model, serial number, compliance state, and last check-in date.

Try in Dex Pro

List a user's Intune devices via the Intune admin center

Sign in to the Microsoft Intune admin center with an account that has at least the Intune Service Administrator or Help Desk Operator role.
In the left navigation, go to Users > All users.
Search for the target user by display name or UPN (for example, jane.doe@contoso.com) and click their name to open the user profile.
In the user blade, select Devices from the left menu.
You will see a table of every Intune-managed device where this user is the primary user, including:
- Device name
- Managed by (Intune / Co-managed)
- Ownership (Corporate / Personal)
- Compliance
- OS and OS version
- Last check-in
Click any device row to drill into hardware details (serial number, model, IMEI), compliance policy results, assigned apps, and available remote actions.
(Optional) Use the Export button at the top of the device list to download a CSV.

Alternative: the Devices blade

You can also go to Devices > All devices and filter the Primary user UPN column — useful when you want to compare across multiple users in one view.

List devices for a user via Microsoft Graph

The flow is two calls: first resolve the user, then query managedDevices filtered by UPN.

1. Resolve the user

GET https://graph.microsoft.com/v1.0/users/{userPrincipalName}?$select=id,displayName,userPrincipalName

Example response:

{
  "id": "8a5f...e2b1",
  "displayName": "Jane Doe",
  "userPrincipalName": "jane.doe@contoso.com"
}

2. List the user's managed devices

GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices
  ?$filter=userPrincipalName eq 'jane.doe@contoso.com'
  &$select=id,deviceName,operatingSystem,osVersion,model,manufacturer,serialNumber,complianceState,lastSyncDateTime,enrolledDateTime,managedDeviceOwnerType

Example response:

{
  "value": [
    {
      "id": "c1d2...9f0a",
      "deviceName": "JDOE-LAPTOP",
      "operatingSystem": "Windows",
      "osVersion": "10.0.22631.4317",
      "model": "Latitude 7440",
      "serialNumber": "ABCD1234",
      "complianceState": "compliant",
      "lastSyncDateTime": "2025-01-14T08:22:11Z"
    }
  ]
}

Alternative endpoint

You can also use the user-relative navigation which is equivalent but reads more naturally in code:

GET https://graph.microsoft.com/v1.0/users/{id}/managedDevices

Required permissions

User.Read.All (delegated or application) — to resolve the user
DeviceManagementManagedDevices.Read.All (delegated or application) — to read managed devices

The first call may return HTTP 403 Insufficient privileges if the signed-in account or app lacks consent. Grant admin consent for both scopes in Entra ID > Enterprise applications > {app} > Permissions.

List a user's Intune devices with Microsoft Graph PowerShell

The Microsoft.Graph PowerShell SDK wraps the Graph endpoints above. Install it once, connect with the right scopes, then call Get-MgDeviceManagementManagedDevice.

1. Install and import the module

Install-Module Microsoft.Graph -Scope CurrentUser
Import-Module Microsoft.Graph.DeviceManagement
Import-Module Microsoft.Graph.Users

2. Connect with the required scopes

Connect-MgGraph -Scopes "User.Read.All", "DeviceManagementManagedDevices.Read.All"

You will be prompted to sign in and consent. An admin must grant consent the first time these scopes are used in the tenant.

3. Look up the user and list their devices

$upn = 'jane.doe@contoso.com'
$user = Get-MgUser -UserId $upn -Property Id,DisplayName,UserPrincipalName

$devices = Get-MgDeviceManagementManagedDevice -Filter "userPrincipalName eq '$upn'" -All

$devices | Select-Object DeviceName, OperatingSystem, OsVersion, Model, SerialNumber, ComplianceState, LastSyncDateTime | Format-Table -AutoSize

4. (Optional) Export to CSV

$devices | Select-Object DeviceName, OperatingSystem, OsVersion, Model, SerialNumber, ComplianceState, LastSyncDateTime, EnrolledDateTime |
  Export-Csv -Path ".\$($user.DisplayName)-devices.csv" -NoTypeInformation

Use the downloadable script below for a parameterised, reusable version with error handling.

Next steps

More Intune & Device Management recipes

Browse the rest of this category in the Dex Cookbook.

Automate this with Dex Pro

Let the autonomous IT engineer run this task under your policies.

Start free

Point Dex at a tenant and try it for 30 days, no credit card.