📱 Recipe · Intune & Device Management

Trigger an Intune Device Sync/Check-in and Verify Status

Force a managed device to check in with Intune immediately when policies or updates aren't landing

Complexity

Beginner

Impact

device-management + troubleshooting + intune + end-user-support

Context

Why This Matters

When an end user reports that they aren't receiving expected Intune policies, configuration profiles, apps, or compliance updates, the most common first-line remediation is to force the device to check in with the Intune service. By default, Windows, macOS, iOS, and Android devices check in with Intune on a schedule (typically every 8 hours once enrolled for longer than a day). A manual sync collapses that wait window to minutes.

This recipe walks through identifying a user's managed device, issuing the remote syncDevice action, and verifying the check-in completed successfully.

When to run this

User reports missing apps, Wi-Fi/VPN profiles, or certificates pushed from Intune
Compliance policy changes aren't reflected on the device
You've just assigned a new configuration profile and want to validate deployment
Troubleshooting a stale lastSyncDateTime value

Expected Outcomes

After completing this recipe you will have:

Located the target user's managed device(s) in Intune
Issued a remote sync command that forces an immediate MDM check-in
Confirmed the command was accepted by the Intune service (HTTP 204)
Verified the device's updated lastSyncDateTime and current compliance state
A clear status report you can share with the requester

Risks & Considerations

Things to watch for

Device must be online. The sync command is a push notification — if the device is offline, powered off, or on a restricted network, the action will queue but won't complete until the device connects.
lastSyncDateTime lag. The timestamp in Graph may take 1–5 minutes to update after the device actually checks in. Don't interpret a stale timestamp as a failure immediately.
deviceActionResults quirk. The syncDevice action may not always appear in the deviceActionResults array. Use lastSyncDateTime as the authoritative signal that the check-in happened.
Not a fix for enrollment issues. If the device is unenrolled, broken-trust, or the MDM agent is corrupted, a sync won't help — you'll need to re-enroll.
Rate limits. Avoid looping sync commands against the same device. One sync, then wait 5–10 minutes before retrying.

Required Permissions

Permission	Why It's Needed
User.Read.All	Resolve the target user's UPN and object ID from their display name
DeviceManagementManagedDevices.Read.All	Query managed device inventory and read compliance/sync state
DeviceManagementManagedDevices.PrivilegedOperations.All	Execute the syncDevice remote action against a managed device

The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.

For IT Admins

Paste into Dex Pro

{user} isn't receiving Intune policies or updates. Trigger an immediate Intune sync/check-in on their managed device(s), verify the check-in completed, and report the current compliance state and last-sync timestamp.

Try in Dex Pro

For End Users

How an employee would ask Dex for help

My work laptop isn't getting the latest company settings or apps from IT — can you push them to me now?

Try in Dex Playground

Trigger a device sync from the Intune admin center

Sign in to the Microsoft Intune admin center at https://intune.microsoft.com with an account that has at least the Intune Administrator or Help Desk Operator role.
Navigate to:
Devices → All devices
In the search box, type the user's name or device name (e.g., Alex Wilber or DESKTOP-PHSSKAD) and select the target device from the list.
On the device overview blade, note the current Last check-in timestamp and Compliance state as a baseline.
In the command bar at the top of the device blade, click Sync. (On mobile layouts it may live under the ... overflow menu.)
Confirm the action in the prompt. You should see a notification: Sync device action was initiated successfully.
Wait 2–5 minutes, then refresh the device blade and confirm the Last check-in timestamp has advanced.
Optionally, review the Device configuration and Device compliance tabs to confirm assigned policies now show as Succeeded.

Alternative: end-user initiated sync

On a Windows device the user can also sync themselves from Settings → Accounts → Access work or school → Connected account → Info → Sync. This is useful if the admin can't reach the device remotely.

Trigger a sync via Microsoft Graph

The flow is three calls: find the user, find their device, issue the sync, then verify.

1. Find the user

GET https://graph.microsoft.com/v1.0/users?$filter=startswith(displayName,'{displayName}')&$select=id,displayName,userPrincipalName

Example response:

{
  "value": [{
    "id": "12a7116b-bbad-4f0a-9738-2fd51b2509ee",
    "displayName": "Alex Wilber",
    "userPrincipalName": "AlexW@contoso.onmicrosoft.com"
  }]
}

2. List the user's managed devices

GET https://graph.microsoft.com/beta/deviceManagement/managedDevices?$filter=userPrincipalName eq '{upn}'&$select=id,deviceName,operatingSystem,complianceState,lastSyncDateTime,managementAgent,model

Capture the device id — a GUID like db25e629-e2f8-4a8e-ad4c-18d27cfa68c3.

3. Trigger the sync

POST https://graph.microsoft.com/beta/deviceManagement/managedDevices/{deviceId}/syncDevice

No request body is required. A successful response is HTTP 204 No Content, meaning Intune has accepted the command and queued it for delivery to the device.

4. Verify

GET https://graph.microsoft.com/beta/deviceManagement/managedDevices/{deviceId}?$select=id,deviceName,complianceState,lastSyncDateTime,deviceActionResults

Inspect lastSyncDateTime — it should advance within a few minutes if the device is online. The deviceActionResults array sometimes contains a syncDevice entry with actionState: done, but don't rely on that alone; the timestamp is the ground truth.

Required permissions

User.Read.All
DeviceManagementManagedDevices.Read.All
DeviceManagementManagedDevices.PrivilegedOperations.All

Trigger a device sync with PowerShell

The Microsoft Graph PowerShell SDK wraps the Graph endpoints above into cmdlets. The key cmdlet is Sync-MgBetaDeviceManagementManagedDevice.

Prerequisites

Install-Module Microsoft.Graph.Beta.DeviceManagement.Actions -Scope CurrentUser
Install-Module Microsoft.Graph.Beta.DeviceManagement -Scope CurrentUser
Install-Module Microsoft.Graph.Users -Scope CurrentUser

Connect with the right scopes

Connect-MgGraph -Scopes "User.Read.All","DeviceManagementManagedDevices.Read.All","DeviceManagementManagedDevices.PrivilegedOperations.All"

Lookup → sync → verify

# 1. Resolve the user
$user = Get-MgUser -Filter "displayName eq 'Alex Wilber'"

# 2. Get their managed devices
$devices = Get-MgBetaDeviceManagementManagedDevice -Filter "userPrincipalName eq '$($user.UserPrincipalName)'"

# 3. Trigger sync on each
foreach ($d in $devices) {
    Sync-MgBetaDeviceManagementManagedDevice -ManagedDeviceId $d.Id
    Write-Host "Sync triggered for $($d.DeviceName)"
}

# 4. Wait, then re-read lastSyncDateTime
Start-Sleep -Seconds 120
Get-MgBetaDeviceManagementManagedDevice -ManagedDeviceId $devices[0].Id |
    Select-Object DeviceName, ComplianceState, LastSyncDateTime

The script below packages this into a reusable function with parameters and error handling.

Next steps

More Intune & Device Management recipes

Browse the rest of this category in the Dex Cookbook.

Automate this with Dex Pro

Let the autonomous IT engineer run this task under your policies.

Start free

Point Dex at a tenant and try it for 30 days, no credit card.