Version 1.0.0 | March 2026
Collects Microsoft Intune configuration, compliance, security, and device data for offline assessment. Produces a portable ZIP of JSON files that can be shared with your consultant for analysis — no ongoing access to your tenant required.
| Category | Data Source | API |
|---|---|---|
| Devices | All managed devices with inventory | Graph Export API |
| Compliance | Compliance policies, device status, trends | Graph Export API |
| Configuration | Configuration profiles, assignment status | Graph Export API |
| Apps | App inventory, install status, discovered apps | Graph Export API |
| Security | Defender agents, malware, firewall status | Graph Export API |
| Autopilot | Deployment status, profiles | Graph Export API |
| Endpoint Analytics | Startup perf, app reliability, resource perf | Graph Export API |
| Updates | Feature/quality/driver update status | Graph Export API |
| Conditional Access | Policies (read-only) | Graph REST API |
| Enrollment | Enrollment failures, activity | Graph Export API |
| Proactive Remediations | Script run states, results | Graph Export API |
| EPM | Endpoint Privilege Management elevations | Graph Export API |
- PowerShell 5.1+ (built into Windows) or PowerShell 7+
- Microsoft.Graph.Authentication — this handles sign-in to Microsoft Graph:
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
The person running the collector needs a Microsoft Entra ID (Azure AD) account in the target tenant with read-only access to Intune data. The script uses interactive browser sign-in — no app registration or client secrets are needed.
Recommended role (simplest): Assign one of these Entra ID directory roles to the collecting account:
| Role | Access Level |
|---|---|
| Global Reader | Read-only access to everything — easiest option |
| Intune Administrator | Full Intune read (and write, but the script only reads) |
Alternatively, the account can be granted the specific Microsoft Graph API permissions (delegated scopes) listed below. These are what the script requests at sign-in:
| Graph API Scope | What It Reads |
|---|---|
DeviceManagementManagedDevices.Read.All |
Device inventory, compliance status, encryption, health attestation |
DeviceManagementConfiguration.Read.All |
Configuration profiles, security baselines, compliance policies |
DeviceManagementApps.Read.All |
App inventory, install status, app protection policies |
DeviceManagementServiceConfig.Read.All |
Autopilot, enrollment, Endpoint Analytics, co-management |
Policy.Read.All |
Conditional Access policies |
When the script runs Connect-MgGraph, a browser window opens for sign-in. The user sees a consent prompt listing the requested permissions.
- If your tenant allows user consent: The collecting user can approve the permissions themselves — no extra setup needed.
- If your tenant restricts user consent (common in enterprise environments): A Global Administrator must grant admin consent first. They can do this in the Entra admin center under Identity > Applications > Enterprise applications > Admin consent requests, or by running the script themselves once to approve the consent prompt.
All permissions are read-only. The script never creates, modifies, or deletes any Intune resources.
# Install the Graph module (one-time)
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
# Run collection (opens browser for sign-in)
.\Collect-IntuneData.ps1 -TenantId "your-tenant-id"
# Output: IntuneCollection_<tenant>_<date>.zip| Parameter | Type | Description |
|---|---|---|
-TenantId |
String | Required. Azure AD / Entra ID tenant ID |
-OutputPath |
String | Output directory (default: current directory) |
-SkipEndpointAnalytics |
Switch | Skip Endpoint Analytics reports (faster) |
-SkipApps |
Switch | Skip app inventory collection |
-SkipSecurity |
Switch | Skip Defender/firewall/malware reports |
-DaysBack |
Int | Days of historical data for trends (default: 30) |
-DryRun |
Switch | Validate permissions without collecting data |
The ZIP contains JSON files following schema version 1.0:
IntuneCollection_<tenant>_<date>/
├── metadata.json # Collection metadata, schema version, parameters
├── devices.json # DevicesWithInventory report
├── compliance-policies.json # Compliance policy definitions
├── compliance-status.json # Device compliance states
├── compliance-trends.json # DeviceComplianceTrend report
├── config-profiles.json # Configuration profile definitions
├── config-status.json # ConfigurationPolicyAggregate report
├── apps-list.json # AllAppsList report
├── apps-install-status.json # AppInstallStatusAggregate report
├── apps-discovered.json # AppInvAggregate report
├── defender-agents.json # DefenderAgents report
├── malware.json # ActiveMalware report
├── firewall-status.json # FirewallStatus report
├── autopilot-status.json # AutopilotV2DeploymentStatus report
├── enrollment-failures.json # DeviceEnrollmentFailures report
├── update-feature.json # FeatureUpdateDeviceState report
├── update-quality.json # QualityUpdateDeviceStatusByPolicy report
├── update-driver.json # DriverUpdatePolicyStatusSummary report
├── ea-startup-perf.json # EAStartupPerfDevicePerformance report
├── ea-app-perf.json # EAAppPerformance report
├── ea-resource-perf.json # EAResourcePerfAggByDevice report
├── ea-device-scores.json # EADeviceScoresV2 report
├── ea-work-anywhere.json # EAWFADeviceList report
├── conditional-access.json # Conditional Access policies
├── epm-elevations.json # EpmElevationReportElevationEvent report
├── proactive-remediations.json # PolicyRunStatesByProactiveRemediation
├── device-health.json # WindowsDeviceHealthAttestationReport
├── tpm-attestation.json # TpmAttestationStatus report
└── co-management.json # ComanagedDeviceWorkloads report
Most data is collected via the Intune Graph Export API:
- POST to
https://graph.microsoft.com/beta/deviceManagement/reports/exportJobswith report name - Poll the export job until status =
completed - Download the ZIP from the returned URL
- Extract and save as JSON in the collection pack
This is the same mechanism used by the Intune admin center's "Export" buttons — we just automate it.
- Read-only — the collector makes no changes to your Intune environment
- No data leaves your machine — output stays in the local ZIP file
- Share selectively — send only the ZIP to your consultant
- PII note — device names, UPNs, and serial numbers are included in the raw data. The analysis tool has a
-ScrubPIIoption that anonymises all identifiable data in the output report.
MIT License — see LICENSE for details.