Intune with PowerShell 7: Compliance, Stale Devices and Autopilot

I have worked in IT for about 20 years. A lot of that was MSP operations. Today I work as an M365 cloud admin.

I kept writing the same scripts. So I cleaned them up and shared them on GitHub. This toolkit is for Microsoft Intune admins. It uses PowerShell 7 and the Microsoft.Graph SDK v2. Beta-only endpoints use Invoke-MgGraphRequest.

Repo: intune-powershell-toolkit

The problem it solves

Device lists get messy. Old laptops never check in again. Compliance reports in the portal are hard to export.

Autopilot imports by hand are slow when a box of new devices arrives.

These scripts make those jobs quick and repeatable.

Highlight scripts

Get-IntuneComplianceReport.ps1

Gives per-policy status counts and a list of non-compliant devices.

./Get-IntuneComplianceReport.ps1

Remove-IntuneStaleDevice.ps1

Retires or deletes devices that have not checked in for a number of days. You can filter by OS. Always run with -WhatIf first.

./Remove-IntuneStaleDevice.ps1 -DaysInactive 120 -WhatIf
./Remove-IntuneStaleDevice.ps1 -DaysInactive 180 -Action Delete -OperatingSystem Android -Confirm

Import-AutopilotDevice.ps1

Imports Autopilot devices from a hardware hash CSV. You can set a group tag.

./Import-AutopilotDevice.ps1 -CsvPath ./samples/autopilot-hashes.sample.csv -GroupTag Contoso-Standard -WhatIf

Other scripts cover device inventory, device sync, app deployment status, Autopilot reports and configuration profile export.

How the scripts are built

• PowerShell 7.4 or later.
• Comment-based help on every script. Run Get-Help ./script.ps1 -Full.
• Reports export to CSV.
• Change scripts support -WhatIf and -Confirm.
• Certificate (app-only) or interactive sign-in.
• No secrets in the repo. Examples use contoso.com and placeholder GUIDs.

Please test in a dev or test tenant first. Read each script before you run it.

My usual workflow

I start with the reports. They are read-only and safe. I open the CSV in Excel and look for anything odd.

Then I pick one fix. I run the change script with -WhatIf and read the output. If it looks right, I run it again for real.

For jobs I repeat, I use a certificate and schedule the script. That way nobody has to remember to run it.

Getting started

Clone the repo:

git clone https://github.com/anthonybuhnerkemper/intune-powershell-toolkit.git
cd intune-powershell-toolkit

Every toolkit ships the same Connect-M365Admin script. Dot-source it, then connect.

# Interactive sign-in
. ./scripts/Connect/Connect-M365Admin.ps1
Connect-M365Admin -Service Graph -Interactive -ClientId 00000000-0000-0000-0000-000000000000

# Or app-only with a certificate
$env:M365_TENANT_ID       = '00000000-0000-0000-0000-000000000000'
$env:M365_CLIENT_ID       = '00000000-0000-0000-0000-000000000000'
$env:M365_CERT_THUMBPRINT = '0000000000000000000000000000000000000000'
Connect-M365Admin -Service Graph

Run a report, check the CSV, then call Disconnect-M365Admin when you are done. The README lists the modules and roles each script needs.

More toolkits

I have nine more free toolkits that use the same pattern: graph-powershell7-admin-toolkit, entra-id-powershell-toolkit, exchange-online-powershell-toolkit, sharepoint-online-powershell-toolkit, onedrive-powershell-toolkit, teams-powershell-toolkit, defender-xdr-powershell-toolkit, sentinel-kql-toolkit, purview-compliance-toolkit.

You can find them all on my GitHub profile.

Feedback welcome

Issues, ideas and pull requests are welcome. What would you add? Tell me in the comments.