Month 6: Robots, reports and Ranger

Microsoft Graph PowerShell

The Intune admin center talks to Microsoft Graph, and so can you. Install the Microsoft Graph PowerShell SDK (Install-Module Microsoft.Graph), sign in with Connect-MgGraph and only the scopes (permissions) you need, then use cmdlets like Get-MgDeviceManagementManagedDevice to read devices.

Connect-MgGraph -Scopes `
 "DeviceManagementManagedDevices.Read.All"
$f = "complianceState eq 'noncompliant'"
Get-MgDeviceManagementManagedDevice `
 -Filter $f |
 Select-Object DeviceName, UserPrincipalName

Exam tip Least privilege applies to scripts too: Read.All to report, ReadWrite.All only when the script changes things.

Unattended automation

A Monday report shouldn't depend on someone signing in. Register an app in Microsoft Entra ID, grant it application permissions (for example DeviceManagementManagedDevices.Read.All) with admin consent, and authenticate with a certificate. Run it from Azure Automation or a scheduled task. Device actions work too, such as Sync-MgDeviceManagementManagedDevice.

Exam tip If multi admin approval protects a resource, Graph calls that change it also wait for approval, scripts included.

Extending compliance with PowerShell

Custom compliance checks things built-in settings can't. Upload a discovery script (PowerShell for Windows) under Endpoint security > Device compliance > Scripts. It must return its findings as one line of compressed JSON (end with return $hash | ConvertTo-Json -Compress). Add a JSON rules file to a compliance policy: SettingName, Operator (IsEquals, GreaterEquals...), DataType, Operand, and remediation strings users see.

Script returns: {"LabelSvc":"Running"}
JSON rule:
 SettingName  LabelSvc
 Operator     IsEquals
 DataType     String
 Operand      Running

Exam tip One discovery script per compliance policy, but one script can check many settings. Errors 65007-65010 point at script or JSON problems.

The Intune agents

Security Copilot agents run in the Intune admin center under Agents. The one still offered is the Vulnerability Remediation Agent (preview): it uses Microsoft Defender Vulnerability Management data to list CVEs on your devices, ranked by risk, with step-by-step Intune fixes. Microsoft removed the Device Offboarding Agent on June 1, 2026 and retired the Change Review and Policy Configuration Agents on August 31, 2026.

Exam tip Needs Intune Plan 1, Security Copilot capacity (SCUs) and Defender Vulnerability Management. A new instance runs as its own Entra agent identity with only the permissions you delegate.

Investigating what an agent finds

Open a Vulnerability Remediation Agent suggestion: affected devices, the number of CVEs, impact summary and suggested actions. Verify in the Defender portal, fix through Intune (an update ring, app update or setting), then mark it applied so the next run tracks progress. For device performance, Copilot in Intune can summarize a device and explain Endpoint analytics data; you confirm in the reports.

Exam tip Treat agent output as a well-researched recommendation, not an order. You decide, then the agent records what you did.

Responding to recommendations

Agents observe, reason and recommend; they don't change devices on their own. Review each suggestion, check it against your own data, decide, then act with normal Intune tools, where Multi Admin Approval still applies. With the Change Review Agent retired, approvers judge Multi Admin Approval requests themselves from the script, the business justification and the audit log.

Exam tip Older study notes still list four Intune agents. Trust the current Agents node: retired agents aren't a right answer for new work.

Endpoint analytics scores

Endpoint analytics scores the user experience from 0 to 100. Startup performance: boot and sign-in times, startup apps that slow sign-in, restart frequency and blue screens. Application reliability: app crashes and mean time to failure. Work from anywhere: readiness for cloud management. Compare against a baseline (the all-organizations median or your own saved one); scores below the baseline by the threshold show as regressions.

Exam tip "Laptops got slower after last month's change" = compare startup scores with the baseline, then open the device to see what's slow.

Remediations

Devices > Scripts and remediations > Remediations: a script package holds a detection script and a remediation script. The remediation runs only when detection exits with exit 1 (issue found). Schedule it Once, Hourly or Daily, choose system or logged-on credentials and 64-bit PowerShell, and assign to device groups. Run remediation runs a package on one device on demand. Remediations need Windows Enterprise E3/E5 or similar licenses.

Detect_Spooler.ps1
 $s = Get-Service Spooler
 if ($s.Status -ne 'Running') {
   Write-Output "Spooler stopped"
   exit 1 }
 exit 0
Remediate_Spooler.ps1
 Start-Service Spooler

Exam tip Status words: Without issues, With issues, Issue fixed, Issue recurred, Failed. Output is capped at 2,048 characters.

Intune reports

Intune reports come in kinds: operational (near real time, act now: noncompliant devices, app install status), organizational (broad summaries), historical (trends) and specialist (Azure Monitor). Most let you choose columns, filter, search and export to CSV. The Intune Data Warehouse offers an OData feed for Power BI dashboards.

Exam tip "Send compliance data to a dashboard the whole team can edit" = diagnostic settings to Log Analytics, then a workbook.

Log Analytics, workbooks and alerts

In Reports > Diagnostic settings, send AuditLogs, OperationalLogs, DeviceComplianceOrg and IntuneDevices to a Log Analytics workspace (needs an Azure subscription). Then build workbooks and dashboards, and create Azure Monitor alert rules with action groups: email when compliance drops (drift), when enrollment failures spike, or when audit logs show policy changes. Conflicts show in each profile's status report.

Exam tip Audit logs answer "who changed this policy and when". Operational logs answer "which enrollments failed".

Tenant health and service communications

Tenant administration > Tenant status has three tabs. Tenant details: name, location, MDM authority, service release. Connector status: Apple push certificate, ADE and VPP tokens, Managed Google Play, Defender and more (unhealthy when expired or not synced for 3+ days). Service health and message center: active incidents, issues that need action, and planned changes.

Exam tip Build an operational baseline: normal compliance %, enrollment success and check-in rates. Alerts only work when you know what normal looks like.

The agents in Intune

Security Copilot agents run inside the Intune admin center (Agents node) and work under admin oversight. They use security compute units (SCUs) from Security Copilot.

• Vulnerability Remediation Agent: reads Microsoft Defender vulnerability data and lists prioritized fixes
• Change Review Agent: evaluates Multi Admin Approval requests for Windows PowerShell scripts and recommends approve or reject
• Device Offboarding Agent: finds stale or mismatched devices in Intune and Entra ID; nothing is removed without approval
• Policy Configuration Agent: turns a document or plain-language request into settings catalog values

Exam tip Microsoft announced retirements for three of these: the Device Offboarding Agent on June 1, 2026, and the Policy Configuration and Change Review agents on August 31, 2026 (see each agent's Learn page). The Vulnerability Remediation Agent has no retirement notice, so it's the one to know best.

Investigating a finding

The Vulnerability Remediation Agent shows a prioritized list of suggestions (ranked by CVSS score, exposure and how many devices). Open one to see the number of CVEs, a summary of the impact, affected and exposed devices, and step-by-step remediation in Intune (for example deploy an app update or a configuration policy). After fixing it, mark it applied so later runs show how the risk changed.

• Needs Intune Plan 1, Security Copilot with SCUs, and Defender Vulnerability Management (Defender for Endpoint P2 or the standalone add-on)
• An admin starts runs (or schedules them) after a readiness check
• Windows client devices only for CVE counts

Exam tip Agents recommend; admins approve and act. A question that has the agent 'automatically wiping devices' is wrong.

Built-in reports

In Reports you'll find operational reports (for example noncompliant devices, app install status), organizational reports (device compliance, device configuration) and historical/trend reports. Most reports let you filter columns (OS, ownership, compliance state), search, sort, choose columns, and Export to a .csv (zipped) file.

Exam tip If a report is missing new data, select Generate (or Generate again): many reports are snapshots, not live.

Workbooks and dashboards

Turn on Diagnostic settings in Tenant administration to stream Intune logs (AuditLogs, OperationalLogs, DeviceComplianceOrg, Devices) to an Azure Log Analytics workspace. Then use Reports > Log analytics workbooks (or build your own with KQL), and pin charts to an Azure dashboard.

• Audit logs: who changed what in Intune
• Operational logs: enrollment successes and failures
• Data kept as long as the workspace's retention setting

Exporting data

For automation, call the Microsoft Graph exportJobs API: POST a job to deviceManagement/reports/exportJobs with the report name, filters and format (csv or json), poll until the status is completed, then download the zip from the returned URL. Power BI can also read the Intune Data Warehouse.

Exam tip Need history beyond what the console shows, or a custom chart: Log Analytics. Need a one-time spreadsheet: Export. Need a scheduled feed into another tool: Graph exportJobs.