Intune's app install status is a sea of red per-device rows. What it won't tell you at a glance is which app is the problem, how bad, and who should fix it. This is the read-only collector that rolls every failure up per app and triages it into a category, an owner, and a remediation.
Every fleet accumulates cruft: laptops that stopped checking in months ago, records for devices that were wiped, machines whose owner left the company. Intune lists them all as if they're equal. This is the read-only collector that separates the living from the stale and tells you what to do about each one.
Open any compliance policy or configuration profile and Intune shows you its assignments. What it never shows is the whole map — every policy, every group it targets, which of those groups are dynamic, and which point at a group that no longer exists. This is the read-only collector that flattens all of it into one table.
Somewhere on your fleet right now, someone has quietly installed a local LLM. Maybe it's Ollama pulling a model, maybe LM Studio, maybe a coding assistant quietly indexing your repos into a local model that sits on the laptop — and never gets wiped when they leave. Intune won't tell you — it doesn't inventory "AI tools" as a thing. This is a scheduled, read-only collector that turns shadow AI into a governance report: who's running what, sanctioned or not, and the finding that should worry you most — leavers who still have it installed.
Ask an admin for "the documentation" of their Intune tenant and you'll get a nervous laugh. It's in the portal — spread across compliance policies, configuration profiles, app assignments, Autopilot profiles, update rings — and the moment anyone writes it down in a Word doc, it's out of date. This is a scheduled, read-only collector that renders the entire Intune and Windows 365 configuration into one always-current, human-readable document.
Every fleet question starts the same way — how many devices, running what, owned by whom, and where do they sit? Intune knows all of it. The problem is it knows each part in a different place: the OS on the device blade, the user's country in Entra, the warranty in a Notes field, the Defender agent in a security report. This is the read-only collector that joins them into one flat row per device you can actually slice.
Intune will happily tell you a device is Not compliant. What it won't hand you — as data you can report on — is the why: which specific setting failed, where the user sits, and what make and model they're on. To learn that, you open the device. Then the next one. Then the next.