A Teams Phone license on a disabled account, a user with no number provisioned, or someone who hasn't made a call in 90 days is money leaving the building every month for nothing. The licensing blade will tell you a SKU is assigned; it won't tell you it's wasted. This read-only report joins license assignment to sign-in, Teams usage and the phone number — and tiers every licensed user by how reclaimable they are.
"How many devices fail Firewall in Finland?" "Which Lenovos are out of warranty in the Madrid office?" "Is Ollama installed anywhere, and is it approved?" You want to ask your fleet those questions in plain English and get an answer in seconds. The obvious way to build that — hand an AI model live access to Intune and Microsoft Graph — is also the most dangerous. This is the capstone of everything on this site: an AI agent for endpoint management that answers questions about your whole Intune fleet — and holds no access to any live system at all. (For how it compares to Microsoft's native Intune Copilot agents, jump to Where this fits.)
When an Autopilot build fails, the technician sees a spinning ESP and a vague error. What the fleet owner needs is the pattern: which phase deployments die in, which category of failure dominates, and which app keeps timing out. This read-only collector turns Autopilot events into that operational picture.
"How many of our devices are Windows 11 ready?" is a question that decides a hardware budget. Intune hints at readiness but won't hand you the specific blocker — TPM, CPU, Secure Boot, RAM — for every device, as data. This read-only collector does, so the refresh plan writes itself.
A corporate Windows device whose primary user has no Intune (or Windows Enterprise) license is a compliance and cost problem hiding in plain sight — it enrols, it looks managed, but it's out of licensing bounds. Intune won't cross-reference devices against user licences. This read-only collector does.
Intune's app install status is a sea of red per-device rows. What it won't tell you at a glance is which app is the problem, how bad, and who should fix it. This is the read-only collector that rolls every failure up per app and triages it into a category, an owner, and a remediation.
Every fleet accumulates cruft: laptops that stopped checking in months ago, records for devices that were wiped, machines whose owner left the company. Intune lists them all as if they're equal. This is the read-only collector that separates the living from the stale and tells you what to do about each one.
Open any compliance policy or configuration profile and Intune shows you its assignments. What it never shows is the whole map — every policy, every group it targets, which of those groups are dynamic, and which point at a group that no longer exists. This is the read-only collector that flattens all of it into one table.
Somewhere on your fleet right now, someone has quietly installed a local LLM. Maybe it's Ollama pulling a model, maybe LM Studio, maybe a coding assistant quietly indexing your repos into a local model that sits on the laptop — and never gets wiped when they leave. Intune won't tell you — it doesn't inventory "AI tools" as a thing. This is a scheduled, read-only collector that turns shadow AI into a governance report: who's running what, sanctioned or not, and the finding that should worry you most — leavers who still have it installed.
Every fleet question starts the same way — how many devices, running what, owned by whom, and where do they sit? Intune knows all of it. The problem is it knows each part in a different place: the OS on the device blade, the user's country in Entra, the warranty in a Notes field, the Defender agent in a security report. This is the read-only collector that joins them into one flat row per device you can actually slice.