A Teams Phone license on a disabled account, a user with no number provisioned, or someone who hasn't made a call in 90 days is money leaving the building every month for nothing. The licensing blade will tell you a SKU is assigned; it won't tell you it's wasted. This read-only report joins license assignment to sign-in, Teams usage and the phone number — and tiers every licensed user by how reclaimable they are.
Someone on the service desk asked me last month how many of our Finnish devices were failing the firewall compliance setting. Simple question. The honest answer was that I had to go and write a Graph query to find out, because there is no way to just ask the fleet a question like that.
So I built something that can answer it. You type "how many devices fail Firewall in Finland" in plain English and get the number back in a few seconds, with the source report and the date on it. The obvious way to build that is to give an AI model live access to Intune and Graph. That is also the most dangerous way, and I did not want to do it.
This is the capstone of everything else on this site. An AI agent that answers questions about our whole Intune fleet, and holds no access to any live system at all. (If you want to see how it compares to Microsoft's own Intune Copilot agents, jump to Where this fits.)
When an Autopilot build fails, the technician sees a spinning ESP and a vague error. What the fleet owner needs is the pattern: which phase deployments die in, which category of failure dominates, and which app keeps timing out. This read-only collector turns Autopilot events into that operational picture.
"How many of our devices are Windows 11 ready?" is a question that decides a hardware budget. Intune hints at readiness but won't hand you the specific blocker — TPM, CPU, Secure Boot, RAM — for every device, as data. This read-only collector does, so the refresh plan writes itself.
A corporate Windows device whose primary user has no Intune (or Windows Enterprise) license is a compliance and cost problem hiding in plain sight — it enrols, it looks managed, but it's out of licensing bounds. Intune won't cross-reference devices against user licences. This read-only collector does.
Intune's app install status is a sea of red per-device rows. What it won't tell you at a glance is which app is the problem, how bad, and who should fix it. This is the read-only collector that rolls every failure up per app and triages it into a category, an owner, and a remediation.
Every fleet accumulates cruft: laptops that stopped checking in months ago, records for devices that were wiped, machines whose owner left the company. Intune lists them all as if they're equal. This is the read-only collector that separates the living from the stale and tells you what to do about each one.
Open any compliance policy or configuration profile and Intune shows you its assignments. What it never shows is the whole map — every policy, every group it targets, which of those groups are dynamic, and which point at a group that no longer exists. This is the read-only collector that flattens all of it into one table.
Somewhere on your fleet right now, someone has quietly installed a local LLM. Maybe it's Ollama pulling a model, maybe LM Studio, maybe a coding assistant quietly indexing your repos into a local model that sits on the laptop — and never gets wiped when they leave. Intune won't tell you — it doesn't inventory "AI tools" as a thing. This is a scheduled, read-only collector that turns shadow AI into a governance report: who's running what, sanctioned or not, and the finding that should worry you most — leavers who still have it installed.
Every fleet question starts the same way — how many devices, running what, owned by whom, and where do they sit? Intune knows all of it. The problem is it knows each part in a different place: the OS on the device blade, the user's country in Entra, the warranty in a Notes field, the Defender agent in a security report. This is the read-only collector that joins them into one flat row per device you can actually slice.