Scripts library¶
Standalone, read-only PowerShell for Intune, Entra and Graph. Each script is grab-and-use: the script,
its .pbit, and an example report — plus the topic tags so you can find it again. Many of these are the
same collectors that club together into Zero-Access Agent.
What these scripts are — and aren't
Each one is standard, publicly-documented Microsoft Graph usage: read-only (.Read.All) API calls
stitched together in PowerShell and joined into a report — the kind any admin can write from Microsoft's
own documentation. They're not proprietary software, and not derived from any employer's or
customer's code, environment or data. Everything here was written and tested in a personal lab
against synthetic (@contoso) data.
New here? Start with the worked example
Device Inventory shows the full template end to end.
| Script | What it does | Topics |
|---|---|---|
| Read-Only Gate | The founding artifact — proves a collector's identity can only read, and aborts the run if it can't. | Microsoft Graph · Azure Automation · Defender / Security |
| Non-Compliant Devices | Every non-compliant Windows device and the exact failing settings. | Intune · Microsoft Graph · Defender / Security |
| Device Inventory | The simplest end-to-end collector — a clean starting point to learn the read-only pattern before the bigger ones. | Intune · Microsoft Graph · Azure Automation |
| Inventory — All Devices | Full managed-device inventory across the fleet — the backbone dataset every other report leans on. | Intune · Microsoft Graph · Azure Automation |
| Intune Documentation | Snapshots your Intune configuration — profiles, policies and settings — as documentation you can diff over time. | Intune · Microsoft Graph |
| Policy Assignments | Resolves which policies land on which groups, so 'why did this device get that setting?' has an answer. | Intune · Microsoft Graph |
| Device Hygiene | Compliance, encryption, stale check-ins and the small signals that separate a healthy fleet from a drifting one. | Intune · Defender / Security · Microsoft Graph |
| App Deployment Failures | Surfaces app installs that failed and where, so remediation targets the real devices, not the whole ring. | Intune · Microsoft Graph |
| License Compliance | Maps assigned vs consumed licences across the tenant — the report finance and IT both ask for. | Entra ID · Microsoft 365 · Microsoft Graph |
| Windows 11 Readiness | Hardware-readiness across the estate — TPM, CPU, RAM — so the Windows 11 plan is grounded in data. | Intune · Windows / Autopilot · Microsoft Graph |
| Autopilot Operations | Autopilot registrations, profiles and deployment health — the enrolment funnel, made visible. | Windows / Autopilot · Intune · Microsoft Graph |
| Local AI Agent Inventory | Inventories local AI-agent tooling across managed devices — a modern-workspace signal most fleets can't see yet. | Intune · Microsoft Graph |
| Synthetic Fleet Generator | Generates fake-but-realistic fleet CSVs — duplicates, missing values, reimaged serials — so you can run everything with no tenant. | Azure Automation |