Device health review in one prompt
06 Nov 2026
An Intune device health review in one prompt
The Intune device list says five devices are non-compliant. That is a status. It doesn't tell you whether to call the user, restart the laptop, change the firmware or order a replacement. The answer sits one level down, in which setting of which policy failed on which device, and Intune's portal makes you open each device to find it.
The GraphPaaS connector for Claude ships a Device health review prompt in its tools menu. It reads four domains in order: the device inventory, the compliance settings that fail, Windows 11 upgrade readiness, and Autopilot registrations. Below is that run against Fabrikam HQ, our demo tenant (synthetic people and devices, real tool calls, data collected on 31 October at 21:45 UTC).
Five non-compliant, and the settings behind them
Run the device health review on Fabrikam HQ.
get_metrics(domain="devices", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
group_by="compliance_state")
→ compliant 31 · noncompliant 5
get_metrics(domain="device_policies", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
where={"kind": "setting"}, order_by="-non_compliant_count",
columns=["setting", "setting_name", "platform", "non_compliant_count",
"error_count", "compliant_count", "affected_count", "evaluated_count"])
→ 9 rows
31 of 36 devices are compliant. The Windows policy carries the failures: Require BitLocker fails on 4 of the 18 Windows PCs evaluated, with 1 more in error; Minimum OS version fails on 3, Require Secure Boot on 2, Firewall on 1. Defender antimalware passes on all 18.
The settings table answers "what is failing across the fleet". The next question is per device, and the same domain has rows for it: one per device and failing setting, with the device's grace period next to it.
Which device fails what, and when does each one run out of grace?
get_metrics(domain="device_policies", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
where={"kind": "setting_device"},
columns=["setting", "setting_name", "device_name", "device_model",
"user", "state", "grace_period_ends"])
→ 11 rows
get_metrics(domain="devices", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
where={"compliance_state": "noncompliant"},
columns=["device_name", "user", "os", "os_version", "model", "last_sync",
"encrypted", "grace_period_ends", "ownership"])
→ 5 rows
FBK-WIN-001 fails four settings and its grace period ended on 31 October. FBK-WIN-009 fails three, FBK-WIN-025 two, and FBK-WIN-033 fails BitLocker with a conflict on Minimum OS version; their grace periods end on 1, 3 and 4 November. The iPhone FBK-IOS-017 is non-compliant but no setting row names a reason: the iOS policy reports 0 failed and 1 pending. Open that one in Intune.
Read across a row and each device has a different fix. Read down the first column and there is a pattern worth stopping on.
A BitLocker failure on disks that are encrypted
Which devices are stale, and which are unencrypted?
get_metrics(domain="devices", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
where={"last_sync": {"<": "2026-10-02"}},
columns=["device_name", "user", "os", "compliance_state", "last_sync",
"encrypted", "ownership"])
→ 4 rows
get_metrics(domain="devices", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
where={"encrypted": false},
columns=["device_name", "os", "compliance_state", "last_sync", "ownership"])
→ 0 rows
Four devices haven't checked in for 30 days: an Android phone last seen 25 August, a Mac on 30 August, FBK-WIN-001 on 6 September and an iPhone on 17 September. FBK-WIN-001 is personally owned. No device reports an unencrypted disk, including the four PCs that fail Require BitLocker.
Both readings can be true at once. Microsoft's Windows compliance settings reference says Require BitLocker is checked through Device Health Attestation, and "the state of this setting is only measured at boot time": a laptop that finished encrypting since its last restart stays non-compliant until it reboots. The same page points to a different setting, Encryption of data storage on a device, that reads the encryption state directly instead.
So the cheap test comes first: restart and sync FBK-WIN-009, FBK-WIN-025 and FBK-WIN-033 before anyone re-encrypts a disk. Expect it not to be enough on FBK-WIN-033, which the readiness data says has no TPM 2.0. And FBK-WIN-001 can't be restarted remotely into compliance; it hasn't talked to Intune since September. Its grace period is the one that already ended, which under Intune's actions for noncompliance is the point where Conditional Access is allowed to block it. Fabrikam has a policy for that: "Require compliant device for Exchange", enabled for all users. Whoever carries that laptop has lost mail on it, or will at the next sign-in.
Compliant, and on Windows 10
What blocks the Windows 11 upgrade?
get_metrics(domain="device_readiness", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
group_by="upgrade_eligibility")
→ upgraded 12 · notCapable 4 · capable 2
get_metrics(domain="device_readiness", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
where={"failed_check_count": {">": 0}},
columns=["device_name", "model", "os_version", "upgrade_eligibility", "failed_checks"])
→ 4 rows
get_metrics(domain="devices", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
where={"os_version": {"contains": "10.0.19045"}},
columns=["device_name", "compliance_state"])
→ 6 rows (4 compliant)
12 PCs already run Windows 11. Six are still on Windows 10 22H2. Two of them, FBK-WIN-009 and FBK-WIN-021, pass every check and can upgrade now. Four can't: all fail the TPM check, FBK-WIN-003 and FBK-WIN-015 also fail Secure Boot and RAM, FBK-WIN-027 and FBK-WIN-033 the processor. Four of the six read compliant.
Build 19045 is Windows 10 version 22H2, and according to Windows 10 release information, Windows 10 reached end of support on 14 October 2025. A compliance policy only checks what it was told to check; this one's minimum OS version lets four out-of-support PCs through as compliant. That's the gap a review that stops at "compliant 31" never sees.
The blockers split the six cleanly. Windows 11's requirements ask for TPM 2.0, UEFI firmware that is Secure Boot capable, and a compatible processor. A missing TPM 2.0 or an unsupported CPU means new hardware. FBK-WIN-009 is the opposite case: it passes the readiness checks, so its firmware can do Secure Boot, yet it fails the Require Secure Boot compliance setting. Most likely it is switched off in the firmware. Turning it on clears a compliance failure and gets the PC ready to upgrade.
Registered for Autopilot, assigned to nothing
Which Autopilot devices won't get a deployment profile?
get_metrics(domain="autopilot", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
where={"kind": "device", "has_profile": false},
columns=["serial_number", "model", "group_tag", "enrollment_state",
"profile_status", "profile_detail_status", "last_contacted"])
→ 3 rows
get_metrics(domain="autopilot", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
where={"kind": "profile"},
columns=["profile_name", "profile_kind", "assigned_to", "excluded_from",
"assignment_count", "device_type", "preprovisioning"])
→ 4 rows (2 assigned)
get_metrics(domain="devices", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
where={"serial_number": ["D3M0000001", "D3M0000027", "D3M0000015"]},
columns=["device_name", "serial_number", "model", "compliance_state", "last_sync"])
→ 3 rows
Three registered devices have no profile assigned: one with no group tag, one tagged StdUser, one tagged DevTeam. Only "Corporate standard" (to All company devices) and "Kiosk devices" (to Kiosks) are assigned. By serial number they are FBK-WIN-001, FBK-WIN-027 and FBK-WIN-015, and the last two can't run Windows 11.
A profile reaches a device only through a group, and in most tenants that
group is dynamic. Microsoft's
Autopilot
device group guide notes that Intune's group tag maps to the
OrderID attribute in Entra, which is what the membership rule matches.
So the question for Fabrikam is what the rule of "All company devices" says, and
whether StdUser, DevTeam and the untagged case fall outside it. The urgency is
lower than it looks: two of the three are on the replacement list anyway. The
rule matters for the hardware that replaces them, which will be registered with
the same tags.
The five actions it ends with
| Action | Devices | Why |
|---|---|---|
| Restart and sync before touching encryption | FBK-WIN-009, -025, -033 | Require BitLocker is attested at boot; the inventory says the disks are encrypted |
| Find the laptop, or retire it | FBK-WIN-001 | Personal, silent since 6 September, four failing settings, grace ended |
| Turn on Secure Boot, then upgrade to Windows 11 | FBK-WIN-009, -021 | Capable hardware on an OS out of support since 14 October 2025 |
| Budget replacements | FBK-WIN-003, -015, -027, -033 | Fail the TPM 2.0 check; no setting fixes that |
| Check the "All company devices" rule against StdUser, DevTeam and no tag | 3 Autopilot records | No profile assigned; the replacements will carry the same tags |
Outside the five: the iPhone the data can't explain, and two stale phones and a Mac that need an owner to answer for them. Our article on stale Intune devices covers what to do with those.
- Device compliance settings for Windows in Intune — Require BitLocker is measured at boot through Device Health Attestation; a reboot is needed after encryption.
- Configure actions for noncompliant devices in Intune — the Mark device noncompliant schedule is the grace period before Conditional Access can block.
- Windows 11 requirements — TPM 2.0, UEFI with Secure Boot capable, compatible 64-bit processor.
- Windows 10 release information — end of support on 14 October 2025; version 22H2 is OS build 19045.
- Create device groups for Windows Autopilot — the group tag maps to the OrderID attribute that dynamic membership rules match.
Run the device health review on your own tenant: it is in the connector's tools menu.
Add the connector →