Intune Compliance in One Call, and Which Devices Run That App
July 16, 2026 · InfraScout Team
Four new read-only Intune tools, each one filling a gap where the answer previously required enumerating a lot of devices to work out something the tenant already knew.
Compliance, without counting devices
An assessment that wants to state a compliance posture had to enumerate managed devices and tally their states. Intune already keeps that total, and two tools now read it.
The compliance rollup returns the whole picture in one call: compliant, non-compliant, error, conflict, in-grace-period, not-applicable, unknown, and remediated device counts. That is the headline number for a report, obtained without paging through a fleet.
The per-setting summaries are the more interesting half. One row per compliance setting, with fleet-wide counts of how many devices are compliant, non-compliant, in error, in conflict, or not applicable for that specific setting. Where the rollup tells you how many devices fail, this tells you which requirements they fail — which is the difference between a compliance number and a remediation plan. Three hundred non-compliant devices failing one encryption setting is a very different afternoon from three hundred failing thirty different things.
Which devices does this person have?
Asking for one user's devices sounds like it should be a filter on the device list. It is not — the tenant-wide device list has no server-side filter on user principal name, so attempting it silently returns something other than what you asked for.
There is one supported path, and the new tool wraps it. Two limitations are stated in the tool's own description so the AI stops trying to work around them: the user must be identified by object ID or exact user principal name (a display name will not resolve — look the person up first), and the result covers devices where they are the primary user. Someone who merely signed into a shared machine will not match.
Stating a limitation where the AI reads it turns out to matter more than documenting it elsewhere. Before this, the model would attempt the unsupported filter, get an unhelpful result, and try again differently.
Which devices run this app?
The detected-apps list tells you what is installed somewhere in your estate. The obvious next question — where — had no answer without a hunt.
The new tool takes a detected app and lists the managed devices that have it. Together with the app list that is the vulnerable-software workflow in two steps: find the outdated or unwanted application, then enumerate exactly which hosts still run it. Ask about an old Java runtime or an unapproved remote-access tool and you get the list of machines rather than a count.
A fix worth mentioning
The existing managed-mobile-apps tool was registered against the wrong Microsoft Graph path and had presumably never returned anything useful. It now points at the correct one. The permission it needs was already granted, so nothing about your tenant's consent changes — the tool simply works.
Try it
Ask "how many Intune devices are compliant, and which settings fail on the most devices?" — that is the two new compliance tools in sequence, and it is a complete compliance section for a report in one exchange.
Full reference in Microsoft Cloud — Intune Tools. Questions? info@infrascout.cloud.