Microsoft Cloud — Intune Tools ​

The 21 Intune tools cover Microsoft Intune device management: managed devices and their per-device configuration, compliance, Defender protection, and detected-malware state, a per-user device lookup, tenant-wide compliance rollups by device and by setting, configuration profiles, the Settings Catalog, Administrative Templates, and security baselines — each readable as a whole inventory, and the last three also by id in a single call — plus detected and managed apps and the devices a detected app is installed on.

All tools accept an optional connection_id. Omit it to use the default Entra connection. See entra_connection_list for multi-tenant scenarios.

Managed Devices & Per-Device State ​

mscloud_intune_list_managed_devices ​

Lists all Intune-managed devices. Filter by operatingSystem, complianceState, or managementAgent. The key tool for endpoint security assessments — identify non-compliant or unmanaged devices.

ParameterTypeRequiredDescription
connection_idstring—Target Entra tenant.
filterstring—OData $filter, e.g. operatingSystem eq 'Windows'.
orderbystring—OData $orderby.
selectstring—Comma-separated property list.
topnumber—Page size, max 100.
skiptokenstring—From the previous response.

Example prompt.

"List all Intune-managed devices that are non-compliant."

mscloud_intune_get_managed_device ​

Returns a single Intune-managed device by ID.

ParameterTypeRequiredDescription
device_idstring✓Managed device ID.
connection_idstring—Target Entra tenant.
selectstring—Comma-separated property list.

Example prompt.

"Show me the full Intune profile for device <id>."

mscloud_intune_list_managed_device_config_states ​

Lists how each assigned configuration profile evaluated on a single managed device — including profiles that errored or conflict. The starting point for "why is this device's configuration off?": it names the profile, not just that something failed.

For problem rows (nonCompliant / error / conflict) the per-setting settingStates (setting id, state, errorCode, errorDescription, currentValue) are fetched from the sub-navigation and inlined automatically — the list itself returns settingStates empty even when settingCount is non-zero. The follow-up fan-out is bounded to the first 25 problem rows per call; a settingStatesNote / settingStatesPartial field flags truncation or a row whose detail could not be loaded.

WARNING

Coverage limit. This endpoint covers legacy deviceConfiguration profiles only. Settings Catalog policies (configurationPolicies) do not appear here, so a device's Settings-Catalog profile status is not visible per-device through this tool. For Settings Catalog content and targets use mscloud_intune_get_configuration_policy / mscloud_intune_list_configuration_policies (tenant-wide); a per-device Settings-Catalog status drill-down is not yet exposed.

ParameterTypeRequiredDescription
device_idstring✓Managed device ID.
connection_idstring—Target Entra tenant.
selectstring—Comma-separated property list.

Example prompt.

"Which configuration profiles errored or conflict on device <id>, and which settings failed?"

mscloud_intune_list_managed_device_compliance_states ​

Lists how each assigned compliance policy evaluated on a single managed device — the policies it passes or fails. A failing policy is what drives a Conditional Access block, so this answers "what is keeping this device non-compliant?".

As with the configuration-state tool, problem rows (nonCompliant / error / conflict) get their per-setting settingStates fetched and inlined automatically (bounded to the first 25 problem rows; truncation/partial flagged). Complements mscloud_intune_get_managed_device_noncompliant_settings, the flat list of failing compliance settings.

ParameterTypeRequiredDescription
device_idstring✓Managed device ID.
connection_idstring—Target Entra tenant.
selectstring—Comma-separated property list.

Example prompt.

"Which compliance policies is device <id> failing, and on which settings?"

mscloud_intune_get_managed_device_noncompliant_settings ​

Returns the exact individual settings behind a device's non-compliant verdict — the specific controls that tripped, not just the policy name. Use it after mscloud_intune_list_managed_device_compliance_states to get from "which policy" to "which setting".

ParameterTypeRequiredDescription
device_idstring✓Managed device ID.
connection_idstring—Target Entra tenant.
selectstring—Comma-separated property list.

Example prompt.

"List the exact settings making device <id> non-compliant."

mscloud_intune_get_managed_device_protection_state ​

Returns the Microsoft Defender antivirus health for a managed device — real-time protection and tamper protection state, antimalware, engine, and signature versions with their last-update time, last quick and full scan times, the network inspection system state, the product status, and whether a reboot is required. Surfaces endpoints whose AV is disabled, stale, or unhealthy.

Windows only

This state exists for Windows devices only. Non-Windows or never-checked-in devices return no data.

ParameterTypeRequiredDescription
device_idstring✓Managed device ID.
connection_idstring—Target Entra tenant.
selectstring—Comma-separated property list.

Example prompt.

"What is the Defender antivirus health on device <id>?"

mscloud_intune_list_managed_device_detected_malware ​

Lists malware detected on a single managed device, as reported by Microsoft Defender antimalware. This is the Intune-native signal — no Defender for Endpoint license is required. Pairs with the protection-state tool for a per-device endpoint-security picture.

Windows only

Only Windows devices report malware state. A clean device, a non-Windows device, or one that has never checked in returns no rows.

ParameterTypeRequiredDescription
device_idstring✓Managed device ID.
connection_idstring—Target Entra tenant.
selectstring—Comma-separated property list.

Example prompt.

"Has any malware been detected on device <id>?"

mscloud_intune_list_user_managed_devices ​

Lists the Intune-managed devices belonging to one person. This is the supported way to answer "what devices does this user have" — the tenant-wide device list cannot be filtered by user principal name, so trying to narrow it that way silently returns the wrong thing.

Pass user_id as an object ID or an exact user principal name. A display name will not resolve; look the person up with mscloud_identity_list_users first if that is all you have. The result covers devices where the person is the primary user, so someone who merely logged onto a shared machine will not match it.

ParameterTypeRequiredDescription
user_idstring✓User object ID (GUID) or exact user principal name — not a display name.
connection_idstring—Target Entra tenant.
selectstring—Comma-separated property list.
top / skipnumber—Usually omit — one person's devices fit a single response. A full page returns nextSkip to pass back as skip.

Example prompt.

"Which devices does <upn> have enrolled, and are they compliant?"

Compliance & Configuration Content ​

The per-device tools above answer "is this device compliant". The two rollups that open this section answer the fleet-wide version in a single call each — the headline number, and which settings are failing to produce it — so an assessment does not have to enumerate every device to state a compliance posture.

mscloud_intune_get_compliance_state_summary ​

Returns the tenant-wide compliance rollup in one call: compliant, non-compliant, error, conflict, in-grace-period, not-applicable, unknown, and remediated device counts, plus the Configuration Manager count. This is the compliance KPI for a report — the number you lead with before drilling into why.

ParameterTypeRequiredDescription
connection_idstring—Target Entra tenant.
selectstring—Comma-separated property list.

Example prompt.

"How many Intune devices are compliant versus non-compliant across the tenant?"

mscloud_intune_list_compliance_setting_state_summaries ​

Returns one row per compliance setting with fleet-wide counts — how many devices are compliant, non-compliant, in error, in conflict, or not applicable for that specific setting. Where the rollup above tells you how many devices fail, this tells you which requirements they fail, which is what turns a compliance number into a remediation plan.

ParameterTypeRequiredDescription
connection_idstring—Target Entra tenant.
filterstring—OData $filter.
expandstring—OData $expand, e.g. assignments.
selectstring—Comma-separated property list.
topnumber—Page size, max 100.
skiptokenstring—From the previous response.

Example prompt.

"Which compliance settings fail on the most devices?"

mscloud_intune_list_device_compliance_policies ​

Lists Intune device compliance policies.

ParameterTypeRequiredDescription
connection_idstring—Target Entra tenant.
filterstring—OData $filter.
selectstring—Comma-separated property list.
topnumber—Page size, max 100.
skiptokenstring—From the previous response.

Example prompt.

"List all device compliance policies in Intune."

mscloud_intune_list_device_configurations ​

Lists Intune device configuration profiles. Optionally load each profile's assignments with expand, and reach derived-type settings that hang off a specific profile type — such as a macOS single sign-on extension — with a cast select (for example microsoft.graph.macOSDeviceFeaturesConfiguration/singleSignOnExtension). Those derived-type payloads exist only on the newer Graph surface, so set api_version to beta to read them; the default v1.0 covers everything else.

ParameterTypeRequiredDescription
connection_idstring—Target Entra tenant.
filterstring—OData $filter.
selectstring—Comma-separated property list; accepts a namespace-qualified cast segment for derived-type properties.
expandstring—OData $expand, e.g. assignments.
api_versionstring—v1.0 (default) or beta. Required for beta-only derived-type payloads; never a silent upgrade.
topnumber—Page size, max 100.
skiptokenstring—From the previous response.

Example prompt.

"List all device configuration profiles, and show the single sign-on extension config on the macOS ones."

mscloud_intune_list_configuration_policies ​

Lists Settings Catalog configuration policies — the modern, unified Intune configuration surface that supersedes the older template-based profiles. Use expand="assignments,settings" to load assigned groups and the configured settings tree inline.

WARNING

Don't filter by id when expand includes settings. Microsoft Graph ignores $filter whenever $expand includes settings — it post-filters after a full cross-partition scan (~1 policy per page), so a filtered+expanded list looks broken and is slow. To read one policy by id, use mscloud_intune_get_configuration_policy (a single Graph call). When you do combine filter with an expand that includes settings, the response carries a warning field pointing you to the getter.

ParameterTypeRequiredDescription
connection_idstring—Target Entra tenant.
expandstring—OData $expand, e.g. assignments,settings.
filterstring—OData $filter (not pushed down when expand includes settings — see warning).
selectstring—Comma-separated property list.
include_nulls / include_odata_metadataboolean—Retain stripped null/@odata.* fields.
topnumber—Page size, max 100.
skiptokenstring—From the previous response.

Example prompt.

"List the Settings Catalog policies configured in Intune."

mscloud_intune_get_configuration_policy ​

Reads one Settings Catalog policy by id in a single Graph call — the efficient path when you already have the id (avoids the full scan a filtered list triggers under expand=settings). Defaults to expand="settings,assignments", returning the structured settingInstance tree (settingDefinitionId + chosen value) and the assigned groups together.

ParameterTypeRequiredDescription
policy_idstring✓Settings Catalog policy id (from the list tool).
expandstring—OData $expand; defaults to settings,assignments. Pass a narrower value to skip the large settings payload.
connection_idstring—Target Entra tenant.
include_nulls / include_odata_metadataboolean—Retain stripped null/@odata.* fields.

Example prompt.

"Show the configured settings and assignments for Settings Catalog policy <id>."

mscloud_intune_list_group_policy_configurations ​

Lists Administrative Templates (ADMX-backed) configuration profiles — the Intune equivalent of Group Policy settings. Use expand="assignments" for the target groups, or expand="definitionValues($expand=definition,presentationValues)" to read the configured ADMX values. To read one template by id, use mscloud_intune_get_group_policy_configuration.

ParameterTypeRequiredDescription
connection_idstring—Target Entra tenant.
expandstring—OData $expand, e.g. assignments or definitionValues($expand=definition,presentationValues).
filterstring—OData $filter.
selectstring—Comma-separated property list.
include_nulls / include_odata_metadataboolean—Retain stripped null/@odata.* fields.
topnumber—Page size, max 100.
skiptokenstring—From the previous response.

Example prompt.

"What Administrative Template profiles are deployed in Intune?"

mscloud_intune_get_group_policy_configuration ​

Reads one Administrative Template by id in a single call. Defaults to expand="definitionValues($expand=definition,presentationValues),assignments", returning each configured ADMX value with its definition and presentation inputs, plus the assigned groups.

ParameterTypeRequiredDescription
config_idstring✓Administrative Template id (from the list tool).
expandstring—OData $expand; defaults to the definition-values + assignments expand above.
connection_idstring—Target Entra tenant.
include_nulls / include_odata_metadataboolean—Retain stripped null/@odata.* fields.

Example prompt.

"Show the configured ADMX values and assignments for template <id>."

mscloud_intune_list_device_management_intents ​

Lists device management intents — the assignments behind Security Baselines, Endpoint Protection, and Attack Surface Reduction templates. Use it to confirm which hardening baselines a tenant actually applies. select and expand may be combined freely (the wrapper drops $select on the wire and re-applies the projection in-process, working around an upstream 500).

INFO

Migrating intents. A migrating intent (isMigratingToConfigurationPolicy: true) returns assignments: [] even when isAssigned: true — the assignment now lives on the migrated Settings Catalog policy. Treat isAssigned as authoritative; do not infer "unassigned" from an empty assignments array.

ParameterTypeRequiredDescription
connection_idstring—Target Entra tenant.
expandstring—OData $expand, e.g. assignments.
filterstring—OData $filter.
selectstring—Comma-separated property list (safe to combine with expand).
include_nulls / include_odata_metadataboolean—Retain stripped null/@odata.* fields.
topnumber—Page size, max 100.
skiptokenstring—From the previous response.

Example prompt.

"Which security baselines and ASR templates are assigned in this tenant?"

mscloud_intune_get_device_management_intent ​

Reads one intent (security baseline / template) by id with its configured settings inlined under a settings field — the intent entity and its /settings navigation fetched together, so you don't have to chase the settings separately. Pass expand="assignments" to also load the target groups.

ParameterTypeRequiredDescription
intent_idstring✓Device management intent id (from the list tool).
expandstring—OData $expand on the intent entity (e.g. assignments); the settings are always inlined.
connection_idstring—Target Entra tenant.
include_nulls / include_odata_metadataboolean—Retain stripped null/@odata.* fields.

Example prompt.

"Show the configured settings for security baseline <id>."

Apps ​

mscloud_intune_list_detected_apps ​

Lists apps detected on Intune-managed devices.

ParameterTypeRequiredDescription
connection_idstring—Target Entra tenant.
filterstring—OData $filter.
topnumber—Page size, max 100.
skiptokenstring—From the previous response.

Example prompt.

"List apps detected across all Intune-managed devices."

mscloud_intune_list_detected_app_devices ​

Lists the managed devices that have one specific detected app installed. Together with the tool above this is the vulnerable-software hunt: find the outdated or unwanted application in the detected-apps list, then enumerate exactly which hosts are running it.

detected_app_id is the opaque Graph ID from mscloud_intune_list_detected_apps, not a display name.

ParameterTypeRequiredDescription
detected_app_idstring✓Detected application ID from mscloud_intune_list_detected_apps.
connection_idstring—Target Entra tenant.
selectstring—Comma-separated property list.
top / skipnumber—Page size (max 100) and offset. A full page returns nextSkip to pass back as skip.

Example prompt.

"Find the outdated Java runtime in detected apps and list every device that still has it."

mscloud_intune_list_mobile_apps ​

Lists managed mobile apps in Intune.

ParameterTypeRequiredDescription
connection_idstring—Target Entra tenant.
filterstring—OData $filter.
selectstring—Comma-separated property list.
topnumber—Page size, max 100.
skiptokenstring—From the previous response.

Example prompt.

"List all managed mobile apps in Intune."

See Also ​

For users, groups, directory roles, and PIM, see Microsoft Cloud — Identity. For Conditional Access, sign-ins, Defender for Endpoint, BitLocker, and LAPS, see Microsoft Cloud — Security. For Teams, SharePoint, OneDrive, Exchange Online, licensing, and usage reports, see Microsoft Cloud — Services.