Safe AI-assisted Microsoft Graph reporting for Intune

A safe AI-assisted Intune report needs four controls. Collect data with a read-only Graph scope (DeviceManagementManagedDevices.Read.All for managed devices), page through all results, and redact the export before any AI sees it. Then check every number in the AI summary against the script’s own output. Let AI draft queries, transformations, and summaries. Don’t let it decide what the data says.

This article covers that governance workflow. For prompt patterns that generate Graph queries, see AI-generated Microsoft Graph queries. For Graph authentication, error handling, and pagination basics, see Microsoft Graph API for Intune.

Symptoms of an unsafe reporting workflow

• The report’s device count doesn’t match Devices > All devices in Intune, usually because only the first page of results was collected.
• The script fails at scale with HTTP 429 Too Many Requests, Graph’s throttling response, because nobody handles Retry-After.
• The app registration has ReadWrite scopes for a report that only reads.
• A summary percentage can’t be traced to a query result.

The pipeline

1. Define the question. For example, “Which Windows devices are noncompliant or haven’t synced in 7 days?” A narrow question means narrow scopes and fewer fields.
2. Grant the minimum scope. The list managedDevices API accepts DeviceManagementManagedDevices.Read.All for both delegated and application permissions. A report needs nothing more. Document who approved the scope and when it gets reviewed.
3. Collect everything. In the Graph PowerShell SDK, -All on Get-MgDeviceManagementManagedDevice lists all pages. Use -Property to request only the fields you need. If you call REST directly, follow @odata.nextLink and handle throttling as Microsoft describes.
4. Shape the data in code, not in the model. Bucketing rules belong in the script, where they’re versioned and repeatable.
5. Redact before AI. Drop serial numbers and user names unless the analysis needs them. Hash device IDs if you only need to group them. Often counts per bucket are enough. Check your organization’s data classification rules before sending any tenant data to an external model.
6. Use AI for wording and patterns. For example: draft a manager summary, group recurring failures by model or region, or suggest a clearer field name.
7. Reconcile. Every number in the summary must match the CSV. If it doesn’t, the summary is wrong.
8. Record the review. Note who checked the output before it went out.

Example: compliance drift report

Field names come from the managedDevice resource. complianceState values are unknown, compliant, noncompliant, conflict, error, inGracePeriod, and configManager. lastSyncDateTime is the last successful sync with Intune.

I haven’t run this script in a tenant. Test it in a non-production tenant or against a small scope first.

Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"
$ReportDate = Get-Date -Format 'yyyy-MM-dd'
$Devices = Get-MgDeviceManagementManagedDevice -All `
    -Property "deviceName,operatingSystem,complianceState,lastSyncDateTime,userPrincipalName" |
    Where-Object { $_.OperatingSystem -eq 'Windows' }

$Report = foreach ($d in $Devices) {
    $days = ((Get-Date) - $d.LastSyncDateTime).Days
    $nonCompliant = $d.ComplianceState -ne 'compliant'
    [pscustomobject]@{
        DeviceName        = $d.DeviceName
        ComplianceState   = $d.ComplianceState
        DaysSinceLastSync = $days
        Bucket = if ($nonCompliant -and $days -gt 7) { 'Noncompliant and stale' }
                 elseif ($nonCompliant)            { 'Noncompliant, active' }
                 elseif ($days -gt 7)              { 'Compliant, stale' }
                 else                              { 'Healthy' }
    }
}
$Report | Export-Csv ".\intune-compliance-drift-$ReportDate.csv" -NoTypeInformation
$Report | Group-Object Bucket | Select-Object Name, Count   # the only thing AI needs

The last line is the redaction step for most summaries. Bucket names and counts tell AI enough to draft “noncompliant devices that are also stale make up the biggest group” without seeing a single device name. inGracePeriod and unknown devices fall into the noncompliant buckets here. Split them out if your team treats them differently.

If you’re building compliance reports, also read AI-assisted Intune compliance troubleshooting for the per-setting compliance side. If you need all Windows Autopilot deployment events, the Graph limits are covered in Fix Autopilot reports showing only 50 records.

Guardrails

• Keep reporting and write automation separate. Use a separate app registration or identity with read-only scopes for reports.
• Version the script, the scope list, the redaction rules, and the prompt template together. If leadership reads the report, all four belong in source control.
• Validate AI-suggested endpoints and properties against the Graph reference before use. Models do make up property names.

For writing the PowerShell itself with AI, see How to prompt AI to write secure PowerShell.

FAQ

What Graph permission does an Intune device report need?

For listing managed devices, DeviceManagementManagedDevices.Read.All. It’s supported for both delegated and application access. Avoid ReadWrite scopes for reporting.

Why does my Graph report show fewer devices than Intune?

Most often because only the first page was collected. Use -All in the Graph PowerShell SDK, or follow @odata.nextLink in REST calls.

Is it safe to paste a Graph export into an AI tool?

Only if your organization’s data policy allows it, and preferably after redaction. For summaries, bucket counts are usually enough.

What does HTTP 429 mean in a Graph report?

Graph is throttling your requests. Back off and retry, honoring the Retry-After header when it’s present.

Can AI decide which devices are at risk?

Let AI suggest patterns. Your script’s logic and a human review should decide the labels.

Sources

• List managedDevices, Microsoft Graph documentation
• managedDevice resource type, Microsoft Graph documentation
• Get-MgDeviceManagementManagedDevice, Microsoft Learn
• Microsoft Graph throttling guidance, Microsoft Learn