Lists the Apple MDM push certificate, every ADE enrolment token and every Apps and Books (VPP) token in Intune, with expiry date, days left and the Apple ID behind each one. Exports a CSV. Changes nothing in your tenant, so there is no WhatIf switch. https://atliso.com/blog/intune-apple-mdm-push-certificate-expired

BitLocker can report as encrypted while its recovery password never made it to Entra ID (Azure AD), leaving the device unrecoverable. This script confirms whether a successful escrow was logged recently, and if not, forces the backup for every RecoveryPassword protector on the target volumes. Detection signal: event ID 845 in the Microsoft-Windows... More info

Windows LAPS can report as compliant in Intune while the local admin password hasn't actually rotated in months. This script confirms whether a successful password backup was logged inside the expected window, and if not, forces a rotation with Reset-LapsPassword. Detection signal: event 10029 (Entra ID backup) or 10018 (Active Directory backup) i... More info

Lists every Intune-managed Windows device with its version, edition and the last day of security updates for that edition, and exports the result to CSV. Windows 11 support is split by edition, not by build. 24H2 is build 26100 on every edition, but Home and Pro lose support on 13 October 2026 while Enterprise and Education keep it until 12 Octobe... More info