Lists the Apple MDM push certificate, every ADE enrolment token and every Apps and Books (VPP) token in Intune, with expiry date, days left and the Apple ID behind each one. Exports a CSV. Changes nothing in your tenant, so there is no WhatIf switch. https://atliso.com/blog/intune-apple-mdm-push-certificate-expired

BitLocker can report as encrypted while its recovery password never made it to Entra ID (Azure AD), leaving the device unrecoverable. This script confirms whether a successful escrow was logged recently, and if not, forces the backup for every RecoveryPassword protector on the target volumes. Detection signal: event ID 845 in the Microsoft-Windows... More info

Windows LAPS can report as compliant in Intune while the local admin password hasn't actually rotated in months. This script confirms whether a successful password backup was logged inside the expected window, and if not, forces a rotation with Reset-LapsPassword. Detection signal: event 10029 (Entra ID backup) or 10018 (Active Directory backup) i... More info

Lists every Intune-managed Windows device with its version, edition and the last day of security updates for that edition, and exports the result to CSV. Windows 11 support is split by edition, not by build. 24H2 is build 26100 on every edition, but Home and Pro lose support on 13 October 2026 while Enterprise and Education keep it until 12 Octobe... More info

Lists Intune devices that haven't checked in for $StaleDays days, cross-checked against the Entra ID activity timestamp, plus Entra-only devices that have gone quiet. Flags duplicate records left behind by a re-enrolment, devices with BitLocker keys stored in Entra, Autopilot devices and hybrid joined devices, so you know what is safe to delete bef... More info

When the Security event log is set to Do Not Overwrite (LogMode=Retain) and fills up, Windows can flip CrashOnAuditFail to 2, which locks out every non-administrator until the log is cleared. This script catches the condition early and remediates it: it resizes the log, sets it to overwrite as needed, and - if the lockout has already tripped - arch... More info

Lists every Intune device that is non-compliant, in its grace period, or in error, with the policy and setting that fails, when the grace period ends (Conditional Access blocks the user from then), and whether Intune has an email address to warn the user. Also shows what each compliance policy does when a device fails, and who it tells. Exports a C... More info

Lists every BitLocker recovery key that was viewed in Entra ID: who read it, when, from which IP, for which device, and whether the key has been rotated since. A key that was read and never rotated still unlocks the drive, so those come first. Also flags anyone who read keys for several devices in the period. Never reads a key itself: it only lists... More info