Export-DeviceCompliance

<#
.SYNOPSIS
    Exports per device compliance policy state to CSV.

.DESCRIPTION
    For every managed device, resolves each assigned compliance policy
    and its pass/fail state, and writes one row per device/policy
    combination to CSV, giving a full fleet compliance picture beyond
    just the overall compliant/non compliant flag.

.PARAMETER ExportPath
    Path to write the CSV to. Defaults to the current directory.

.EXAMPLE
    .\Export-DeviceCompliance.ps1 -ExportPath C:\Reports

.NOTES
    Requires Microsoft.Graph.DeviceManagement with an active
    Connect-MgGraph session.

.AUTHOR
    Shehryar Hassan
#>

param(
    [string]$ExportPath = (Get-Location).Path
)

$devices = Get-MgDeviceManagementManagedDevice -All

$rows = foreach ($device in $devices) {
    $states = Get-MgDeviceManagementManagedDeviceDeviceCompliancePolicyState -ManagedDeviceId $device.Id
    if ($states) {
        foreach ($state in $states) {
            [pscustomobject]@{
                DeviceName = $device.DeviceName
                Owner      = $device.UserPrincipalName
                Policy     = $state.DisplayName
                State      = $state.State
            }
        }
    } else {
        [pscustomobject]@{
            DeviceName = $device.DeviceName
            Owner      = $device.UserPrincipalName
            Policy     = "(no policy assigned)"
            State      = "n/a"
        }
    }
}

$file = Join-Path $ExportPath "device-compliance-export_$(Get-Date -Format yyyyMMdd_HHmmss).csv"
$rows | Export-Csv -Path $file -NoTypeInformation
Write-Host "Exported $($rows.Count) row(s) across $($devices.Count) device(s) to $file" -ForegroundColor Cyan