Get-EntraDeviceComplianceGapReport

<#
.SYNOPSIS
    Finds directory devices with no Intune compliance record.

.DESCRIPTION
    Lists devices registered in Entra ID and cross references them
    against Intune managed devices, flagging any device that exists in
    the directory but has no matching compliance record, a common sign
    of a device that enrolled but never fully checked in.

.EXAMPLE
    .\Get-EntraDeviceComplianceGapReport.ps1

.NOTES
    Requires Microsoft.Graph.Identity.DirectoryManagement and
    Microsoft.Graph.DeviceManagement with an active Connect-MgGraph
    session.

.AUTHOR
    Shehryar Hassan
#>

$directoryDevices = Get-MgDevice -All -Property Id,DisplayName,DeviceId,ApproximateLastSignInDateTime
$managedDevices = Get-MgDeviceManagementManagedDevice -All

$managedDeviceIds = $managedDevices.AzureAdDeviceId

$gaps = $directoryDevices | Where-Object { $_.DeviceId -notin $managedDeviceIds } |
    Select-Object DisplayName, DeviceId, ApproximateLastSignInDateTime

$gaps | Sort-Object ApproximateLastSignInDateTime -Descending | Format-Table -AutoSize
Write-Host "$($gaps.Count) directory device(s) with no matching Intune compliance record" -ForegroundColor Cyan