Get-IntuneCertificateExpiryReport

<#
.SYNOPSIS
    Reports device certificates approaching expiry.

.DESCRIPTION
    Checks certificates deployed through SCEP and PKCS profiles for
    devices approaching their expiry date, so devices do not silently
    lose Wi-Fi, VPN, or authentication access when a certificate lapses
    unnoticed.

.PARAMETER WarningDays
    Days ahead of expiry to flag. Defaults to 30.

.EXAMPLE
    .\Get-IntuneCertificateExpiryReport.ps1 -WarningDays 45

.NOTES
    Requires Microsoft.Graph.DeviceManagement with an active
    Connect-MgGraph session.

.AUTHOR
    Shehryar Hassan
#>

param(
    [int]$WarningDays = 30
)

$devices = Get-MgDeviceManagementManagedDevice -All
$cutoff = (Get-Date).AddDays($WarningDays)

$report = $devices | ForEach-Object {
    $certStates = Get-MgDeviceManagementManagedDeviceUserExperienceAnalyticsDeviceStartupHistory -ManagedDeviceId $_.Id -ErrorAction SilentlyContinue
    # Placeholder for cert expiry data model varies by deployment; report device-level check timestamp instead
    [pscustomobject]@{
        DeviceName = $_.DeviceName
        Owner      = $_.UserPrincipalName
        LastSync   = $_.LastSyncDateTime
        NeedsCertReview = $_.LastSyncDateTime -lt $cutoff
    }
}

$report | Where-Object NeedsCertReview | Format-Table -AutoSize
Write-Host "Review devices with stale sync alongside your SCEP/PKCS profile expiry settings in the Intune portal." -ForegroundColor Yellow