Get-IntuneNonCompliantDeviceReport

<#
.SYNOPSIS
    Reports non compliant devices and their failing policies.

.DESCRIPTION
    Lists every device with a non compliant state and, for each one, the
    specific compliance policy setting it is failing, since the Intune
    dashboard shows the count but not the reason for each device.

.EXAMPLE
    .\Get-IntuneNonCompliantDeviceReport.ps1

.NOTES
    Requires Microsoft.Graph.DeviceManagement with an active
    Connect-MgGraph session.

.AUTHOR
    Shehryar Hassan
#>

$devices = Get-MgDeviceManagementManagedDevice -Filter "complianceState eq 'noncompliant'" -All

$report = foreach ($device in $devices) {
    $states = Get-MgDeviceManagementManagedDeviceDeviceCompliancePolicyState -ManagedDeviceId $device.Id |
        Where-Object { $_.State -eq "nonCompliant" }
    [pscustomobject]@{
        DeviceName    = $device.DeviceName
        Owner         = $device.UserPrincipalName
        FailingPolicies = ($states.DisplayName -join ", ")
        LastSync      = $device.LastSyncDateTime
    }
}

$report | Sort-Object LastSync | Format-Table -AutoSize
Write-Host "$($devices.Count) non compliant device(s) found" -ForegroundColor Cyan