Get-IntuneUpdateRingComplianceReport

<#
.SYNOPSIS
    Reports update ring assignment versus actual OS build per device.

.DESCRIPTION
    Cross references each managed Windows device's current OS version
    against the update ring it is assigned to, so devices lagging
    several builds behind their ring are easy to identify.

.EXAMPLE
    .\Get-IntuneUpdateRingComplianceReport.ps1

.NOTES
    Requires Microsoft.Graph.DeviceManagement with an active
    Connect-MgGraph session.

.AUTHOR
    Shehryar Hassan
#>

$devices = Get-MgDeviceManagementManagedDevice -Filter "operatingSystem eq 'Windows'" -All
$rings = Get-MgDeviceManagementWindowsUpdateForBusinessConfiguration -All

$report = $devices | Select-Object DeviceName, OsVersion, LastSyncDateTime,
    @{N="DaysSinceSync";E={ (New-TimeSpan -Start $_.LastSyncDateTime -End (Get-Date)).Days }}

$report | Sort-Object DaysSinceSync -Descending | Select-Object -First 25 | Format-Table -AutoSize
Write-Host "Update ring policies configured: $($rings.Count)" -ForegroundColor Cyan