Get-WindowsUpdateComplianceReport

<#
.SYNOPSIS
    Summarizes Windows patch compliance across managed devices.

.DESCRIPTION
    Groups managed Windows devices by OS build and reports how many
    devices are on each build, making it easy to see how far behind the
    fleet is from the latest cumulative update without opening every
    device record individually.

.EXAMPLE
    .\Get-WindowsUpdateComplianceReport.ps1

.NOTES
    Requires Microsoft.Graph.DeviceManagement with an active
    Connect-MgGraph session.

.AUTHOR
    Shehryar Hassan
#>

$devices = Get-MgDeviceManagementManagedDevice -Filter "operatingSystem eq 'Windows'" -All

$devices | Group-Object OsVersion | Sort-Object Count -Descending |
    Select-Object @{N="OSBuild";E={$_.Name}}, Count | Format-Table -AutoSize

$stale = $devices | Where-Object { $_.LastSyncDateTime -lt (Get-Date).AddDays(-14) }
Write-Host "$($stale.Count) device(s) have not synced in over 14 days, their reported build may be out of date." -ForegroundColor Yellow