Collection of useful functions and procedures for PowerShell scripting

Lists the Apple MDM push certificate, every ADE enrolment token and every Apps and Books (VPP) token in Intune, with expiry date, days left and the Apple ID behind each one. Exports a CSV. Changes nothing in your tenant, so there is no WhatIf switch. https://atliso.com/blog/intune-apple-mdm-push-certificate-expired

Lists Intune devices that haven't checked in for $StaleDays days, cross-checked against the Entra ID activity timestamp, plus Entra-only devices that have gone quiet. Flags duplicate records left behind by a re-enrolment, devices with BitLocker keys stored in Entra, Autopilot devices and hybrid joined devices, so you know what is safe to delete bef... More info

Lists every Intune device that is non-compliant, in its grace period, or in error, with the policy and setting that fails, when the grace period ends (Conditional Access blocks the user from then), and whether Intune has an email address to warn the user. Also shows what each compliance policy does when a device fails, and who it tells. Exports a C... More info

Lists every BitLocker recovery key that was viewed in Entra ID: who read it, when, from which IP, for which device, and whether the key has been rotated since. A key that was read and never rotated still unlocks the drive, so those come first. Also flags anyone who read keys for several devices in the period. Never reads a key itself: it only lists... More info