Endpoint Manager: Find machines not in Autopilot

When it comes to managing your endpoints in endpoint manager, one of the things you may be looking to do is to get all of your Intune registered machines to also be enrolled as Autopilot devices.

Now we can of course just have the deployment profile deployed to all machines and then hit the "Convert targeted machines to autopilot" but this might not necessarily be feasible for every client. We may want to perform some due diligence first so we can at least understand what devices in Intune are not in Autopilot.

When you go into Reports - Endpoint Analytics you should see the overview of our whole estate with the Endpoint Analytics score. But if you also see on the far right where the baseline toggles are is the Insights and recommendations which indicates how many by percentage are not registered with Autopilot.

Whilst this is good information to know, there isn't a direct way of seeing exactly which machines are actually not registered, and this is where we come in.

So the first thing we want to do is to be able to connect to our Intune tenancy which we can use the following

Install-Module AzureAD
Install-Module WindowsAutopilotIntune
Install-Module Microsoft.Graph.Intune
Connect-MSGraph

This portion will allow you to connect to your Endpoint Manager tenancy using MS Graph. As we are not pre-caching any credentials you'll need to login manually.

You should then see the connection details of your UPN and TenantId. Once done then use the following commands

$DevicesInIntune = Get-IntuneManagedDevice -Filter "operatingsystem eq 'Windows'" | Get-MSGraphAllPages | Select Userdisplayname, devicename, serialnumber, manageddeviceid
$DevicesInIntune | ForEach-Object {$_.serialnumber} {If (Get-AutopilotDevice -Serial $_.serialnumber)
{$_.Devicename + " " + $_.serialnumber + " Yes"} else {$_.Devicename + " " + $_.serialnumber + " No"}} | Out-File C:\Temp\Autopilotnotregistered.txt

This should then produce a text file with all of your machines according to what you have in Intune so that you have an accurate understanding of what is actually in Autopilot and what isn't.

Bear in mind that when you run the Get-IntuneManagedDevice command with no filter you will get every single device, whether it be Windows, iOS or Android. This is important to note as you may get every single device and it won't make much sense as Autopilot is only for Windows devices, which is why the code above limits it to only Windows devices.

You can however change these filters if you wanted to limit it down to a specific vendor.

For example Get-IntuneManagedDevice -Filter "Manufacturer eq 'HP'" if requiring to narrow the search down where required.