How to export Windows Autopilot devices in Microsoft Intune

Before you start

Use an account that can read Windows Autopilot devices: an Intune Administrator, or an Intune role with the Enrollment programs permission Read device, such as Read Only Operator. The tenant needs an active Intune licence. The PowerShell example requests DeviceManagementServiceConfig.Read.All; your organisation may require administrator consent.

The script reads the list as Intune holds it when it runs, so the CSV is a snapshot. It writes named columns, leaving out ProductKey. The examples read and export and change nothing.

Option 1

Export Autopilot devices with PowerShell

Install the modules once, then connect and export every registered device. Any error stops the script before it writes a partial CSV.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
Install-Module Microsoft.Graph.DeviceManagement.Enrollment -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'DeviceManagementServiceConfig.Read.All' -NoWelcome
try {
    $devices = @(Get-MgDeviceManagementWindowsAutopilotDeviceIdentity -All)
    if ($devices.Count -eq 0) {
        Write-Output 'No devices are registered with Windows Autopilot.'
    } else {
        $devices | Sort-Object SerialNumber |
            Select-Object SerialNumber,Manufacturer,Model,GroupTag,PurchaseOrderIdentifier,
                EnrollmentState,LastContactedDateTime,UserPrincipalName,DisplayName,
                ManagedDeviceId,AzureActiveDirectoryDeviceId,Id |
            Export-Csv -Path './autopilot-devices.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($devices.Count) Autopilot devices exported."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The CSV has 1 row for each device, sorted by serial number. EnrollmentState is enrolled, notContacted (imported but not enrolled), pendingReset, failed or unknown. UserPrincipalName is the assigned user, blank when there is none. ManagedDeviceId and AzureActiveDirectoryDeviceId link a row to its Intune and Entra ID devices. To narrow the export, add a Where-Object step before Select-Object, such as Where-Object { $_.GroupTag -eq 'Sales' }; to widen it, add properties to Select-Object.

Check a single device

Reconnect with Connect-MgGraph, then look up 1 device by serial number. The filter runs on your side, after the whole list is read.

# Run while connected to Microsoft Graph. Replace the example serial number.
Get-MgDeviceManagementWindowsAutopilotDeviceIdentity -All |
    Where-Object { $_.SerialNumber -eq 'EXAMPLE-1234' } |
    Select-Object SerialNumber,GroupTag,EnrollmentState,LastContactedDateTime,UserPrincipalName

Option 2

Find Autopilot devices in the admin centre

1. Sign in to the Microsoft Intune admin centre for the correct tenant.
2. Select Devices, then under By platform select Windows.
3. Under Device onboarding, select Enrollment.
4. Under Windows Autopilot, select Devices to open the Windows Autopilot devices list.
5. Type a serial number in the Search by serial number box, or read the list. Leave Import and Delete alone, so nothing changes.

This suits looking up 1 device or checking a short list. For a CSV of every device, use PowerShell or Altivane.

Common questions

Why does the CSV not say which profile a device has?

The Graph device identity holds the device's own details and the IDs of its linked devices, with no property for the deployment profile or whether one is assigned. Altivane's report adds Profile and Profile status.

Why is a device in the Autopilot list but not in Windows devices?

They are different lists. Microsoft says a registered device joins Devices > Windows > Windows devices only when registration succeeds and a licensed user has signed in on it. A device showing notContacted has not enrolled yet. To list enrolled devices that fail compliance, see how to find non-compliant devices in Microsoft Intune.

Why does the script return an error or nothing at all?

Check the licence, the role and the consent first: the call needs an active Intune licence, a role that can read enrolment programs, and consent for DeviceManagementServiceConfig.Read.All. A device imported moments ago can take several minutes to appear: on the Windows Autopilot devices list, select Sync, then Refresh until it shows.