How to find configuration profile errors in Microsoft Intune

Before you start

Use an account that can read Intune policies and reports, such as one with the Read Only Operator role. The tenant needs an active Intune licence. The PowerShell example asks Intune to export a report, and Microsoft lists DeviceManagementConfiguration.ReadWrite.All as the least privileged permission that can start an export, so the script requests it even though it only reads. Your organisation may require administrator consent.

Know how fresh the figures are. Microsoft says the device assignment status can take 24 to 48 hours to reflect recent assignment or group changes. The examples read and export; they change no profile or device.

Option 1

Find configuration profile errors with PowerShell

Install the module once, then connect, export the report and keep the profiles with errors or conflicts.

# Install once, if the module is not already installed.
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'DeviceManagementConfiguration.ReadWrite.All' -NoWelcome
try {
    $jobs = 'https://graph.microsoft.com/v1.0/deviceManagement/reports/exportJobs'
    $body = @{
        reportName       = 'ConfigurationPolicyAggregate'
        format           = 'csv'
        localizationType = 'replaceLocalizableValues'
        select           = @('PolicyName', 'UnifiedPolicyType', 'UnifiedPolicyPlatformType',
            'NumberOfCompliantDevices', 'NumberOfErrorDevices', 'NumberOfConflictDevices',
            'NumberOfNotApplicableDevices', 'PolicyId')
    } | ConvertTo-Json
    $start = @{ Method = 'POST'; Uri = $jobs; Body = $body; ContentType = 'application/json' }
    $job = Invoke-MgGraphRequest @start
    while ($job.status -in 'notStarted', 'inProgress') {
        Start-Sleep -Seconds 5
        $job = Invoke-MgGraphRequest -Method GET -Uri "$jobs/$($job.id)"
    }
    if ($job.status -ne 'completed') { throw "The export ended as $($job.status)." }
    Invoke-WebRequest -Uri $job.url -OutFile './profile-status.zip'
    Expand-Archive -Path './profile-status.zip' -DestinationPath './profile-status' -Force
    $rows = Get-ChildItem -Path './profile-status' -Filter '*.csv' | Import-Csv
    $failing = { [int]$_.NumberOfErrorDevices + [int]$_.NumberOfConflictDevices }
    $report = @($rows | Select-Object *, @{ Name = 'Failing'; Expression = $failing } |
        Where-Object { $_.Failing -gt 0 } | Sort-Object Failing -Descending)
    if ($report.Count -eq 0) {
        Write-Output 'No configuration profile reports a device error or conflict.'
    } else {
        $report | Export-Csv -Path './profile-errors.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) profiles report at least 1 device error or conflict."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The report is the one behind the configuration list in the admin centre: 1 row per profile, settings catalog and template profiles alike, with how many devices succeeded, are in error, are in conflict or don't apply. Intune gives the export as a compressed CSV, which the script unpacks into ./profile-status. A device is counted once in every profile it fails, so the totals can add up to more than your device count.

Option 2

Review profile errors in the admin centre

1. Sign in to the Microsoft Intune admin centre for the correct tenant.
2. Go to Devices > Monitor and select Configuration policy assignment failures.
3. Read the number of devices in error or conflict for each profile. Policy type tells settings catalog, security baseline and endpoint security profiles apart, and you can filter by type and platform or search by name.
4. Select a profile to see the devices and users in a failure state, then select a device to see the setting that failed and its error code.
5. Select Export to keep a CSV of the list. Leave the report without changing anything.

This suits working through failures. Microsoft marks the report as preview, and it shows what fails now, not a record to compare with last month.

Common questions

What is the difference between an error and a conflict?

An error means the profile failed to apply, usually with an error code that links to an explanation. A conflict means 2 settings reach the same device with different values, or the device has a setting Intune can't override. In the admin centre, a device's conflict row lists every profile that holds the setting.

Why don't the counts match the device list?

Microsoft says it's normal for the check-in status and the device assignment status to differ, and that the assignment status can take 24 to 48 hours to catch up on large tenants. Both depend on each device's last check-in.

Does a non-compliant device show here?

No. Compliance policies report separately from configuration profiles, and a device can apply every profile and still fail compliance. To find those, see how to find non-compliant devices in Microsoft Intune.