How to find unencrypted Windows devices in Microsoft Intune

Before you start

Use an account that can read Intune devices and reports; Microsoft names Read Only Operator as the least privileged built-in Intune role for the reports. The tenant needs an active Intune licence. The PowerShell example requests DeviceManagementManagedDevices.Read.All; your organisation may require administrator consent.

A Windows device that is not enrolled in Intune never appears. For a Windows device, Intune's encryption status describes the OS drive and does not check other drives. The examples read and export; they change no device or policy.

Option 1

Find unencrypted Windows devices with PowerShell

Install the modules once, then connect and export the Windows devices that Intune does not report as encrypted.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.DeviceManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'DeviceManagementManagedDevices.Read.All' -NoWelcome
try {
    $props = 'id', 'deviceName', 'userPrincipalName', 'operatingSystem', 'osVersion',
        'complianceState', 'isEncrypted', 'lastSyncDateTime', 'serialNumber'
    $devices = Get-MgDeviceManagementManagedDevice -All -Property $props
    $windows = @($devices | Where-Object { $_.OperatingSystem -eq 'Windows' })
    $report = @($windows | Where-Object { -not $_.IsEncrypted } | Sort-Object DeviceName |
        Select-Object DeviceName,UserPrincipalName,OsVersion,ComplianceState,
            LastSyncDateTime,SerialNumber,Id)
    if ($windows.Count -eq 0) {
        Write-Output 'No Windows devices are enrolled in Intune.'
    } elseif ($report.Count -eq 0) {
        Write-Output "All $($windows.Count) Windows devices report encryption."
    } else {
        $report | Export-Csv -Path './unencrypted-windows.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) of $($windows.Count) Windows devices are not encrypted."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The script keeps Windows devices where IsEncrypted is false or empty, and sorts them by name. It reads every managed device and filters in PowerShell. To keep only devices that are also non-compliant, add -and $_.ComplianceState -eq 'noncompliant' to the second Where-Object. LastSyncDateTime is the device's last successful sync, so an old date means its encryption state may be out of date.

Option 2

Review device encryption in the admin centre

1. Sign in to the Microsoft Intune admin centre for the correct tenant.
2. Go to Devices > Manage devices > Configuration, open the Monitor tab and select Device encryption status.
3. Read OS, Encryption readiness and Encryption status for each device. The report lists macOS devices too, so use OS to pick out Windows.
4. Select a device to open its Device encryption status pane. For Windows it shows Profiles, Profile state summary and Status details, such as an unprotected OS volume.
5. Select Export on the report to download a .csv file with the status details for each device.

This suits 1 tenant, or finding out why 1 device is not encrypted. It does not rate the result or keep a copy of each run.

Common questions

Why does a device that finished encrypting still show as not encrypted?

Microsoft says it can take up to 24 hours for Intune to report a device's encryption status or a change to it, including the time to encrypt and report back. Check LastSyncDateTime before you chase the device.

Does a device in the list prove its data drives are unprotected?

No. Intune's encryption status for a Windows device is about the OS drive, so an encrypted device can still have an unprotected data drive. Where a BitLocker policy covers fixed drives, Status details can say so.

Why is an unencrypted device also non-compliant?

A compliance policy that sets Encryption of data storage on a device to Require marks a device without encryption as non-compliant. The Require BitLocker setting is measured at boot time, so a device that has finished encrypting may need a restart before it counts as compliant. To list those devices, see how to find non-compliant devices.