How to export your device inventory from Intune, step by step

The documented export, in five clicks

Microsoft Learn training for Intune reporting documents the path. Sign in to the Microsoft Intune admin center and go to Devices, then All devices. Select Columns, add the fields you want and apply. Filter if you only want one platform or ownership type. Select Export and confirm; Intune downloads a zipped CSV. The Graph reports reference names the same export DevicesWithInventory, available under Devices, then All devices, then Export.

For a refresh decision, add every column offered before you export. The report reference lists the columns: device name, serial number, manufacturer, model, OS version, last contact, created date, total and free storage, user principal name, join type, management agent, ownership, compliance state, encryption, SKU family, processor architecture, BIOS version, TPM manufacturer and version, and the Ethernet and Wi-Fi MAC addresses. Created date is your enrollment date, and for most fleets the best available proxy for purchase date.

What the export leaves out

Two columns people expect are missing: the processor model and the physical memory. The DevicesWithInventory export carries processor architecture, which tells you x64 from ARM64 and nothing about generation, and it carries no RAM figure at all. A refresh decision built on the All devices export alone therefore cannot tell an eighth-generation laptop from a sixth-generation one, and cannot see the 4 GB machines.

Memory is in Graph, with a catch. The managedDevice resource exposes physicalMemoryInBytes, and Microsoft notes that the default is 0; to retrieve the actual value you must make a GET call for the individual device and include the property in the select parameter. A list call returns zeros. Scripts that pull the device list and read memory from it will report every device as having no RAM, which is a common and confusing result.

Adding processor, memory, battery and TPM with the properties catalog

For Windows devices, Intune collects hardware detail through a properties catalog policy. Go to Devices, then Windows, then Configuration, then Create, choose Windows 10 and later, and pick the Properties catalog profile type. Microsoft lists the categories you can collect: battery, BIOS, CPU, disk drive, memory, system enclosure, TPM, video controller, logical drive, encryptable volume and Windows quality updates. Initial collection takes up to 24 hours, and the results appear on each device under Tools, then Device inventory.

Microsoft names the use case itself: identify devices that need to be replaced based on hardware properties like disk size or memory. The video controller category is the one most fleets forget, and it is the one that shows which desks have a discrete GPU. Querying the collected properties across many devices at once is a device query feature in Advanced Analytics, which Microsoft added to Microsoft 365 E3 from July 2026.

The second export: Endpoint analytics device performance

Age and hardware tell you what a device is. Endpoint analytics tells you how it behaves. Under Reports, Endpoint analytics, Startup performance, the Device performance tab lists startup score, core boot time, restart count and blue screen count per device, and it exports to CSV like any Intune report. Devices enrolled in Endpoint analytics need a valid Intune license, and the base reports support Intune-managed, co-managed and tenant-attached Configuration Manager clients on Windows Pro, Enterprise and Education.

Advanced Analytics adds the resource performance report, with CPU and RAM usage by device, model and manufacturer, and the battery health report. Microsoft defines CPU usage above 50 percent and RAM usage above 75 percent as spikes, averages the percentage of usage time spent in spikes over 14 days, and shows processor name, cores, base speed, RAM and disk type on the device page. If you have it, export this report too. These reports add hardware and performance evidence. Supply application-use evidence for workload fit and the Windows readiness report or additional hardware inventory for Windows 11 readiness.

The licensing you may already have

Check before you buy anything. Microsoft's Intune pricing page, read at the end of October 2026, lists Intune Plan 1 at $8 per user per month, the Plan 2 add-on at $4, the Intune Suite at $10 and Advanced Analytics on its own at $5 per user per month. The same page says that from July 2026 Microsoft 365 E3 customers receive Remote Help, Advanced Analytics and Intune Plan 2 capabilities, and the Intune blog of December 2025 described the same additions to Enterprise Mobility and Security E3, with Endpoint Privilege Management, Enterprise App Management and Cloud PKI going to Microsoft 365 E5.

An E3 or E5 tenant that never bought the add-on may therefore find the resource performance and battery health reports waiting under Reports, then Endpoint analytics. Business Premium tenants are reported not to be included in the change, so a smaller organization should check its own admin center rather than assume. Either way, the base device performance export is available to any tenant with Intune licensing.

Windows 11 readiness, by device

The Windows feature update device readiness report, under Reports, Device management, Windows updates, Reports, then Windows Feature Update Device Readiness Report, gives each device a readiness status of Low, Medium or High risk, Upgraded, Unknown, or Replace device for a device that is not capable of upgrading to the target version. The system requirement issue codes name the blocker: processor family, memory, BIOS, TPM, system drive size, Secure Boot or storage. Microsoft notes the data can lag by about 52 hours, so run it a few days before you plan to export.

Reading the same data through Microsoft Graph, read-only

A connected refresh service does not need a human to click Export. Listing managed devices through Graph needs DeviceManagementManagedDevices.Read.All, as delegated or application permission. The Endpoint analytics device performance entity in the beta endpoint needs the same read scope and returns disk type, boot score, core boot time, restart and blue screen counts and model scores.

One detail decides the architecture. Microsoft documents the report export job API, which creates the same CSV downloads the console produces, with read-write scopes only; the least privileged permission listed is DeviceManagementConfiguration.ReadWrite.All. A strictly read-only application therefore cannot use export jobs. It reads devices and analytics through GET calls instead. Microsoft documents the 100-requests-per-tenant-per-minute limit for exportJobs; that limit does not establish the limits for these device and analytics endpoints. That is how our connected mode stays read-only: a dedicated app registration, read scopes only, and no export job.

Once you have the two files, the scoring is the easy part. The verdicts page shows how the five signals are weighted, the sample report shows the output, and the initial report sends you a secure upload link for the files within one business day.

Common questions