Created by Claude - please verify

Encryption and TPM / Secure Boot posture - 'encrypted' is what Intune reports, not a live disk check.

Required Microsoft Graph permissions

DeviceManagementManagedDevices.Read.All — application permission, granted to the app registration with admin consent.

Licence: Microsoft Intune.

Endpoints: GET /v1.0/deviceManagement/managedDevices · GET /beta/deviceManagement/managedDevices/{id}?$select=hardwareInformation,deviceHealthAttestationState (hardware scan)

TPM and Secure Boot are only returned per device, so they come from an on-demand scan (one Graph call per Windows device). Secure Boot comes from Device Health Attestation and is blank on devices that never reported it.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Device Encryption & TPM / Secure Boot Posture

Which managed devices hold company data unencrypted, and which Windows devices lack the hardware roots of trust (TPM 2.0, Secure Boot) that BitLocker, Windows Hello and Windows 11 depend on.

Intune returned no managed devices. Please contact support if this is not the expected result.