Created by Claude - please verify

Assignments - profiles, compliance, settings catalog (beta), apps and scripts (beta) with their assignments; referenced groups checked for existence and members.

Required Microsoft Graph permissions

DeviceManagementConfiguration.Read.All DeviceManagementApps.Read.All Group.Read.All — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Intune.

Endpoints: GET /v1.0/deviceManagement/deviceConfigurations|deviceCompliancePolicies?$expand=assignments · GET /beta/deviceManagement/configurationPolicies?$expand=assignments · GET /v1.0/deviceAppManagement/mobileApps?$expand=assignments · GET /beta/deviceManagement/deviceManagementScripts|deviceHealthScripts?$expand=assignments · GET /v1.0/groups/{id} ($batch)

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Intune Assignment Hygiene

Over time Intune fills up with profiles and apps that apply to nobody: never assigned, assigned only to deleted or empty groups, or only excluded. They look deployed in reviews and clutter troubleshooting. Objects assigned to All users and All devices at the same time can apply twice and conflict.