Created by Claude - please verify

Device certificates - on-demand scan of managedDeviceCertificateStates per managed device (beta, $batch).

Required Microsoft Graph permissions

DeviceManagementConfiguration.Read.All DeviceManagementManagedDevices.Read.All — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Intune with SCEP or PKCS certificate profiles.

Endpoint: GET /beta/deviceManagement/managedDevices/{id}/managedDeviceCertificateStates ($batch)

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Intune Device Certificates Expiring

SCEP and PKCS certificates from Intune authenticate devices to Wi-Fi, VPN and mail. They renew automatically - unless the device is offline or the certificate connector is down (see Connector & Integration Health). This scan lists certificates that expired, expire within 60 days, or failed to issue.

Press Run scan to read the certificates of every managed device.