Created by Claude - please verify

Secure Boot certificates - reads the output of a detection-only Intune remediation that you deploy (script below); Intune's own Secure Boot report was withdrawn.

Required Microsoft Graph permissions

DeviceManagementConfiguration.Read.All DeviceManagementManagedDevices.Read.All — application permissions, granted to the app registration with admin consent.

Licence: Intune remediations need Windows Enterprise E3/E5 (or Microsoft 365 E3/E5, A3/A5, Windows VDA).

Endpoints: GET /beta/deviceManagement/deviceHealthScripts · GET /beta/deviceManagement/deviceHealthScripts/{id}/deviceRunStates?$expand=managedDevice

The remediation must be named 'Secure Boot ...' (or mention UEFICA2023 in its description) so this report can find it.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Secure Boot Certificate Update Readiness

Microsoft's original Secure Boot certificates expire in 2026: the KEK CA 2011 and UEFI CA 2011 in June, and the Windows Production PCA 2011 on 19 October 2026. Devices that have not received the 2023 certificates keep booting, but they can no longer get boot manager security fixes or revocations (the BlackLotus class of attacks). Windows installs the new certificates through cumulative updates and a servicing task; some models need an OEM firmware update first.

Detection script to deploy (Intune > Devices > Scripts and remediations > Create, detection only, run as system, 64-bit)

# IntensiveReports - Secure Boot 2023 certificate status (detection only)
$ErrorActionPreference = 'SilentlyContinue'
$sb = $false; try { $sb = Confirm-SecureBootUEFI } catch { }
$svc = Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing'
$status = [string]$svc.UEFICA2023Status
$err = [string]$svc.UEFICA2023Error
$db2023 = $false; try { $db2023 = [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023' } catch { }
$bios = (Get-CimInstance Win32_BIOS).SMBIOSBIOSVersion
Write-Output ('SecureBoot=' + $sb + ';UEFICA2023Status=' + $status + ';UEFICA2023Error=' + $err + ';DbHas2023=' + $db2023 + ';Firmware=' + $bios)
if ($sb -and ($status -eq 'Updated' -or $db2023)) { exit 0 } else { exit 1 }