Created by Claude - please verify

Intune tenant hygiene - reads the classic enrollment restriction types; per-platform restriction policies created in the new UI may appear under their own names.

Required Microsoft Graph permissions

DeviceManagementServiceConfig.Read.All — application permission, granted to the app registration with admin consent.

Licence: Microsoft Intune.

Endpoints: GET /v1.0/deviceManagement?$select=settings · GET /v1.0/deviceManagement/deviceEnrollmentConfigurations

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Intune Tenant Hygiene

Three tenant-wide Intune switches quietly decide whether Conditional Access 'require compliant device' means anything: whether a device with no compliance policy counts as compliant, how long a device stays compliant without checking in, and whether personal devices can enroll into full management.

No Intune settings were returned. Please contact support if this is not the expected result.