Efficient way to get Autopilot Info from Entra ID Device ID

Audit devices by Entra ID, verify if they exist in Windows Autopilot, and export results to CSV using Microsoft Graph—fast, reliable, and admin-friendly.

If you manage a large device fleet, you’ve probably faced this question more than once:

“Is this device in Intune—and does it also exist in Autopilot?”

When you’re troubleshooting provisioning issues, cleaning up stale records, or validating a migration, manually checking device objects across portals wastes time and invites mistakes. That’s exactly where a small automation like this becomes a daily-life saver.

This post explains what the script does, why it’s useful, and how you can run it safely in real environments.

“Is this device in Intune—and does it also exist in Autopilot?”

When you’re troubleshooting provisioning issues, cleaning up stale records, or validating a migration, manually checking device objects across portals wastes time and invites mistakes. That’s exactly where a small automation like this becomes a daily-life saver.

This post explains what the script does, why it’s useful, and how you can run it safely in real environments.

What this script does (in plain English)

This PowerShell script creates an Autopilot Device Inventory by taking a list of Entra ID device IDs and checking two things for each device:

1. Does the device exist in Intune (managed devices)?
   It queries Microsoft Intune via Microsoft Graph:
   • Device name
   • Last sync time
   • Ownership (corporate/personal)
   • Entra ID device ID
   • Intune managed device ID
2. Does the device exist in Autopilot?
   It calls the Autopilot identities endpoint and flags whether the device has Autopilot data in Windows Autopilot.

Finally, it:

• Displays results in Out-GridView for quick filtering/sorting
• Exports results to a CSV file:
  C:\Temp\AutopilotInfoDevices.csv

Why you’d use it (real admin use cases)

Here are the most common scenarios where this script is genuinely helpful:

1) Autopilot troubleshooting

A device fails during enrollment and you need to confirm:

• It’s in Intune and
• It’s actually registered in Autopilot

2) Fleet cleanup and data hygiene

You have a list of device IDs (from CMDB, logs, exports, tickets) and want to quickly identify:

• Devices missing from Autopilot (not ready for modern provisioning)
• Devices that exist in Autopilot but aren’t actively managed / haven’t synced recently
• Devices state and prepare for bulk action (e.g. bulk update group tags)

3) Migration validation

During tenant moves, Windows 11 rollouts, or enrollment redesigns:

• Validate that the “right” devices are staged in Autopilot before rollout waves begin

How the script works (quick walkthrough)

Step 1 — Connects to Microsoft Graph

It starts with Connect-MgGraph so Graph cmdlets and requests can run.

Step 2 — Builds a results table

Creates a DataTable with columns:

• DeviceName
• lastSyncDateTime
• ownership
• EntraID
• IntuneID
• AutopilotInfo

Step 3 — Reads device IDs from a text file

It loads device IDs from:
C:\Temp\EntraIDs.txt

Each line should contain a single Entra/Azure AD device ID (GUID).

Step 4 — Queries Intune + Autopilot

For each Entra ID:

• Pulls Intune device data using Get-MgDeviceManagementManagedDevice -Filter "AzureAdDeviceId eq '...'".
• Calls Autopilot identities using Invoke-MgGraphRequest and marks:
  • “Has data in Autopilot”
  • or “Does not have Autopilot data.”

Step 5 — Shows and exports results

• Interactive view: Out-GridView
• CSV export (UTF-8, appended):
  AutopilotInfoDevices.csv

Requirements and permissions

PowerShell modules

You’ll typically want:

• Microsoft.Graph (Graph SDK)

Graph permissions (typical)

Depending on your environment and Graph configuration, you’ll usually need permissions that allow:

• Reading Intune managed devices
• Reading Autopilot device identities

In practice, that often means Graph scopes aligned with:

• Intune managed device read access
• Windows Autopilot identity read access

(Exact scopes can vary by tenant setup and whether you run delegated vs. app permissions.)

What you get in the output (and how to interpret it)

Key column: AutopilotInfo

• Has data in Autopilot → Device is registered for Autopilot provisioning
• Does not have Autopilot data → Not registered (or ID doesn’t match what Autopilot has)

LastSyncDateTime

• Helps you spot stale/non-active devices quickly
  (Example: devices that haven’t synced in weeks/months)

ownership

• Useful for identifying BYOD vs corporate context, especially when cleanup is required

The script (finally)

You can also find the script on my GitHub page.

<# 
.SYNOPSIS
    Builds a simple inventory report for a list of Entra ID device IDs:
    - Pulls device details from Intune (managedDevices)
    - Checks whether each device has Windows Autopilot identity data
    - Displays results in Out-GridView and exports to CSV

.PREREQUISITES
    - Microsoft.Graph PowerShell SDK installed
    - You are signed in with sufficient permissions to read:
        * Intune managed devices
        * Windows Autopilot device identities

.INPUT
    Text file with one Entra ID device ID (GUID) per line:
    C:\Temp\EntraIDs.txt

.OUTPUT
    Grid view + CSV:
    C:\Temp\AutopilotInfoDevices.csv
#>

# Connect to Microsoft Graph (interactive sign-in).
Connect-MgGraph

# -----------------------------
# Configuration
# -----------------------------
$InputPath  = "C:\Temp\EntraIDs.txt"
$ExportPath = "C:\Temp\AutopilotInfoDevices.csv"

# -----------------------------
# Prepare output table
# -----------------------------
$table = New-Object System.Data.DataTable
[void]$table.Columns.Add("DeviceName")
[void]$table.Columns.Add("LastSyncDateTime")
[void]$table.Columns.Add("Ownership")
[void]$table.Columns.Add("EntraID")
[void]$table.Columns.Add("IntuneID")
[void]$table.Columns.Add("AutopilotInfo")

# Read Entra device IDs from file
$deviceEntraIDIds = Get-Content -Path $InputPath
Write-Host "Count of devices: $($deviceEntraIDIds.Count)"

# -----------------------------
# Main loop
# -----------------------------
foreach ($EntraIDId in $deviceEntraIDIds) {

    # Reset variables for each iteration
    $info                = $null
    $autopilotDeviceInfo = $null
    $hasAutopilotData    = $null

    Write-Host "Processing: $EntraIDId"

    # 1) Query Intune managed device record by Entra/Azure AD device ID
    # NOTE: If multiple records could match (rare), you'd want to handle arrays.
    $info = Get-MgDeviceManagementManagedDevice -Filter "AzureAdDeviceId eq '$EntraIDId'" | Select-Object *

    # 2) Query Autopilot identity (Graph beta endpoint)
    # Filter by azureActiveDirectoryDeviceId
    $url = "https://graph.microsoft.com/beta/deviceManagement/windowsAutopilotDeviceIdentities?`$filter=azureActiveDirectoryDeviceId%20eq%20%27$EntraIDId%27"
    $autopilotDeviceInfo = (Invoke-MgGraphRequest -Method GET -Uri $url).value

    # Determine whether Autopilot data exists
    if (($null -ne $autopilotDeviceInfo) -and ($autopilotDeviceInfo -ne "")) {
        $hasAutopilotData = "Has data in Autopilot"
    }
    else {
        $hasAutopilotData = "Does not have Autopilot data."
    }

    # Extract fields from Intune managed device record
    # NOTE: If $info is $null (no Intune record), these will be empty.
    $deviceName            = $info.DeviceName
    $deviceLastSyncDateTime= $info.LastSyncDateTime
    $deviceEntraID         = $info.AzureAdDeviceId
    $deviceIntuneID        = $info.Id
    $ownership             = $info.ManagedDeviceOwnerType

    # Add row to report table
    [void]$table.Rows.Add(
        $deviceName,
        $deviceLastSyncDateTime,
        $ownership,
        $deviceEntraID,
        $deviceIntuneID,
        $hasAutopilotData
    )
}

# -----------------------------
# Display & export
# -----------------------------

# Interactive view (Windows PowerShell / desktop environments)
# Print results to terminal
$table | Format-Table -AutoSize | Out-String | Write-Host

# Interactive view (Windows PowerShell / desktop environments)
$table | Out-GridView -Title "Autopilot / Intune Device Inventory"

# Export to CSV (Append keeps adding to existing file—remove -Append if you prefer a fresh file each run)
$table | Export-Csv -NoTypeInformation -Path $ExportPath -Encoding UTF8 -Append

FAQ

Does this script delete or modify anything?

No. It’s read-only reporting (it queries and exports).

What if Intune returns nothing for a device?

That often means:

• The device isn’t an Intune-managed device, or
• The Entra ID doesn’t match a managed device record (wrong ID type, stale data, etc.)

Why might Autopilot data be missing?

Common reasons:

• Device was never registered in Autopilot
• Hardware hash was not uploaded
• Device is managed another way (manual enrollment, legacy processes)

Summary

This Autopilot Device Inventory script gives you a fast, repeatable way to verify device presence across:

• Microsoft Entra ID
• Microsoft Intune
• Windows Autopilot

If you’re managing real scale, it’s the kind of small automation that saves hours—especially when troubleshooting Autopilot readiness or validating rollout preparation.

If you want, I can also rewrite the script into a “production-ready” version with:

• retry + throttling handling
• clean logging
• timestamped exports
• optional input types (CSV, clipboard, single ID)

References and Documentation

• Overview of Windows Autopilot
• Create device groups for Windows Autopilot
• Manually register devices with Windows Autopilot