{"id":9998,"date":"2026-11-07T06:26:19","date_gmt":"2026-11-07T06:26:19","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=9998"},"modified":"2026-11-07T06:26:20","modified_gmt":"2026-11-07T06:26:20","slug":"powershell-to-export-windows-autopatch-device-status-intune","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/powershell-to-export-windows-autopatch-device-status-intune","title":{"rendered":"Powershell to Export Windows Autopatch device status Intune"},"content":{"rendered":"\n
<#\n.SYNOPSIS\n    Exports Windows Autopatch device status and alerts to CSV.\n\n.DESCRIPTION\n    Reads the Autopatch reporting API the Intune portal uses (services.autopatch.microsoft.com - undocumented,\n    may change). The token comes from an Azure CLI sign-in for the \"Modern Workplace Customer APIs\" resource,\n    so no DevTools token copying is needed.\n\n    Requirements:\n      - Azure CLI (az). The sign-in uses the Windows broker, so run this in a normal visible window.\n      - An active Intune role (e.g. Intune Administrator via PIM) when you sign in - without it the API\n        returns 403. If you activate the role after signing in, run: az logout --username <upn>  then rerun.\n\n.PARAMETER TenantId\n    Optional. Defaults to the tenant of the account you sign in with.\n\n.PARAMETER OutputFolder\n    Where the CSVs are written. Defaults to the script folder.\n\n.PARAMETER Token\n    Optional fallback: a bearer token copied from Edge DevTools (Network tab, any services.autopatch.microsoft.com\n    request, \"authorization\" header). Never save it in this file.\n#>\n\n[CmdletBinding()]\nparam(\n    [string]$TenantId,\n    [string]$OutputFolder = $PSScriptRoot,\n    [string]$Token\n)\n\n$ErrorActionPreference = 'Stop'\n\n# ?? Token (Azure CLI sign-in) ?????????????????????????????????????????????????\n$AutopatchResource = 'c9d36ed4-91b3-4c87-b8d7-68d92826c96c'   # Modern Workplace Customer APIs (Autopatch backend)\nif (-not $Token) {\n    if (-not (Get-Command az -ErrorAction SilentlyContinue)) { throw 'Azure CLI (az) not found - install it or pass -Token.' }\n    $tenantArgs = if ($TenantId) { @('--tenant', $TenantId) } else { @() }\n    $tokJson = az account get-access-token --resource $AutopatchResource @tenantArgs --only-show-errors 2>$null\n    if ($LASTEXITCODE) {\n        Write-Host 'Sign in to the customer tenant (activate your Intune role first)...' -ForegroundColor Cyan\n        az login @tenantArgs --allow-no-subscriptions --only-show-errors --output none\n        if ($LASTEXITCODE) { throw 'Azure CLI sign-in failed or was cancelled.' }\n        $tokJson = az account get-access-token --resource $AutopatchResource @tenantArgs --only-show-errors\n        if ($LASTEXITCODE) { throw \"Could not get an Autopatch API token: $tokJson\" }\n    }\n    $tokInfo = $tokJson | ConvertFrom-Json\n    $Token = $tokInfo.accessToken\n    Write-Host \"Signed in as $(az account show --query user.name -o tsv) | Tenant $($tokInfo.tenant)\" -ForegroundColor Green\n}\n$autopatchToken = 'Bearer ' + ($Token -replace '^Bearer\\s+', '')\n$stamp = Get-Date -Format 'yyyyMMdd_HHmmss'\n\n# ?? Alert name friendly mapping ???????????????????????????????????????????????\n$alertMap = @{\n    \"SecureBootCertificateUpdateRequired\" = \"Secure Boot - Certificate update required\"\n    \"DeviceTelemetryNotReceived\"          = \"Device diagnostic data not received\"\n    \"DeviceDiagnosticDataNotReceived\"     = \"Device diagnostic data not received\"\n    \"HotpatchLCUBaselineMissing\"          = \"Hotpatch - Baseline missing to Hotpatch\"\n    \"HotpatchOSIncompatible\"              = \"Hotpatch - OS not compatible\"\n    \"MultipleSecurityUpdatesMissing\"      = \"Multiple security updates missing\"\n    \"DownloadIssue\"                       = \"Update Download Failed\"\n    \"DiskFull\"                            = \"Insufficient disk space for update\"\n    \"InstallCancelled\"                    = \"Update installation canceled\"\n    \"DownloadCancelled\"                   = \"Update download canceled\"\n    \"FileNotFound\"                        = \"Update files not found\"\n    \"AdminIPU\"                            = \"Repair devices\"\n    \"InstallIssue\"                        = \"Update installation failed\"\n    \"WindowsComponentCorruption\"          = \"Windows component corruption\"\n    # Seen 2026-11-07 - descriptive names, not necessarily the portal's wording\n    \"AUOptionSettingsConflict\"            = \"Automatic Updates setting conflicts with policy\"\n    \"EligibleAdminIPU\"                    = \"Eligible for repair (admin in-place upgrade)\"\n    \"HotpatchCHPEEnabledOnARM64\"          = \"Hotpatch - CHPE enabled on ARM64\"\n    \"HotpatchVBSDisabled\"                 = \"Hotpatch - VBS disabled\"\n}\n\n$headers = @{\n    Authorization       = $autopatchToken\n    \"client-request-id\" = [guid]::NewGuid().ToString()\n    Accept              = \"application\/json;odata.metadata=minimal\"\n}\n\n# ?? Fetch alert summary ???????????????????????????????????????????????????????\nWrite-Host \"Fetching Autopatch alert summary...\" -ForegroundColor Cyan\ntry {\n    $alertResponse = Invoke-RestMethod -Method GET `\n        -Uri \"https:\/\/services.autopatch.microsoft.com\/unified-reporting\/odata\/1.0\/DeviceAlertList\" `\n        -Headers $headers\n\n    $alerts = $alertResponse.value\n    Write-Host \"Alert types found: $($alerts.Count)\" -ForegroundColor Green\n\n    Write-Host \"`n=== Alert Summary ===\" -ForegroundColor Yellow\n    $alerts | Select-Object `\n        @{N=\"Alert Name\";   E={ $alertMap[$_.alertGroupName] ?? $_.alertGroupName }},\n        @{N=\"Severity\";     E={$_.alertGroupSeverity}},\n        @{N=\"Update Type\";  E={($_.alertGroupAffectedUpdateTypes | ConvertFrom-Json) -join \", \"}},\n        @{N=\"Device Count\"; E={$_.impactDeviceCount}},\n        @{N=\"State\";        E={$_.alertGroupState}},\n        @{N=\"Latest Date\";  E={$_.alertGroupLatestDateTime}} |\n        Sort-Object \"Device Count\" -Descending |\n        Format-Table -AutoSize\n\n    $alertSummaryPath = Join-Path $OutputFolder \"AutopatchAlertSummary_$stamp.csv\"\n    $alerts | Select-Object `\n        @{N=\"AlertName\";         E={ $alertMap[$_.alertGroupName] ?? $_.alertGroupName }},\n        @{N=\"AlertNameRaw\";      E={$_.alertGroupName}},\n        @{N=\"Severity\";          E={$_.alertGroupSeverity}},\n        @{N=\"State\";             E={$_.alertGroupState}},\n        @{N=\"AffectedUpdateType\";E={$_.alertGroupAffectedUpdateTypes}},\n        @{N=\"DeviceCount\";       E={$_.impactDeviceCount}},\n        @{N=\"RemediationAction\"; E={$_.alertGroupRemediationAction}},\n        @{N=\"LatestDateTime\";    E={$_.alertGroupLatestDateTime}} |\n        Export-Csv $alertSummaryPath -NoTypeInformation -Encoding UTF8\n    Write-Host \"Alert summary exported: $alertSummaryPath\" -ForegroundColor Green\n} catch {\n    Write-Host \"Alert summary failed: $_\" -ForegroundColor Red\n    if (\"$_\" -match '403|Forbidden') { Write-Host 'No access - activate an Intune role (e.g. Intune Administrator), then: az logout --username <upn> and rerun.' -ForegroundColor Yellow }\n}\n\n# ?? Fetch per-device status ???????????????????????????????????????????????????\nWrite-Host \"`nFetching device management status...\" -ForegroundColor Cyan\ntry {\n    $deviceStatus = @()\n    $uri = \"https:\/\/services.autopatch.microsoft.com\/unified-reporting\/odata\/1.0\/AutopatchManagementStatusDetails?`$count=true\"\n\n    do {\n        $response      = Invoke-RestMethod -Method GET -Uri $uri -Headers $headers\n        $deviceStatus += $response.value\n        $uri           = $response.'@odata.nextLink'\n        Write-Host \"  Retrieved $($deviceStatus.Count) devices...\" -ForegroundColor Gray\n    } while ($uri)\n\n    $withAlerts = $deviceStatus | Where-Object { $_.alertCount -gt 0 }\n\n    Write-Host \"`n================================================\" -ForegroundColor Yellow\n    Write-Host \"  Total devices      : $($deviceStatus.Count)\"     -ForegroundColor White\n    Write-Host \"  Devices with alerts: $($withAlerts.Count)\"       -ForegroundColor Red\n    Write-Host \"================================================\"   -ForegroundColor Yellow\n\n    # Show devices with alerts and friendly alert names\n    Write-Host \"`n=== Devices with Alerts ===\" -ForegroundColor Yellow\n    $withAlerts | ForEach-Object {\n        $friendlyAlerts = ($_.alertNames | ForEach-Object { $alertMap[$_] ?? $_ }) -join \"; \"\n        [PSCustomObject]@{\n            DeviceName    = $_.deviceName\n            UpdateStatus  = $_.updateStatus\n            OSVersion     = $_.osVersion\n            Alerts        = $friendlyAlerts\n            AlertCount    = $_.alertCount\n            LastSync      = $_.lastIntuneSyncDateTimeUTC\n        }\n    } | Sort-Object AlertCount -Descending | Format-Table -AutoSize -Wrap\n\n    # Export full device status\n    $devicePath = Join-Path $OutputFolder \"AutopatchBrokenDevices_$stamp.csv\"\n    \n    $withAlerts | ForEach-Object {\n        $friendlyAlerts = ($_.alertNames | ForEach-Object { $alertMap[$_] ?? $_ }) -join \"; \"\n        [PSCustomObject]@{\n            DeviceName       = $_.deviceName\n            SerialNumber     = $_.serialNumber\n            Model            = $_.model\n            OSVersion        = $_.osVersion\n            UpdateStatus     = $_.updateStatus\n            AlertCount       = $_.alertCount\n            Alerts           = $friendlyAlerts\n            LastIntuneSync   = $_.lastIntuneSyncDateTimeUTC\n        }\n    } | Sort-Object AlertCount -Descending |\n        Export-Csv $devicePath -NoTypeInformation -Encoding UTF8\n\n    Write-Host \"Exported $($withAlerts.Count) broken devices to: $devicePath\" -ForegroundColor Green\n\n    # Breakdown by alert type\n    Write-Host \"`nAlert breakdown:\" -ForegroundColor Cyan\n    $deviceStatus | ForEach-Object {\n        $_.alertNames | ForEach-Object { $alertMap[$_] ?? $_ }\n    } | Group-Object | Sort-Object Count -Descending | Format-Table Name, Count -AutoSize\n\n} catch {\n    Write-Host \"Device status failed: $_\" -ForegroundColor Red\n}\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-9998","post","type-post","status-publish","format-standard","hentry","category-research"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t