How to export compliance policy settings in Microsoft Intune

Before you start

Use an Intune Administrator, or an account with an Intune role that can read device compliance policies, such as Read Only Operator. The tenant needs an active Intune licence. The PowerShell example requests DeviceManagementConfiguration.Read.All; your organisation may require administrator consent.

The policies are read live. The export covers the settings in each policy, not whether devices meet them, and not the tenant-wide settings such as how a device with no policy is marked. The examples read and export and change nothing.

Option 1

Export compliance policy settings with PowerShell

Install the modules once, then connect, read the policies and write out each setting.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.DeviceManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'DeviceManagementConfiguration.Read.All' -NoWelcome
try {
    $policies = @(Get-MgDeviceManagementDeviceCompliancePolicy -All)
    $report = foreach ($policy in $policies) {
        # Each platform's own settings arrive in AdditionalProperties.
        $settings = $policy.AdditionalProperties
        $platform = "$($settings['@odata.type'])" -replace '^#microsoft\.graph\.', ''
        foreach ($name in ($settings.Keys | Sort-Object)) {
            $value = $settings[$name]
            if ($name -like '*@odata*' -or $null -eq $value) { continue }
            if ($value -isnot [string] -and $value -is [System.Collections.IEnumerable]) {
                $value = ConvertTo-Json -InputObject $value -Compress -Depth 4
            }
            [pscustomobject]@{
                Policy = $policy.DisplayName
                Platform = $platform
                Setting = $name
                Value = $value
            }
        }
    }
    $report = @($report)
    if ($report.Count -eq 0) {
        Write-Output 'No compliance policy settings were found.'
    } else {
        $file = './compliance-policy-settings.csv'
        $report | Export-Csv -Path $file -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) settings of $($policies.Count) policies written to $file."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The CSV has 1 row for each setting of each policy, under Microsoft Graph's property name, such as passwordRequired or osMinimumVersion, with the platform taken from the policy's type, such as windows10CompliancePolicy. A list or a nested value is kept whole as JSON in Value. To compare 1 policy over time, filter the file on Policy and keep each month's copy.

Option 2

Read a compliance policy's settings in the admin centre

1. Sign in to the Microsoft Intune admin centre for the correct tenant.
2. Go to Devices and, under Manage devices, select Compliance.
3. Select the policy. Intune opens its Monitor tab.
4. Select the Properties tab to read each setting the policy configures, and its assignments. Leave Edit alone, so nothing changes.

This suits reading 1 policy in the words the admin centre uses. There's no export of the settings here, so a record of every policy, or a comparison from one month to the next, takes PowerShell or a report.

Common questions

Why does the export list settings nobody set?

Microsoft Graph returns every property of the policy's platform type, set or not, so a setting left Not configured still comes back with its default value. Read each value with Microsoft's settings reference for that platform beside it.

Where are the tenant-wide compliance settings?

Not in any policy. Mark devices with no compliance policy assigned as and Compliance status validity period (days) are under Endpoint security > Device compliance > Compliance policy settings in the Intune admin centre. Microsoft sets the validity period to 30 days by default.

Which devices fail these settings?

The settings say what a policy asks for; the devices' compliance states say who falls short. See how to find non-compliant devices in Microsoft Intune.