How to find personally owned devices in Microsoft Intune

Before you start

Use an Intune Administrator, or an account with an Intune role that can read managed devices, such as Read Only Operator. The tenant needs an active Intune licence. The PowerShell example requests DeviceManagementManagedDevices.Read.All; your organisation may require administrator consent.

The list covers devices enrolled in Intune, read as Intune holds them now. Microsoft says Intune marks devices that are Microsoft Entra registered as personal. The examples read and export and change nothing.

Option 1

Find personally owned devices with PowerShell

Install the modules once, then connect, read the managed devices and export the personal ones.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication,
    Microsoft.Graph.DeviceManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'DeviceManagementManagedDevices.Read.All' -NoWelcome
try {
    $properties = 'deviceName', 'userPrincipalName', 'operatingSystem', 'osVersion',
        'managedDeviceOwnerType', 'complianceState', 'lastSyncDateTime', 'enrolledDateTime',
        'model'
    $devices = @(Get-MgDeviceManagementManagedDevice -All -Property $properties)
    $report = @($devices | Where-Object { "$($_.ManagedDeviceOwnerType)" -eq 'personal' } |
        Sort-Object OperatingSystem, DeviceName |
        Select-Object DeviceName, UserPrincipalName, OperatingSystem, OsVersion,
            ComplianceState, LastSyncDateTime, EnrolledDateTime, Model)
    if ($report.Count -eq 0) {
        Write-Output "None of the $($devices.Count) managed devices is personally owned."
    } else {
        $report | Export-Csv -Path './personal-devices.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) of $($devices.Count) devices are personally owned."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The CSV has 1 row for each personal device, grouped by platform. ComplianceState and LastSyncDateTime show whether the device still meets your policies and still checks in. The script filters after reading every device, so on a large tenant it takes a while. Change 'personal' to 'company' for the corporate devices, or to 'unknown' for devices Intune hasn't classed.

Count devices by platform and ownership

Reconnect with Connect-MgGraph, then count the devices for each platform and ownership. The export above disconnects when it finishes.

# Run while connected to Microsoft Graph.
$properties = 'operatingSystem', 'managedDeviceOwnerType'
Get-MgDeviceManagementManagedDevice -All -Property $properties |
    Group-Object OperatingSystem, ManagedDeviceOwnerType | Sort-Object Count -Descending |
    Select-Object Count, Name

Option 2

Review personal devices in the admin centre

1. Sign in to the Microsoft Intune admin centre for the correct tenant.
2. Go to Reports > Device compliance, select the Reports tab, then Device compliance.
3. Set the Ownership filter to personal devices, then select Generate report. Export the report data if you want to keep it.
4. For 1 device, go to Devices > All devices, select it and open Properties to read Device ownership. Leave the page without saving.

This suits a check of personal devices against your compliance policies. For a list to keep, with each device's user, platform and last sync, use PowerShell or Altivane.

Common questions

Why is a company laptop listed as personal?

Microsoft marks Windows devices enrolled through Add Work Account, the MDM only option or the Company Portal app as personal. A corporate identifier counts only at enrolment, for the enrolment restrictions, and afterwards the device still shows as personal. Devices enrolled through Windows Autopilot are marked corporate.

What happens if a device is changed to personal?

Microsoft says that changing a device from corporate to personal makes Intune delete the app information it collected from that device within 7 days. Intune still collects the inventory of apps IT installed and a partial phone number. Check before you change a device's ownership.

Do personal devices still have to be compliant?

Yes. Compliance policies apply to any enrolled device they're assigned to, whoever owns it. To list the devices that fail, see how to find non-compliant devices in Microsoft Intune.