How to find unassigned profiles and apps in Microsoft Intune

Before you start

Use an account that can read Intune policies and apps. Microsoft names Read Only Operator as a role that can view existing policies and reports and can't make any changes. The tenant needs an active Intune licence. The PowerShell example requests DeviceManagementConfiguration.Read.All and DeviceManagementApps.Read.All; your organisation may require administrator consent.

Settings catalog policies and an app's isAssigned property are only in Microsoft Graph's beta, so the example uses the beta modules throughout. Microsoft supports the beta, but says it changes more often than v1.0. The lists are read live. The examples read and export and change nothing.

Option 1

Find unassigned profiles and apps with PowerShell

Install the modules once, then connect and export the objects that nothing is assigned to. The connection prompts you to sign in, so the script holds no password.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Beta.DeviceManagement,
    Microsoft.Graph.Beta.Devices.CorporateManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
$scopes = 'DeviceManagementConfiguration.Read.All', 'DeviceManagementApps.Read.All'
Connect-MgGraph -Scopes $scopes -NoWelcome
try {
    $rows = [System.Collections.Generic.List[object]]::new()
    $policies = Get-MgBetaDeviceManagementConfigurationPolicy -All
    foreach ($policy in $policies | Where-Object { -not $_.IsAssigned }) {
        $rows.Add([pscustomobject]@{ Kind = 'Settings catalog'; Name = $policy.Name
            Modified = $policy.LastModifiedDateTime })
    }
    $configs = Get-MgBetaDeviceManagementDeviceConfiguration -All -ExpandProperty Assignments
    foreach ($config in $configs | Where-Object { $_.Assignments.Count -eq 0 }) {
        $rows.Add([pscustomobject]@{ Kind = 'Configuration profile'; Name = $config.DisplayName
            Modified = $config.LastModifiedDateTime })
    }
    $apps = Get-MgBetaDeviceAppManagementMobileApp -All
    foreach ($app in $apps | Where-Object { -not $_.IsAssigned }) {
        $rows.Add([pscustomobject]@{ Kind = 'App'; Name = $app.DisplayName
            Modified = $app.LastModifiedDateTime })
    }
    if ($rows.Count -eq 0) {
        Write-Output 'Every settings catalog policy, configuration profile and app is assigned.'
    } else {
        $rows | Sort-Object Kind, Name |
            Export-Csv -Path './unassigned-intune-objects.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($rows.Count) objects are assigned to no one."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The script keeps 3 kinds: settings catalog policies, the older configuration profiles and apps. Microsoft has deprecated listing apps with their assignments expanded, so the app list reads isAssigned instead. Compliance policies, scripts, app protection policies and enrolment profiles are separate lists that this example leaves out. Modified helps you tell an abandoned object from one still being built: open it before you remove anything.

Option 2

Check assignments in the admin centre

1. Sign in to the Microsoft Intune admin centre for the correct tenant.
2. Go to Apps > All apps. The list shows whether each app is assigned.
3. Select an app to open its overview. Under Essentials, Assigned says Yes or No.
4. For profiles, go to Devices > Manage devices > Configuration, select the Policies tab and select a policy.
5. Read Assignments on the policy's page for the users and groups it reaches. Leave the page without editing it.

This suits checking a few apps and profiles. Checking every profile this way means opening each one, so for a whole tenant, export the list with PowerShell or a report.

Common questions

Does a profile assigned to an empty group count as assigned?

Yes. An app's isAssigned means it is assigned to at least 1 group, whether or not the group has members, and a profile with any assignment has a non-empty list. To find objects that reach no one in practice, compare the groups they're assigned to with their members.

Why does a profile I just unassigned still apply?

Microsoft says a policy stays assigned and in effect on a device until that device next syncs with Intune, so the change can take a while to show. A sync from the device, or a remote sync from the admin centre, brings it forward.

Why does an assigned profile never reach a device?

The device has to check in with Intune to receive it. A device that hasn't synced for weeks gets nothing new; to find those, see how to find stale devices in Microsoft Intune.