How to List All Devices in Microsoft 365

Correlating device last sign-in activity with compliance status involves comparing the most recent access to Microsoft 365 services with the device’s current compliance state (e.g., compliant, noncompliant, or unknown). 

This helps admins identify users accessing Microsoft 365 from non-compliant devices and access device activity and security posture. They can take action to reduce risk, clean up inactive licenses, and enforce Zero Trust policies.

Correlate device last sign-in activity with compliance status using Entra admin center

• Log in to the Microsoft Entra admin center.
• Navigate to Entra ID»Devices»All devices.
• Now, you can check the compliance status & last sign-in activity of every user's device along with the details like join type, owner, MDM, security settings management and more.

Correlate user device sign-in activity with compliance using PowerShell

Connect to the Microsoft Graph PowerShell module with required permissions and run the script below.

$devices = Get-MgDeviceManagementManagedDevice -All
$signIns = Get-MgAuditLogSignIn -All | Where-Object { $_.DeviceDetail.DeviceId }
$latest = $signIns | Sort-Object CreatedDateTime -Descending | Group-Object { $_.DeviceDetail.DeviceId } | ForEach-Object { $_.Group[0] }
$report = foreach ($s in $latest) { $d = $devices | Where-Object { $_.AzureADDeviceId -eq $s.DeviceDetail.DeviceId }
 [PSCustomObject]@{ DeviceName = $s.DeviceDetail.DisplayName 
   LastSignIn = $s.CreatedDateTime
   User       = $s.UserPrincipalName
   Compliance = if ($d) { $d.ComplianceState } else { "Unknown" } }} 
$report | Format-Table -AutoSize

This script obtains device name, user name and device’s last sign-in activity with compliance details. It helps you spot risky devices, compliant devices, etc. Also identify who used which device, when, and whether it met your organization’s security standards.

AdminDroid reports unify device compliance, user details, and sign-in activities into a single view that eliminates the need to manually correlate data from multiple sources. This saves time, reduces errors, and provides actionable insights without complex scripting.

• AdminDroid’s compliant devices report allows you to easily map user login activity with the compliance status of their devices.
• With advanced filters, you can quickly spot high-risk scenarios like users signing in from non-compliant or personal devices.
• You can also use advanced customization to group compliant devices by last sign-in date and spot recent activity easily.

Imagine a scenario where an employee steps away from their workstation to attend a quick discussion and unintentionally leaves their laptop unlocked in a shared space. During this time, the unattended device could be unintentionally accessed, potentially exposing confidential client data or internal systems. Automatically locking the device after a few minutes of inactivity ensures the session is secured. This helps to protect sensitive information even when users forget to manually lock their screen.

Auto-lock devices by setting-up device configurations in Intune admin center

Configure auto-lock device settings using PowerShell

Using the Intune portal, an admin would need to manually create and assign this policy for each group or tenant. With PowerShell, the same policy can be scripted, reused, and applied across hundreds of devices or multiple tenants in seconds. So, here is how to configure auto-lock device property using PowerShell.

Connect to the Microsoft Graph PowerShell module with required permissions and run the below script to configure auto-lock device settings.

$windowsConfig = @{ "@odata.type" = "#microsoft.graph.windows10GeneralConfiguration"
  displayName = "<displayname>"
  inactivityTimeoutInSeconds = 300
  requirePasswordWhenResumeFromIdle = $true }
$windowsPolicy = Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations" -Body ($windowsConfig | ConvertTo-Json -Depth 3) -ContentType "application/json"
$assignment = @{ target = @{  "@odata.type" = "#microsoft.graph.groupAssignmentTarget"
    groupId = "<groupId>" }}
Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations/$($windowsPolicy.id)/assignments" -Body ($assignment | ConvertTo-Json -Depth 3) -ContentType "application/json"

Note: During execution, you must assign a group ID to configure the rule. Get group ID by using Get- MgGroup. Replace <displayName> and <groupID> with a suitable policy name and specific group ID. Set “inactivityTimeoutInSeconds” with any desired duration for inactivity locking (i.e., 300=5 minutes). 

Jailbroken or rooted devices are mobile devices that have been modified to bypass the built-in security controls of their operating systems like iOS or Android. Blocking these devices is important because they can compromise the security of your organization by exposing sensitive apps and data to high risk.

Restrict rooted devices using device compliance policies via Intune

You can block such devices using Intune compliance policies or Conditional Access rules to ensure that only trusted devices can access your Microsoft 365 organization.

• Open Compliance page and select “Create policy”.
• Select the Platform as ‘Android (AOSP)’ or ‘iOS/iPadOS’ and click Create.
• In the Basics tab, provide a relevant name and description, then proceed by clicking Next.
• Navigate to the Compliance settings»Device Health and set “Jailbroken (iOS) or Rooted (Android)” devices toggle to ‘Block’.
• Specify if any other required settings like ‘Actions for non-compliance’ and ‘Assignments’ are needed, and complete the process by creating the policy.

Tip: Blocking jailbroken or rooted devices protects your organization from major security breaches and unauthorized access. It’s one of the Microsoft recommended practices which increases the secure score for devices.

Block rooted or jailbroken devices using PowerShell

Using Microsoft Graph PowerShell, you can block rooted devices in Microsoft 365 by creating a compliance policy with the appropriate settings.

Use the PowerShell cmdlet below to define the policy and set the rule to block jailbroken or rooted devices.

Connect-MgGraph -Scopes DeviceManagementConfiguration.ReadWrite.All
$androidPolicy = @{ "@odata.type" = "#microsoft.graph.androidCompliancePolicy"
displayName = "<Android Block Rooted Devices>"
securityThreatProtectionRequired = $true
deviceThreatProtectionEnabled = $true
deviceThreatProtectionRequiredSecurityLevel = "secured"
rootedDeviceBlocked = $true 
scheduledActionsForRule = @( @{ ruleName = "BlockRooted"
scheduledActionConfigurations = @( @{ actionType = "block"
gracePeriodHours = 0 } ) } ) }
New-MgDeviceManagementDeviceCompliancePolicy -BodyParameter $androidPolicy

Unmanaged devices are devices that are not enrolled in your organization’s management system, such as Microsoft Intune or another MDM (Mobile Device Management) solution. These devices may have access to organizational resources, but they operate outside admin control. On the other hand, non-compliant devices are the ones that fail to meet security requirements like encryption or antivirus required by the organization.

To make sure that only safe and reliable devices can access the data of your company, it's crucial to block unmanaged and non-compliant devices from using Microsoft 365. By blocking these, you can reduce the risk of data leaks, malware, and unauthorized access.

Configure CA policy to block non-compliant devices using Entra admin center