Intune Reporting, Workbooks & Data Export

The four report types

Simple explanation

Intune has four flavours of report, and they differ by how fresh the data is and how much of it you get.

One is for “what is broken right now”, one is for “what does the whole estate look like”, one is for “how has this changed over months”, and one is for “give me the raw data so I can build my own thing”.

Report type	Answers	Data characteristics
Operational	”What needs my attention right now?”	Timely, targeted, record-level, drill-down, filterable
Organizational	”What does the whole estate look like?”	Broad summary across the tenant
Historical	”How has this trended?”	Aggregated over time, pattern and trend analysis
Specialist	”Give me the raw data”	Raw datasets built for export and custom reporting

Exam tip: pick the report type from the verb

The question rarely names the report type — it describes a need:

“identify the devices that failed enrolment today” → Operational
“give leadership a summary of the whole fleet” → Organizational
“show whether compliance has improved over six months” → Historical
“feed our own Power BI model with raw records” → Specialist

If the requirement mentions another tool consuming the data, you are being pointed at export, not at the portal.

Where reports live

Reports appear in two places, and both are examinable:

Reports node — the central reporting hub, organised by area (device compliance, app install status, endpoint analytics, and so on)
In context — inside the object you are looking at. A configuration profile has its own per-setting and per-device status, and that is usually the fastest path when troubleshooting a single policy.

If a question describes an admin troubleshooting one profile on one device, the in-context report on that profile beats navigating to the Reports node.

Filtering and customising

Most reports support column selection and filtering before you generate them, which matters for two reasons: readability, and export size. Generating a filtered report is significantly cheaper than exporting everything and filtering afterwards.

Scope tags are not a report filter

A recurring trap: an admin “cannot see” devices in a report.

Before blaming the report, check role-based access control and scope tags. Intune reports honour RBAC — an administrator scoped to one region sees only that region’s objects. The report is not broken; the scope is doing its job.

Distinguish clearly:

Filters (in the Assignments sense) target who a policy applies to
Scope tags control which objects an admin can see and manage
Report filters just narrow what is displayed

A question that says “the report is empty for one administrator but populated for another” is almost always a scope tag question.

Workbooks and dashboards

For anything beyond the built-in reports, Intune data can be routed to Azure Monitor, where workbooks provide customisable, visual, shareable reporting.

Built-in reports vs Azure Monitor workbooks
Feature	Built-in Intune reports	Azure Monitor workbooks
Setup	None — available immediately	Requires routing Intune diagnostic data to a Log Analytics workspace
Customisation	Column and filter selection	Full query-based visualisation and layout control
Cost	Included	Azure Monitor / Log Analytics ingestion and retention costs apply
Retention	Service-defined	Controlled by the workspace retention settings
Best for	Day-to-day operations	Long-term trends, cross-source correlation, executive dashboards

The exam signal for workbooks is long retention or combining Intune data with other sources. If a scenario needs two years of history, built-in reports are the wrong answer.

Getting the data out

Three routes, and the right one depends on volume and repeatability.

Route	Good for	Limitation
Export button in the portal	One-off, human-sized extracts	Manual; not repeatable
Graph export jobs (`deviceManagement/reports/exportJobs`)	Scheduled, automated extraction	Asynchronous — you must poll
Data warehouse / OData feed	BI tools consuming historical data	Aggregated, not near-real-time

The export job pattern

Graph report export is asynchronous, and this is the detail exams like:

Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"

# 1. Request the export job
$job = Invoke-MgGraphRequest -Method POST `
  -Uri "https://graph.microsoft.com/beta/deviceManagement/reports/exportJobs" `
  -Body (@{ reportName = 'Devices'; format = 'csv' } | ConvertTo-Json)

# 2. Poll until status is 'completed', then download from the returned URL

You do not get the file back from the first call. You submit a job, poll its status, and then download from the URL the service returns once it is complete. An answer option claiming the POST returns the CSV directly is wrong.

Question

Which Intune report type provides raw data intended for custom reporting?