PowerShell: Intune – Force Compliance Re-Evaluation Fleet-Wide

.\Invoke-FleetComplianceResync.ps1 -WhatIf

.\Invoke-FleetComplianceResync.ps1 -DeviceNamePattern "LAPTOP-*" -OnlyNonCompliant -ThrottleMs 750

Fetching managed devices (OS: Windows, name pattern: LAPTOP-*)...
214 device(s) matched, 37 after the compliance filter.
Sync requested for 37 device(s), 1 failed. Report: .\fleet-sync-report-20251022-090512.csv

Import-Csv .\fleet-sync-report-20251022-090512.csv | Where-Object { $_.Status -eq "Failed" } | Format-Table DeviceName, Error

$before = Import-Csv .\fleet-sync-report-20251022-090512.csv | Where-Object { $_.Status -eq "Synced" }
foreach ($row in $before) {
    $now = Get-MgDeviceManagementManagedDevice -ManagedDeviceId $row.DeviceId -Property "deviceName,lastSyncDateTime,complianceState"
    [PSCustomObject]@{
        DeviceName      = $now.DeviceName
        SyncedBefore    = $row.LastSyncDateTime
        SyncedNow       = $now.LastSyncDateTime
        ComplianceState = $now.ComplianceState
    }
}

<#
.SYNOPSIS
    Sends the Intune syncDevice action to every matching managed device so
    compliance and configuration policy are re-evaluated immediately.
.DESCRIPTION
    Connects to Microsoft Graph, lists managed devices that match the operating
    system and device name filters (optionally only those not compliant), and
    calls Sync-MgDeviceManagementManagedDevice (the v1.0 syncDevice action) on
    each one. The sync makes the device check in with Intune now instead of at
    its next scheduled check-in. Calls are spaced by -ThrottleMs, a throttled
    call (HTTP 429) is retried once after a back-off, and the result of each
    call is written to a CSV report. Supports -WhatIf.
.PARAMETER OperatingSystem
    Managed device operatingSystem value to target. Defaults to Windows.
.PARAMETER DeviceNamePattern
    Wildcard pattern matched against the device name. Defaults to * (every device).
.PARAMETER OnlyNonCompliant
    Skips devices whose complianceState is already compliant.
.PARAMETER ThrottleMs
    Delay in milliseconds between sync calls. Defaults to 500.
.PARAMETER ReportPath
    Path to the CSV report written after the run.
.EXAMPLE
    .\Invoke-FleetComplianceResync.ps1 -WhatIf
.EXAMPLE
    .\Invoke-FleetComplianceResync.ps1 -DeviceNamePattern "LAPTOP-*" -OnlyNonCompliant -ThrottleMs 750
.NOTES
    Author  : Thomas Lasswell (https://www.techcolumnist.com)
    Version : 1.0 (2025-10-22)
    Requires: Microsoft.Graph.Authentication, Microsoft.Graph.DeviceManagement;
              DeviceManagementManagedDevices.Read.All and
              DeviceManagementManagedDevices.PrivilegedOperations.All.
.LINK
    https://learn.microsoft.com/en-us/graph/api/intune-devices-manageddevice-syncdevice?view=graph-rest-1.0
#>

[CmdletBinding(SupportsShouldProcess = $true)]
param (
    [Parameter()]
    [string]$OperatingSystem = "Windows",

    [Parameter()]
    [string]$DeviceNamePattern = "*",

    [Parameter()]
    [switch]$OnlyNonCompliant,

    [Parameter()]
    [int]$ThrottleMs = 500,

    [Parameter()]
    [string]$ReportPath = ".\fleet-sync-report-$(Get-Date -Format 'yyyyMMdd-HHmmss').csv"
)

Import-Module Microsoft.Graph.Authentication
Import-Module Microsoft.Graph.DeviceManagement

Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All", "DeviceManagementManagedDevices.PrivilegedOperations.All" -NoWelcome

Write-Host "Fetching managed devices (OS: $OperatingSystem, name pattern: $DeviceNamePattern)..."

$escapedOs = $OperatingSystem.Replace("'", "''")
$devices = @(Get-MgDeviceManagementManagedDevice -All -Filter "operatingSystem eq '$escapedOs'" -Property "id,deviceName,complianceState,lastSyncDateTime,operatingSystem" |
    Where-Object { $_.DeviceName -like $DeviceNamePattern })
$matchedCount = $devices.Count

if ($OnlyNonCompliant) {
    $devices = @($devices | Where-Object { $_.ComplianceState -ne "compliant" })
}

Write-Host "$matchedCount device(s) matched, $($devices.Count) after the compliance filter."

$results = foreach ($device in $devices) {
    $status = "Skipped"
    $errorMessage = $null

    if ($PSCmdlet.ShouldProcess($device.DeviceName, "Sync-MgDeviceManagementManagedDevice")) {
        $attempt = 0
        while ($status -ne "Synced" -and $attempt -lt 2) {
            $attempt++
            try {
                Sync-MgDeviceManagementManagedDevice -ManagedDeviceId $device.Id -ErrorAction Stop
                $status = "Synced"
                $errorMessage = $null
            } catch {
                $status = "Failed"
                $errorMessage = $_.Exception.Message
                if ($errorMessage -match "TooManyRequests|429" -and $attempt -lt 2) {
                    # Back off once when Graph throttles the call, then retry.
                    Start-Sleep -Seconds 30
                } else {
                    break
                }
            }
        }

        Start-Sleep -Milliseconds $ThrottleMs
    }

    [PSCustomObject]@{
        DeviceName       = $device.DeviceName
        DeviceId         = $device.Id
        ComplianceState  = $device.ComplianceState
        LastSyncDateTime = $device.LastSyncDateTime
        Status           = $status
        Error            = $errorMessage
    }
}

$results | Export-Csv -Path $ReportPath -NoTypeInformation -Encoding utf8

$failed = @($results | Where-Object { $_.Status -eq "Failed" })
Write-Host "Sync requested for $(@($results).Count) device(s), $($failed.Count) failed. Report: $ReportPath"