Intune Licence Compliance

The question it answers: Which users have devices enrolled in Intune but hold no Intune licence?

Users with devices enrolled in Intune who hold no Intune service plan. Intune keeps managing those devices, but the tenant is out of licence compliance - and the gap usually means a licence was removed from a leaver or a group-based assignment failed.

Note

Any INTUNE_* service plan counts except INTUNE_O365 (Basic Mobility and Security). Disabled plans on a user’s licence are respected.

At a glance

Where in the app	Licensing › Intune Licence Compliance
Workload	Licensing
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Intune.
Report id (API and MCP)	entra.licensing.intune-licence-compliance

Columns

Column	Key	Type
User	DisplayName	Link
UPN	UserPrincipalName	Text
Devices	UsedBecause	Text
Enabled	AccountEnabled	YesNo
Current licences	AssignedLicences	Text

Filters

Filter	Key (API)	On when the page opens
Enabled accounts only	enabled	No

What it needs

Licence: Microsoft Intune.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
User.Read.All	Microsoft Graph	Read all users’ full profiles
User-LifeCycleInfo.Read.All	Microsoft Graph	Read all users’ lifecycle information
DeviceManagementManagedDevices.Read.All	Microsoft Graph	Read Microsoft Intune devices
Organization.Read.All	Microsoft Graph	Read organization information

Data sources it reads

• GET /v1.0/users (assignedLicenses)
• GET /beta/deviceManagement/managedDevices
• GET /v1.0/subscribedSkus

Through the API and MCP

GET /ir-api/v1/reports/entra.licensing.intune-licence-compliance?size=100
GET /ir-api/v1/reports/entra.licensing.intune-licence-compliance?filter=enabled

An AI assistant reads it with the MCP tool get_report and the id entra.licensing.intune-licence-compliance. The client needs the Read grant for Licensing. See Using the API.