Device Encryption & TPM / Secure Boot Posture

The question it answers: Which managed devices are unencrypted, and which Windows devices lack TPM 2.0 or Secure Boot?

Which managed devices hold company data unencrypted, and which Windows devices lack the hardware roots of trust (TPM 2.0, Secure Boot) that BitLocker, Windows Hello and Windows 11 depend on.

Note

TPM and Secure Boot are only returned per device, so they come from an on-demand scan (one Graph call per Windows device). Secure Boot comes from Device Health Attestation and is blank on devices that never reported it.

At a glance

Where in the app	Intune › Encryption & TPM Posture
Workload	Intune
Kind	Table · dashboard tile
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Intune.
Report id (API and MCP)	intune.devices.encryption-posture
Tabs on its page	TPM / Secure Boot Hardware Scan

Columns

Column	Key	Type
Device	DeviceName	Link
User	UserPrincipalName	Text
Posture	Posture	Status
Platform	OsFamily	Text
Encrypted	IsEncrypted	YesNo
TPM	TpmVersion	Text
Secure Boot	SecureBoot	Text
Ownership	OwnerType	Text
Compliance	ComplianceState	Text
Last sync	LastSyncDateTime	Date

Filters

Filter	Key (API)	On when the page opens
Only devices with a problem	problems	Yes

What it needs

Licence: Microsoft Intune.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
DeviceManagementManagedDevices.Read.All	Microsoft Graph	Read Microsoft Intune devices

Data sources it reads

• GET /beta/deviceManagement/managedDevices
• GET /beta/deviceManagement/managedDevices/{id}?$select=hardwareInformation,deviceHealthAttestationState (hardware scan)

Through the API and MCP

GET /ir-api/v1/reports/intune.devices.encryption-posture?size=100
GET /ir-api/v1/reports/intune.devices.encryption-posture?filter=problems

An AI assistant reads it with the MCP tool get_report and the id intune.devices.encryption-posture. The client needs the Read grant for Intune. See Using the API.