TPM / Secure Boot Hardware Scan

The question it answers: Which TPM version and Secure Boot state does each managed Windows device report?

TPM and Secure Boot are only returned per device. Run the scan here; the Devices tab then shows them for every Windows device.

Note

TPM and Secure Boot are only returned per device, so they come from an on-demand scan (one Graph call per Windows device). Secure Boot comes from Device Health Attestation and is blank on devices that never reported it.

At a glance

Where in the app	Intune › Encryption & TPM Posture
Shown as	a tab of Device Encryption & TPM / Secure Boot Posture
Workload	Intune
Kind	Table
Data	A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan.
Licence	Microsoft Intune.
Report id (API and MCP)	intune.devices.hardware-security-scan

Columns

Column	Key	Type
Device	DeviceName	Link
User	UserPrincipalName	Text
TPM	TpmVersion	Text
Secure Boot	SecureBoot	Text

What it needs

Licence: Microsoft Intune.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
DeviceManagementManagedDevices.Read.All	Microsoft Graph	Read Microsoft Intune devices

Data sources it reads

• GET /beta/deviceManagement/managedDevices
• GET /beta/deviceManagement/managedDevices/{id}?$select=hardwareInformation,deviceHealthAttestationState (one call per Windows device)

Through the API and MCP

GET /ir-api/v1/reports/intune.devices.hardware-security-scan?size=100
POST /ir-api/v1/reports/intune.devices.hardware-security-scan/scan

An AI assistant reads it with the MCP tool get_report and the id intune.devices.hardware-security-scan. The client needs the Run scan grant for Intune. See Using the API.