Intune Assignment Hygiene
The question it answers: Which Intune profiles and apps apply to nobody because they are unassigned, target empty or deleted groups, or are only excluded?
Over time Intune fills up with profiles and apps that apply to nobody: never assigned, assigned only to deleted or empty groups, or only excluded. They look deployed in reviews and clutter troubleshooting. Objects assigned to All users and All devices at the same time can apply twice and conflict.
At a glance
Section titled “At a glance”| Where in the app | Intune › Device Operations & Hardening › Assignment Hygiene |
| Workload | Intune |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | Microsoft Intune. |
| Report id (API and MCP) | intune.operations.assignment-hygiene |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Object type | Category | Text |
| Name | Subject | Link |
| Check | Setting | Text |
| Assignments | Value | Text |
| Finding | Finding | Text |
| Dead / empty groups | Detail | Text |
| Date | When | Date |
| Count | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: Microsoft Intune.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
DeviceManagementConfiguration.Read.All | Microsoft Graph | Read Microsoft Intune device configuration and policies | |
DeviceManagementApps.Read.All | Microsoft Graph | Read Microsoft Intune apps | |
Group.Read.All | Microsoft Graph | Read all groups |
Data sources it reads
GET /v1.0/deviceManagement/deviceConfigurations|deviceCompliancePolicies?$expand=assignmentsGET /beta/deviceManagement/configurationPolicies?$expand=assignmentsGET /v1.0/deviceAppManagement/mobileApps?$expand=assignmentsGET /beta/deviceManagement/deviceManagementScripts|deviceHealthScripts?$expand=assignmentsGET /v1.0/groups/{id} ($batch)
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/intune.operations.assignment-hygiene?size=100An AI assistant reads it with the MCP tool get_report and the id intune.operations.assignment-hygiene. The client needs the Read grant for Intune. See Using the API.