Devices Still Assigned to Leavers
The question it answers: Which managed devices belong to a user who is disabled, deleted or past their leave date?
Company hardware whose primary user has been disabled, deleted or is past their leave date. These are the devices to collect, wipe and re-issue - and until then they may still hold company data and a valid Intune enrollment.
At a glance
Section titled “At a glance”| Where in the app | Intune › Service & Operations › Devices of Leavers |
| Workload | Intune |
| Kind | Table |
| Data | Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once. |
| Licence | Microsoft Intune. |
| Report id (API and MCP) | intune.service.leaver-devices |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Device | DeviceName | Link |
| User | UserPrincipalName | Text |
| Status | Category | Status |
| Reason | Finding | Text |
| Ownership | OwnerType | Text |
| Serial | Value | Text |
| Model | Model | Text |
| Last sync | LastSyncDateTime | Date |
What it needs
Section titled “What it needs”Licence: Microsoft Intune.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
DeviceManagementManagedDevices.Read.All | Microsoft Graph | Read Microsoft Intune devices | |
User.Read.All | Microsoft Graph | Read all users’ full profiles | |
User-LifeCycleInfo.Read.All | Microsoft Graph | Read all users’ lifecycle information |
Data sources it reads
GET /beta/deviceManagement/managedDevicesGET /v1.0/users
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/intune.service.leaver-devices?size=100An AI assistant reads it with the MCP tool get_report and the id intune.service.leaver-devices. The client needs the Read grant for Intune. See Using the API.