Automate Reports and Verify Against Console Truth

Tier: Core · Workflow area: Scripting & automation · ~30 minutes

This playbook turns the monthly reporting grind — "how many licensed Visio seats are unused?", "which laptops are 60+ days behind on patches?" — into AI-drafted PowerShell against Microsoft Graph and your RMM's API, with a built-in verification step that keeps you from mailing management a number the console contradicts. (UC-29)

When to use

• Recurring reports you currently build by handlicense utilization, warranty expiry, patch compliance, stale devices. Anything you export-and-pivot monthly is a script waiting to exist.
• Numbers that leave the teamthe moment a figure goes to a manager, auditor or vendor negotiation, it needs a script (reproducible) plus a console check (defensible).
• Multi-source truthwhen the answer lives across Entra, Intune and the RMM, a script that joins them beats three browser tabs and a spreadsheet.

When NOT to use

• One-off curiositiesa question you will ask once is faster answered in the console. Script the questions that recur.
• When you cannot name the authoritative sourceif you do not know whether Intune or the RMM is truth for "last seen", the script will just automate the ambiguity. Decide the source of record first.
• Write operationsthis playbook is read-only reporting. A "report" script that AI helpfully extends with Set- or Remove- verbs has left its lane; see the scripting-safety module before running anything that mutates.

The recipe

1. 1.

   Specify the report before you prompt. Write three lines: the question, the authoritative source, and the columns. Example: "Devices not patched in 60+ days; source of record is Intune (RMM is secondary); columns: deviceName, primaryUser, OS, lastPatchDate, daysBehind."

2. 2.

   Have AI draft the Graph script with your constraints baked in.

   Copy

   Write a PowerShell script using the Microsoft Graph PowerShell SDK
   (Connect-MgGraph, least-privilege scopes only — read scopes, nothing
   admin) that reports Windows devices whose last successful patch
   install is older than 60 days.
   
   Requirements:
   - Use Get-MgDeviceManagementManagedDevice; page through ALL results,
     do not stop at the default page size
   - Output: deviceName, userPrincipalName, operatingSystem,
     complianceState, lastSyncDateTime, daysSinceSync
   - Export to CSV with a date-stamped filename
   - At the end, print a one-line summary: total devices, count over
     threshold, and the exact Graph endpoint + filter used
   Ask me clarifying questions before writing if any property you need
   is ambiguous.
   

   The last line matters: Graph property names drift between beta and v1.0, and a model that guesses silently is how lastSyncDateTime quietly becomes a proxy for "patched".

3. 3.

   Read the draft for three specific failure modes before running it: paging (any Graph call without -All or explicit @odata.nextLink handling undercounts), property mismatch (does the property the script uses actually mean what your report claims?), and scope creep (reject any script requesting *.ReadWrite.* scopes for a report).

4. 4.

   Run it and capture the summary line. Typical output:

   Copy

   Total managed Windows devices: 412
   Devices with lastSyncDateTime > 60 days: 37
   Source: GET /deviceManagement/managedDevices?$filter=operatingSystem eq 'Windows'
   Export: patch-lag-2026-08-06.csv
   

5. 5.

   Verify against console truth — every time, not just the first time. Open the Intune admin center (or your RMM dashboard), find the nearest built-in view — Reports > Device compliance, or the RMM's patch summary — and compare totals. You are checking two numbers: the population (412 managed Windows devices — does the console agree?) and the exception count (37 — is the console's stale-device count in the same neighborhood?). Small deltas usually mean timing or filter differences; write the explanation into the report footer. Large deltas mean the script is wrong — do not send.

6. 6.

   Reconcile deltas with AI, not by hand. Paste both numbers and the script back:

   Copy

   My script reports 37 devices >60 days stale; the Intune console
   compliance report shows 29 non-compliant. Here is the script: [paste].
   List the most likely causes of this delta (filter differences,
   property semantics, paging, co-managed devices, timing) and what to
   check for each. Do not just pick one — rank all plausible causes.
   

7. 7.

   Schedule it with the verification step attached. The script runs on a schedule; the console spot-check is a 90-second calendar task on report day. Add the footer line to every emitted report: "Verified against Intune console compliance view on 2026-08-06; delta of 8 explained by co-managed devices reporting via ConfigMgr." That sentence is what makes the number defensible in an audit or a license negotiation.

Make it yours

• Microsoft-first shopbuild everything on the Graph PowerShell SDK with an app registration using application permissions (read-only), certificate auth, and Azure Automation or a scheduled task on a hardened runner. License reports come from Get-MgSubscribedSku joined to user sign-in activity.
• RMM-centric shop (NinjaOne, Datto, Atera, ConnectWise)same recipe against the RMM's REST API; AI drafts the pagination and auth boilerplate well, but always paste one real (redacted) JSON response into the prompt so it maps fields from reality, not from its memory of the vendor docs.
• Mixed fleet with Jamfrun the Graph script for Windows and an AI-drafted Jamf Pro API script for macOS, then a third joining script; verify each population against its own console before trusting the join.

Quality check

• Population first, exceptions second. If the script's total device count does not match the console, nothing downstream can be trusted — reconcile the denominator before arguing about the numerator.
• Read-only scopes, enforced. The app registration or delegated consent behind reporting scripts carries only .Read. scopes. Verify in Entra, not in the script comments.
• The verification is logged, not vibes. One line per run: date, console value, script value, delta, explanation. A report you cannot show the reconciliation for is a guess with a CSV attached.
• Re-verify after any upstream changeGraph API version bumps, RMM agent updates, and co-management changes all silently shift what fields mean.