You have deployed the PRT detection script via Intune Proactive Remediation. Devices are running it. Now you want to know: how many devices in my fleet actually have a valid PRT right now? Which ones are broken? Who are the affected users? This post shows you how to pull that data out of Intune in under five minutes using Graph Explorer — no PowerShell, no app registration, no code. One query, one export, one Excel file.
Why Graph Explorer for This
Intune's built-in Proactive Remediation report in the admin centre shows you device status — compliant, non-compliant, error — but it buries the actual script output. You cannot easily see which specific check failed, what the PRT expiry date was, or whether the NGC key was set. The raw detection output is stored in Graph and is fully queryable. Graph Explorer lets you pull it directly without writing any code or registering an application.
The detection script we use writes one structured line per device in this format:
FAIL|AzureAdJoined=YES|DomainJoined=YES|PRT=MISSING|NGC=NO|Tenant=Contoso|LastUpdate=
Every field is pipe-delimited, which means once you export from Graph Explorer you can split it into clean columns in Excel in about 30 seconds.
Step 1 - Open Graph Explorer and Sign In
Go to developer.microsoft.com/graph/graph-explorer and sign in with your work account. Use an account that has at least the Intune Administrator or Global Reader role.
The first time you run these queries Graph Explorer will ask you to consent to the required permission. Click Modify permissions in the left panel and ensure this permission is consented:
| Permission | Type | Why needed |
|---|---|---|
| DeviceManagementScripts.Read.All | Delegated | Read Proactive Remediation scripts and device run states |
Step 2 - Find Your Proactive Remediation Script ID
Run this query to list all your Proactive Remediation scripts and find the ID of your PRT detection policy:
The response lists every script with its id, displayName, and lastModifiedDateTime. Look for your PRT Health Check policy and copy the id GUID.
Step 3 - Pull All Device Run States
Replace {id} with the GUID you copied and run this query:
Each item in the value array represents one device. The fields you care about:
| Field | What it contains |
|---|---|
| managedDevice/deviceName | Hostname |
| managedDevice/userPrincipalName | Primary user UPN assigned in Intune |
| detectionState | success (exit 0) or fail (exit 1) |
| preRemediationDetectionScriptOutput | The full PASS/FAIL pipe-delimited line your script wrote |
| remediationState | remediationNotRequired / remediationSucceeded / remediationFailed |
| lastStateUpdateDateTime | When the script last ran on this device |
Step 4 - Export and Open in Excel
In Graph Explorer, click the Download button above the response panel to save the full JSON to your Downloads folder.
Open Excel and import the JSON:
- Go to Data - Get Data - From File - From JSON
- Select the downloaded JSON file
- In Power Query, click the value list to expand it
- Click Into Table, then expand the columns you want
- Expand managedDevice to get deviceName and userPrincipalName
- Click Close and Load
You now have a flat table with one row per device. Split the preRemediationDetectionScriptOutput column into columns:
- Select the
preRemediationDetectionScriptOutputcolumn - Data - Text to Columns - Delimited - Pipe (|)
- This splits it into: Status, AzureAdJoined, DomainJoined, PRT, NGC, Tenant, Expiry
lastStateUpdateDateTime descending to put the most recently checked devices at the top.
Reading the Results
| detectionState | remediationState | Script output | What it means | Action |
|---|---|---|---|---|
| success | remediationNotRequired | PASS | PRT valid, all checks passed | None |
| fail | remediationSucceeded | FAIL | PRT was missing - remediation fixed it | Monitor next run |
| fail | remediationFailed | FAIL | PRT missing and could not be recovered | Manual fix - sign out/in or re-join |
| error | - | ERROR | Script failed to run | Check device is online with active user session |
Devices showing remediationFailed are your priority list. The automatic fix did not work. Common reasons: a stale Hybrid AAD join where the device registration in Entra ID has expired, or a UPN change where the cached credential no longer matches the account. Both require the user to sign out and back in, and in some cases the Hybrid AAD join scheduled task needs to re-run.
Quick Reference - The Two Graph Queries
GET https://graph.microsoft.com/beta/deviceManagement/deviceHealthScripts
# Step 2 - pull all device results (replace {id} with your script GUID)
GET https://graph.microsoft.com/beta/deviceManagement/deviceHealthScripts/{id}/deviceRunStates?$expand=managedDevice