Check Device Compliance
Check the compliance status of a device
Description
This runbook retrieves the compliance status of a managed device from Microsoft Intune. In simple mode it shows the overall compliance state and lists any non-compliant policies. In detailed mode it additionally shows which specific settings are failing and the reason for each failure. Optionally, a report with the full compliance details can be sent via email.
Setup regarding email sending
Sending an email report is optional and only happens when a recipient (EmailTo) is provided. The sender address is taken from the RJReport.EmailSender tenant setting.
This runbook sends emails using the Microsoft Graph API. To send emails via Graph API, you need to configure an existing email address in the runbook customization.
See the RealmJoin Report Settings documentation for details on all available settings.
Email branding
The report email honors the optional RJReport.Branding.* tenant settings:
Header and footer image – public HTTPS URLs, PNG/JPEG/GIF, max. 200 KB each
Footer link – target of the footer image
Accent and text color – 6-digit hex values, e.g.
#0052cc
When these settings are not configured, the default RealmJoin graphics and colors are used. An image that cannot be downloaded or validated, or an invalid color value, never prevents the report email – the corresponding default is used instead.
Setup instructions and image requirements: Email branding.
Location
Device → General → Check Device Compliance
Full Runbook name
rjgit-device_general_check-device-compliance
Details
Version
1.2.0
Required modules
RealmJoin.RunbookHelper (>= 0.8.9) Microsoft.Graph.Authentication (>= 2.39.0)
Schedulable
no
Permissions
Application permissions
Type: Microsoft Graph
DeviceManagementManagedDevices.Read.All
Reads the managed device, its compliance policy states and per-policy setting states
Organization.Read.All
Reads /organization for the tenant display name shown in the compliance report
Mail.Send (optional — feature: Email report)
Sends the compliance report email via Send-RjReportEmail when EmailTo is configured
Parameters
DeviceId
The Entra ID device ID of the target device. Passed automatically by the RealmJoin platform.
Required
true
Default Value
Type
String
Hidden in portal
yes (preset via runbook customization)
DetailedOutput
Select "Simple" (final value: $false) to show only the overall compliance state and non-compliant policy names. Select "Detailed" (final value: $true) to additionally show which specific settings are failing and the reason for each failure.
Required
false
Default Value
False
Type
Boolean
Portal display name
Output Mode
Portal options
Simple - show overall compliance state and non-compliant policies
false
Detailed - show failing settings and reasons per policy
true
EmailTo
Optional - if specified, a compliance report will be sent to the provided email address(es). Can be a single address or multiple comma-separated addresses.
Required
false
Default Value
Type
String
Portal display name
Recipient Email Address(es) (optional)
EmailFrom
The sender email address. This needs to be configured in the runbook customization.
Required
false
Default Value
Type
String
Hidden in portal
yes (preset via runbook customization)
BrandingHeaderImageUrl
Optional public HTTPS URL of a custom header image (PNG/JPEG/GIF, max. 200 KB) for the report email. Sourced from the RJReport.Branding.HeaderImageUrl tenant setting. When empty, the default RealmJoin header graphic is used.
Required
false
Default Value
Type
String
Hidden in portal
yes (preset via runbook customization)
BrandingFooterImageUrl
Optional public HTTPS URL of a custom footer image (PNG/JPEG/GIF, max. 200 KB) for the report email. Sourced from the RJReport.Branding.FooterImageUrl tenant setting. When empty, the default RealmJoin footer graphic is used.
Required
false
Default Value
Type
String
Hidden in portal
yes (preset via runbook customization)
BrandingFooterLink
Optional URL the footer image links to. Sourced from the RJReport.Branding.FooterLink tenant setting. When empty, the default link (https://www.realmjoin.com) is used.
Required
false
Default Value
Type
String
Hidden in portal
yes (preset via runbook customization)
BrandingAccentColor
Optional accent color override (6-digit hex, e.g. '#0052cc') for the report email template. Sourced from the RJReport.Branding.AccentColor tenant setting. When empty or invalid, the default RealmJoin accent color is used.
Required
false
Default Value
Type
String
Hidden in portal
yes (preset via runbook customization)
BrandingTextColor
Optional text color override (6-digit hex) for the report email template. Sourced from the RJReport.Branding.TextColor tenant setting. When empty or invalid, the default RealmJoin text color is used.
Required
false
Default Value
Type
String
Hidden in portal
yes (preset via runbook customization)
Last updated
Was this helpful?