List Mobile Devices

List managed mobile devices with inventory and network details

Description

Lists all Intune managed Android, iOS and iPadOS devices with their inventory: IMEI, serial number, phone number, carrier, ownership, compliance and enrollment. Optionally the last reported IP address and subnet, ICCID, eSIM identifier, cellular technology, UDID, battery health and Shared iPad state are added. That shows in which networks the devices were last active. The list can be limited by platform, a device group or a group of the primary users. The report can be sent by email or provided as a download link.

Common use cases

• Inventory of all mobile devices including IMEI, serial number, phone number and carrier
• Identifying in which (Wi-Fi) networks mobile devices were last active, for example handheld scanners across warehouse locations
• Reviewing the compliance, supervision and encryption state of the mobile fleet
• SIM/eSIM inventory via ICCID and eSIM identifier
• Handing the full mobile inventory to asset management as an Excel workbook or CSV file

Output columns

Every run writes a Summary table (device counts per platform, non-compliant and personally owned devices and - with network details enabled - the number of devices without a reported IP address) and up to three device tables to the Output Data tab of the RealmJoin portal. The console output shows the same counts plus the breakdown by compliance state and ownership and the applied filters. The same data can also be delivered as report files by email and/or as a download link, see the section on report delivery below.

Inventory (always shown)

Column	Source and meaning
DeviceName	Device name as reported by Intune
PrimaryUser	User principal name of the primary user
OperatingSystem / OSVersion	Operating system (Android, iOS, iPadOS) and version
Manufacturer / Model	Hardware manufacturer and model
SerialNumber	Hardware serial number
IMEI	International Mobile Equipment Identity of the device
PhoneNumber	Phone number of the SIM - only present when IncludePhoneNumber is enabled, otherwise the column is omitted entirely
Carrier	Subscriber carrier of the SIM
Ownership	company or personal
Compliance	Intune compliance state
LastSync	Timestamp of the last successful Intune check-in

Security and enrollment (always shown)

Column	Source and meaning
Supervised	iOS/iPadOS supervised mode
Encrypted	Device encryption state
Jailbroken	Whether the device is jailbroken or rooted
ThreatState	Threat state reported by a Mobile Threat Defense partner (only meaningful when an MTD partner is connected)
PatchLevel	Android security patch level (empty on iOS/iPadOS)
EnrollmentType / EnrollmentProfile	How the device was enrolled and the enrollment profile used
Category	Intune device category
FreeGB / TotalGB	Free and total storage (empty when the device reports no usable storage inventory, common for Android Enterprise work profiles)
Enrolled	Enrollment date

Network and SIM (only with IncludeNetworkDetails enabled - off by default)

Column	Source and meaning
IPv4 / Subnet	Last IP address and subnet reported by the device - the closest indicator for the (Wi-Fi) network the device was last active in
WiFiMAC	Wi-Fi MAC address of the device
ICCID	Unique identification number of the SIM card
ESIM	eSIM identifier, when an eSIM is provisioned
Cellular	Cellular technology of the device
UDID	Unique device identifier (iOS/iPadOS)
BatteryHealth	Battery health percentage, where reported
Shared	Whether the device is a Shared iPad
LastSync	Timestamp of the last successful Intune check-in - tells how old the IP information is

This table is sorted by subnet, so devices group visually by the network they were last seen in.

Data freshness and limitations

All values describe the state of the last successful Intune device check-in, not necessarily the current state - always interpret them together with the LastSync column. Intune does not report the Wi-Fi SSID of a device; the last IP address and subnet are the closest network indicator. Note that the reported IP address can also stem from a cellular connection when the device last checked in over mobile data. Intune partially masks the phone number of personally owned devices regardless of the IncludePhoneNumber setting.

Performance considerations

The network/SIM details are disabled by default and should be enabled with care on large tenants or with many mobile devices: Microsoft Graph returns these values only on a single-device request, not in the device list response. The runbook always sends these requests through the Graph batch endpoint in chunks of up to 20, but the runtime still grows linearly with the number of devices - thousands of mobile devices mean correspondingly long runs and an increased risk of Graph throttling (throttled requests are retried automatically with the wait time reported by Graph). On large environments, combine IncludeNetworkDetails with the group scope filters.

Scope filtering

The scope can be limited to the members of an Entra device group (IncludeDeviceGroup) and/or to devices whose primary user is a member of a user group (IncludeUserGroup). When both filters are set, a device must match both. Transitive memberships are resolved, so members of nested groups are included.

Report delivery

Report files are only generated when the Report delivery option includes an email or a download link. With Output Data only selected, the results are read directly in the Output Data tab of the RealmJoin portal, where each table can also be exported to Excel. Email delivery and download link generation are independent and can be combined; the Report file format defaults to the Excel workbook only.

• Email: sends a summary email with the complete inventory attached as CSV and/or Excel workbook. When the CSV attachment exceeds the email size limit and CSV & XLSX is selected, the email falls back to the Excel workbook alone. When no mobile device matches, the email states that no device was found and carries no attachment.
• Download link: uploads the report file(s) to the Azure storage account configured in the RJReport.StorageAccount.* tenant settings (container list-mobile-devices by default) and prints time-limited SAS download links in the job output. Suitable when the inventory is too large for an email attachment or should be handed to asset management directly. The storage upload authenticates with the Automation account's managed identity; that identity needs the Storage Account Contributor RBAC role on the target storage account (this is an Azure RBAC assignment, not a Graph application permission).

The report files contain all columns of the tables above, including the DeviceId. The PhoneNumber and the network/SIM columns are only part of the files when the corresponding options are enabled. Non-compliant devices are highlighted in the Excel workbook. No files are created when no mobile device matches the selected platforms and filters.

Schedules that were created before the Report delivery option existed keep sending their email: a stored recipient alone still enables the email for them. When such a schedule is opened for editing, the option shows Output Data only; select the delivery again before saving, otherwise the schedule stops sending the report.

Setup regarding email sending

Sending an email report is optional and only happens when the Report delivery option includes an email; a recipient is then required. The sender address is taken from the RJReport.EmailSender tenant setting.

This runbook sends emails using the Microsoft Graph API. To send emails via Graph API, you need to configure an existing email address in the runbook customization.

See the RealmJoin Report Settings documentation for details on all available settings.

Email branding

The report email honors the optional RJReport.Branding.* tenant settings:

• Header and footer image - public HTTPS URLs, PNG/JPEG/GIF, max. 200 KB each
• Footer link - target of the footer image
• Accent and text color - 6-digit hex values, e.g. #0052cc

When these settings are not configured, the default RealmJoin graphics and colors are used. An image that cannot be downloaded or validated, or an invalid color value, never prevents the report email - the corresponding default is used instead.

Setup instructions and image requirements: Email branding.

Location

Organization → Devices → List Mobile Devices

Full Runbook name

rjgit-org_devices_list-mobile-devices

Details

Property	Value
Version	1.1.0
Required modules	RealmJoin.RunbookHelper (>= 0.8.9) Microsoft.Graph.Authentication (>= 2.39.0) Az.Accounts (>= 5.5.2)
Schedulable	no

Permissions

Application permissions

• Type: Microsoft Graph

  • DeviceManagementManagedDevices.Read.All

    • Lists Intune managed mobile devices including hardware, SIM and network details
  • Directory.Read.All (optional — feature: Group scope filtering)

    • Reads group members to resolve the optional device/user group scope filters
  • Mail.Send (optional — feature: Email report)

    • Sends the report email via Send-RjRbReportEmail when email delivery is selected
  • Organization.Read.All (optional — feature: Email report)

    • Reads /organization for the tenant name used in the report file names, the email subject and the email footer; without it the runbook falls back to 'Unknown Tenant'

Permission notes

Azure Storage Account: 'Storage Account Contributor' role for the Automation Account's managed identity on the target storage account - the upload retrieves the account keys via listKeys (only required for the download link options)

Parameters

Android

Includes Android devices.

Property	Value
Required	false
Default Value	True
Type	Boolean
Portal display name	Include Android devices?

iOS

Includes iOS and iPadOS devices.

Property	Value
Required	false
Default Value	True
Type	Boolean
Portal display name	Include iOS/iPadOS devices?

IncludeNetworkDetails

Adds IP address, subnet, ICCID, eSIM identifier, cellular technology, UDID, battery health and Shared iPad state. Needs one extra request per device, so large tenants take longer.

Property	Value
Required	false
Default Value	False
Type	Boolean
Portal display name	Include network and SIM details?

IncludePhoneNumber

Shows the phone number column. Intune masks part of the number on personally owned devices anyway.

Property	Value
Required	false
Default Value	True
Type	Boolean
Portal display name	Include phone numbers?

IncludeDeviceGroup

Only devices in this Entra ID group, nested groups included. Leave empty for all mobile devices.

Property	Value
Required	false
Default Value
Type	String
Portal display name	Limit to devices in group

IncludeUserGroup

Only devices whose primary user is in this group, nested groups included. Leave empty for all.

Property	Value
Required	false
Default Value
Type	String
Portal display name	Limit to primary users in group

EmailFrom

Sender address of the report email. Taken from the tenant setting RJReport.EmailSender.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

BrandingHeaderImageUrl

Header image of the report email (HTTPS URL, PNG/JPEG/GIF, max 200 KB). Taken from the tenant setting RJReport.Branding.HeaderImageUrl; the default RealmJoin header is used when empty.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

BrandingFooterImageUrl

Footer image of the report email (HTTPS URL, PNG/JPEG/GIF, max 200 KB). Taken from the tenant setting RJReport.Branding.FooterImageUrl; the default RealmJoin footer is used when empty.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

BrandingFooterLink

Link behind the footer image of the report email. Taken from the tenant setting RJReport.Branding.FooterLink; realmjoin.com is used when empty.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

BrandingAccentColor

Accent color of the report email as a 6-digit hex value. Taken from the tenant setting RJReport.Branding.AccentColor; the RealmJoin default is used when empty or invalid.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

BrandingTextColor

Text color of the report email as a 6-digit hex value. Taken from the tenant setting RJReport.Branding.TextColor; the RealmJoin default is used when empty or invalid.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

ReportFileFormat

Deliver the report as CSV, as an Excel workbook, or both.

Property	Value
Required	false
Default Value	XLSX only
Type	String
Portal display name	Report file format
Hidden in portal	yes (preset via runbook customization)

Portal options

Portal option	Value
CSV & XLSX	CSV & XLSX
CSV only	CSV only
XLSX only	XLSX only

CreateDownloadLink

Also upload the report and return a download link that expires after a few days.

Property	Value
Required	false
Default Value	False
Type	Boolean
Hidden in portal	yes (preset via runbook customization)

ContainerName

Storage container the report files are uploaded to. Set per runbook.

Property	Value
Required	false
Default Value	list-mobile-devices
Type	String
Hidden in portal	yes (preset via runbook customization)

ResourceGroupName

Resource group of the storage account for report uploads. Taken from the tenant setting RJReport.StorageAccount.ResourceGroup.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

StorageAccountName

Storage account for report uploads. Taken from the tenant setting RJReport.StorageAccount.StorageAccountName.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

LinkExpiryDays

Number of days a download link stays valid. Taken from the tenant setting RJReport.StorageAccount.LinkExpiryDays.

Property	Value
Required	false
Default Value	6
Type	Int32
Hidden in portal	yes (preset via runbook customization)

SendEmailReport

Send the report to the recipient email address.

Property	Value
Required	false
Default Value	False
Type	Boolean
Hidden in portal	yes (preset via runbook customization)

EmailTo

Send the report to these addresses. Separate several with commas; each recipient gets a separate email.

Property	Value
Required	false
Default Value
Type	String
Portal display name	Recipient email address(es)
Hidden in portal	yes (preset via runbook customization)

Back to Runbook Reference overview