Report Windows Devices Without Autopilot Scheduled
Reports all Windows Entra devices that have no associated Windows Autopilot object.
This is a scheduled runbook. It is designed to run on a recurring schedule rather than being triggered for a single object. See Scheduling for details on how to configure runbook schedules.
Description
This runbook lists every Windows device object in Entra ID (Microsoft Entra) and matches it against the Windows Autopilot device identities in Intune. Entra devices whose device ID is not referenced by any Autopilot object (via the Autopilot object's azureActiveDirectoryDeviceId) are reported as orphans.
Such orphaned Entra device objects are typical leftovers ("Objektleichen") from devices that were reset, re-imaged, or replaced without being cleaned up. The report supports clean-up efforts by making these candidates visible so they can be reviewed and - if appropriate - deleted.
Optionally, the report files can be uploaded to an Azure Storage Account (returning time-limited download links) and/or sent via email with the selected report file format(s) attached. The ReportFileFormat parameter controls which file formats are generated and delivered (CSV only, CSV & XLSX, or XLSX only). When the CSV attachment exceeds the email size limit and "CSV & XLSX" is selected, the email falls back to the Excel workbook alone.
Reporting orphaned Windows devices
This runbook lists every Windows device object in Entra ID and matches it against the Windows Autopilot device identities in Intune. Devices that have no associated Autopilot object (matched via the Autopilot object's azureActiveDirectoryDeviceId) are reported as clean-up candidates ("Objektleichen").
Two Yes/No toggles control the output:
Send the report via email? — when enabled, the recipient address field (
EmailTo) is shown and the report is sent via email with the CSV attached.Create a file download link? — when enabled, the CSV is uploaded to an Azure Storage Account and a time-limited download link is returned.
Both can be combined or used independently. If both are disabled, the report is only printed to the runbook output.
Setup regarding the storage account
The CSV report is uploaded to an Azure Storage Account. The target storage account is taken from the shared RJReport tenant settings, so it can be configured once and reused across all report runbooks:
RJReport.StorageAccount.ResourceGroupRJReport.StorageAccount.StorageAccountNameRJReport.StorageAccount.LinkExpiryDays(optional, defaults to 6)
The container name is configured per runbook (parameter ContainerName, default windows-devices-without-autopilot) and is intentionally not part of the global RJReport settings.
See the RealmJoin Report Settings documentation for details.
The runbook's managed identity needs at least Contributor access on the subscription or resource group containing the storage account.
Setup regarding email sending
Sending an email report is optional and only happens when a recipient (EmailTo) is provided. The sender address is taken from the RJReport.EmailSender tenant setting.
This runbook sends emails using the Microsoft Graph API. To send emails via Graph API, you need to configure an existing email address in the runbook customization.
See the RealmJoin Report Settings documentation for details.
Location
Organization → Devices → Report Windows Devices Without Autopilot (Scheduled)
Full Runbook name
rjgit-org_devices_report-windows-devices-without-autopilot_scheduled
Details
Version
1.1.0
Required modules
RealmJoin.RunbookHelper (>= 0.8.7) Microsoft.Graph.Authentication (>= 2.39.0) Az.Accounts (>= 5.3.4)
Schedulable
yes
Permissions
Application permissions
Type: Microsoft Graph
Device.Read.All
DeviceManagementServiceConfig.Read.All
Organization.Read.All
Mail.Send
Permission notes
Azure IaaS: - Contributor - access on subscription or resource group used for the export
Parameters
SendMail
If enabled, the report is sent via email with the selected report file format(s) attached. Toggling this on reveals the recipient address and report file format fields.
Required
false
Default Value
False
Type
Boolean
Portal display name
Send the report via email?
Portal options
Yes - send the report via email
No - do not send an email
EmailTo
Recipient address(es) for the email report. Only used / shown when SendMail is enabled. Can be a single address or multiple comma-separated addresses (string).
Required
false
Default Value
Type
String
Portal display name
Recipient Email Address(es)
Hidden in portal
yes (preset via runbook customization)
EmailFrom
The sender email address. Sourced from the RJReport tenant settings (RJReport.EmailSender).
Required
false
Default Value
Type
String
Hidden in portal
yes (preset via runbook customization)
ReportFileFormat
Controls which report file formats are generated and delivered: "CSV only", "CSV & XLSX" (default) or "XLSX only".
Required
false
Default Value
CSV & XLSX
Type
String
Portal display name
Report file format
Hidden in portal
yes (preset via runbook customization)
Portal options
CSV & XLSX
CSV only
XLSX only
CreateDownloadLink
If enabled, the report files are uploaded to an Azure Storage Account and time-limited download links are returned.
Required
false
Default Value
True
Type
Boolean
Portal display name
Create a file download link (upload report to storage)?
Portal options
Yes - upload report and return a download link
No - do not create a download link
ContainerName
Storage container name used for the upload. Configured per runbook (not a global RJReport setting).
Required
false
Default Value
windows-devices-without-autopilot
Type
String
Hidden in portal
yes (preset via runbook customization)
ResourceGroupName
Resource group that contains the storage account. Sourced from the RJReport tenant settings.
Required
false
Default Value
Type
String
Hidden in portal
yes (preset via runbook customization)
StorageAccountName
Storage account name used for the upload. Sourced from the RJReport tenant settings.
Required
false
Default Value
Type
String
Hidden in portal
yes (preset via runbook customization)
LinkExpiryDays
Number of days until the generated download link expires. Sourced from the RJReport tenant settings.
Required
false
Default Value
6
Type
Int32
Hidden in portal
yes (preset via runbook customization)
Last updated
Was this helpful?