Send your device and licence report automatically every month

Every month the same round: an export from Intune, a licence overview from the Microsoft 365 admin center, then pasting it all together in Excel. It easily takes half an hour, you do it twelve times a year, and whether anyone reads the result in full is questionable. Here is how to turn that into one report that builds and sends itself.

The half hour that keeps coming back

In smaller organisations a full-time administrator is not a given. Microsoft 365 is managed by the office manager, the founder, or an external party with a few hours a month. Reporting easily slips: you look at the licence overview only when the invoice is higher than expected, and at device update status only when someone calls about a slow laptop.

Automating this helps not because it is modern, but because it removes the threshold. A report that lands in your mailbox every first Monday actually gets read. And because it arrives every month, you see differences: four devices without a recent check-in last month, eleven now. That difference is the value, not the snapshot.

What do you actually want to know?

Start with the question, not the technology. These three questions are a useful starting point:

• Which devices are falling behind? Devices that have not checked in for weeks, devices without encryption, or devices on an operating system version going out of support.
• Which licences are you paying for without a user? Assigned versus available per subscription, plus licences still attached to blocked accounts.
• Which accounts are quiet? Users who have not signed in for a long time. Often these are leavers whose offboarding was never finished.

Three tables, each no longer than a screen. Nobody reads a forty-page report, including you.

Three routes, three profiles

1. The built-in reports

Intune and the Microsoft 365 admin center have their own reports with an export button. No development, no permission puzzle: you click and you have a file. The downside is that you keep doing it yourself, and combining data from two portals is still manual. Useful as a first step to decide which columns you actually want, and to check later whether your automated report produces the same numbers.

2. Power Automate

Low threshold, visible steps, and anyone on the team can see what the flow does. You schedule a flow, fetch the data, write it to a file and mail it. Watch two things: calls towards Microsoft Graph can run through connectors that count as premium, and Power Platform licensing changes regularly. Before you build, check the current Power Platform Licensing Guide and Microsoft’s licensing FAQ to see which licence you need, and the release wave plan for Power Automate for what shipped in 2026 wave 1; since September 2026 Microsoft publishes new capabilities on the AI at Work roadmap. That saves you a flow that works technically but is not allowed under your licence.

3. PowerShell with Microsoft Graph

Plenty of control and low running costs, but you do need to be able to read a script. You run it in a scheduled task or a cloud runbook, fetch exactly the fields you want, and send the result as an attachment. Keep the version jump of the Microsoft Graph PowerShell SDK in mind: version 3, planned for Q4 2026, no longer supports Windows PowerShell 5.1, so you need PowerShell 7; anyone staying on 5.1 must stay on a 2.x release. That line received an update (V2.41) on 30 September 2026 that resolves clashing assemblies in shared sessions. Check the releases on GitHub and the open issues before pinning a version: V2.41, for example, broke Azure Automation runbooks on the PowerShell 7.2 and 7.4 runtimes.

The smallest working setup

Do not build the perfect report straight away. Aim for one table that is correct, then expand.

1. Create an app registration in Microsoft Entra ID with a clear name such as “Monthly reporting”.
2. Grant read permissions only for the data you need (device data, subscriptions, users). Look up the exact permission in the Graph documentation for the endpoint you use; do not guess.
3. Use a certificate instead of a secret if the environment you run in supports it.
4. Write the script or flow with a single query, for example Get-MgSubscribedSku for the licence overview, and write the result to CSV.
5. Schedule it at a fixed moment, such as the first Monday of the month at 07:00.
6. Mail it to a shared mailbox, not to one person. Otherwise the report stops when that person leaves.
7. Compare the first two runs by hand with the export from the portal. Only trust the numbers once they match.

Permissions: as few as possible, with one clear owner

Never run reporting under an administrator’s personal account. That account will eventually get MFA changes, a new password, or be disabled, and the report stops without anyone noticing. An app registration with read-only permissions is safer and survives staff changes.

Also record who owns it: who renews the certificate, who gets the alert when a run fails, and where the source code lives. One line in your documentation prevents a script that nobody dares to touch two years from now.

The pitfalls

• Expired certificate or secret. A common reason reporting dies. Put the expiry date in the calendar, not only in your head.
• Paging. Microsoft Graph returns results in pages. If you process only the first page, your device count is quietly wrong.
• Throttling. A tenant-wide query can return a 429 response. Respect the wait time you get back and retry, instead of aborting the query.
• Concealed names. In usage reports, user and group names can be hidden. Check that setting if your report shows nothing but hashes.
• Time zone and daylight saving. Schedules often default to UTC. Harmless for a monthly report, annoying if you depend on an exact cut-off date.
• Silent failures. A failed run should send you a message. No message is not proof that it went well.

Adding AI: where it helps and where it does not

AI is useful for writing the script, explaining an error message and drafting the summary above your table. It is less suitable as a check on the numbers themselves: a language model does not count, it estimates. Let your script do the arithmetic and use AI for the accompanying text at most.

Beyond that, do not paste tenant data, serial numbers or user names into a random chatbot. Use a service your organisation has data processing agreements with, or anonymise your sample data before sharing anything.

Checklist: live in an afternoon

1. Pick at most three questions your report answers.
2. Collect the same data manually first as a reference.
3. Choose your route: built-in, Power Automate, or PowerShell with Graph.
4. Create an app registration with read-only permissions and a certificate.
5. Build one table, schedule it, and mail it to a shared mailbox.
6. Compare two runs with the manual export.
7. Put expiry dates and the owner in your documentation.
8. Only then add the second and third table.

For the one-off question in between — what is the status of this single device? — I built Deskside: scan the serial number and see the status in Windows Autopilot, Microsoft Intune and Microsoft Entra ID right away. A monthly report and a quick scan complement each other: the report shows trends, the scan answers today’s question. If you would rather have this set up for you, see IT consultancy or book a half-hour intro call.

Frequently asked questions

Do I need a paid Power Automate licence?

It depends on the connectors you use; calls towards Microsoft Graph can count as premium. Check the current Power Platform Licensing Guide and Microsoft's licensing FAQ before you build, because the structure changes regularly.

Which PowerShell version do I need for the Graph SDK?

Version 3 of the Microsoft Graph PowerShell SDK is announced for Q4 2026 and no longer supports Windows PowerShell 5.1, so it requires PowerShell 7. Microsoft announced a twelve-month retirement period in September 2026; the 2.x line received V2.41 on 30 September 2026. Check the GitHub releases before pinning a version.

Can I use my own admin account for reporting?

Better not. Use an app registration in Microsoft Entra ID with read-only permissions and preferably a certificate, so the report keeps running when your password changes or you leave.

Can I let AI summarise my report?

For the accompanying text, yes. Let your script do the counting, and do not paste user names or serial numbers into a chatbot your organisation has no data processing agreement with.