> For the complete documentation index, see [llms.txt](https://docs.intuneassistant.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.intuneassistant.cloud/intune-assistant/analyzer/intune-rsop.md).

# Intune RSOP

## What It Does

Intune RSOP answers a simple but important question: **is a device really configured the way Intune says it should be?**

Intune tells you what's assigned to a device. It doesn't tell you whether that device actually applied every setting correctly. Intune RSOP closes that gap: you export a settings snapshot from the device itself (using the IntuneAssistant tool, run locally on the device), upload it here, and the analyzer compares it setting-by-setting against what your tenant has actually assigned to that device — including its primary user, if it has one.

The result is a clear match/mismatch report and a compliance score for that one device, right now.

***

## How to Use It

1. On the managed device you want to check, run the IntuneAssistant export tool to produce a settings snapshot (a `.json` file).
2. In IntuneAssistant, navigate to **Analyzer → Intune RSOP** in the left sidebar.
3. Drop the settings export (`rsop-upload.json`) onto the left upload area, or click it to browse for the file.
4. Optionally, drop the device user file (`rsop-device-context.json`) onto the right upload area. With it, the analyzer can also check whose data the export contains. A combined file that already holds both works too.
5. Click **Analyze**. The analyzer fetches what Intune actually has assigned to that device and compares it against your files.
6. Review the compliance score, the **Primary user** card, the summary counts, and the per-setting table.
7. Use the **status filter** to narrow the table down to just mismatches, missing settings, or unexpected ones.
8. Click **Analyze another device** to run a new comparison.

Each file you upload must cover a single device — if it contains settings from more than one device, the analyzer will ask you to split it up.

***

## What You'll See

### Compliance Score

A single percentage showing how many of the device's assigned settings actually match. Above the score, you'll see the device's name and its primary user (if it has one).

### Primary User

If you uploaded the device user file, a **Primary user** card compares the user(s) found on the device with the primary user Intune has for that device:

* **Match**: one of the users on the device is the primary user in Intune.
* **Mismatch**: none of them is. Settings that apply to a user then describe a different user than the one Intune targets, and those settings are marked as such.
* **Unknown**: the upload has no user information, or Intune has no primary user for the device.

Intune decides who the primary user is. What the device reports is only evidence, so a mismatch can also mean a shared device or someone else being signed in when the export was made.

### Summary Cards

| Card       | Meaning                                                                                                  |
| ---------- | -------------------------------------------------------------------------------------------------------- |
| Match      | The device's reported value matches what Intune has configured                                           |
| Mismatch   | Intune has this setting assigned, but the device reported a different value                              |
| Missing    | Intune has this setting assigned, but the device's export didn't report it at all                        |
| Unexpected | The device reported a setting the analyzer couldn't match to anything currently assigned to it in Intune |

### Per-Setting Table

Each row shows the setting name, the policy it comes from, the value Intune expects, the value the device actually reported, and a status badge. A small `*` next to a Match badge means the two values only agreed after ignoring minor formatting differences (like extra spaces or letter casing) — worth a quick look if you want to confirm it's a genuine match.

Rows with an info icon next to the setting name can be clicked to expand — this shows exactly why the device gets that policy (which group it's a member of, an "All Devices"/"All Licensed Users" assignment, or a filter, along with the outcome for each).

### Recent Analyses

Below the main results, a short list of your most recent RSOP analyses for other devices, each showing its device, primary user, when it ran, and its compliance score.

***

## Requirements

* **License**: Active customer (any tier). Currently available to beta customers only while the feature is being rolled out.
* **Permissions required**: your account needs read access to managed devices and configuration policies in your tenant — the same access already used by other device and analyzer tools in IntuneAssistant. If it's missing, you'll be prompted to grant consent.
* The export tool must be run on the device itself, by someone with access to read its local policy state.
* Keeping a history of past analyses ("Recent analyses") requires the Troubleshooter add-on. Without it, you can still run and view every analysis — it just won't be remembered afterward.

***

## Common Questions

**Why does a setting show as "Mismatch" when I'm sure the device has the right value?** Intune and a device's local registry don't always represent a value in the exact same text format (for example, an option name versus a raw number). The table shows both raw values side by side so you can judge for yourself — a mismatch is always worth a look, but it isn't always a real configuration problem.

**Why does a setting show as "Missing"?** Intune has this setting assigned to the device, but the exported file didn't include it at all. This can mean the device hasn't applied the policy yet, or the export tool didn't capture that particular setting.

**Why does a setting show as "Unexpected"?** The device reported a setting that the analyzer couldn't tie back to anything currently assigned to it in Intune — often left over from a policy that used to apply but no longer does.

**Do I need the device user file?** No. Without it the analysis works as before, and the Primary user card shows "Unknown".

**Is my data shared across devices or customers?** No. Each analysis is scoped to your own tenant, and the history list only ever shows analyses you've run in your own tenant.