Intune RSOP
What It Does
Intune RSOP answers a simple but important question: is a device really configured the way Intune says it should be?
Intune tells you what's assigned to a device. It doesn't tell you whether that device actually applied every setting correctly. Intune RSOP closes that gap: you export a settings snapshot from the device itself (using the IntuneAssistant tool, run locally on the device), upload it here, and the analyzer compares it setting-by-setting against what your tenant has actually assigned to that device — including its primary user, if it has one.
The result is a clear match/mismatch report and a compliance score for that one device, right now.
How to Use It
On the managed device you want to check, run the IntuneAssistant export tool to produce a settings snapshot (a
.jsonfile).In IntuneAssistant, navigate to Analyzer → Intune RSOP in the left sidebar.
Drop the settings export (
rsop-upload.json) onto the left upload area, or click it to browse for the file.Optionally, drop the device user file (
rsop-device-context.json) onto the right upload area. With it, the analyzer can also check whose data the export contains. A combined file that already holds both works too.Click Analyze. The analyzer fetches what Intune actually has assigned to that device and compares it against your files.
Review the compliance score, the Primary user card, the summary counts, and the per-setting table.
Use the status filter to narrow the table down to just mismatches, missing settings, or unexpected ones.
Click Analyze another device to run a new comparison.
Each file you upload must cover a single device — if it contains settings from more than one device, the analyzer will ask you to split it up.
What You'll See
Compliance Score
A single percentage showing how many of the device's assigned settings actually match. Above the score, you'll see the device's name and its primary user (if it has one).
Primary User
If you uploaded the device user file, a Primary user card compares the user(s) found on the device with the primary user Intune has for that device:
Match: one of the users on the device is the primary user in Intune.
Mismatch: none of them is. Settings that apply to a user then describe a different user than the one Intune targets, and those settings are marked as such.
Unknown: the upload has no user information, or Intune has no primary user for the device.
Intune decides who the primary user is. What the device reports is only evidence, so a mismatch can also mean a shared device or someone else being signed in when the export was made.
Summary Cards
Match
The device's reported value matches what Intune has configured
Mismatch
Intune has this setting assigned, but the device reported a different value
Missing
Intune has this setting assigned, but the device's export didn't report it at all
Unexpected
The device reported a setting the analyzer couldn't match to anything currently assigned to it in Intune
Per-Setting Table
Each row shows the setting name, the policy it comes from, the value Intune expects, the value the device actually reported, and a status badge. A small * next to a Match badge means the two values only agreed after ignoring minor formatting differences (like extra spaces or letter casing) — worth a quick look if you want to confirm it's a genuine match.
Rows with an info icon next to the setting name can be clicked to expand — this shows exactly why the device gets that policy (which group it's a member of, an "All Devices"/"All Licensed Users" assignment, or a filter, along with the outcome for each).
Recent Analyses
Below the main results, a short list of your most recent RSOP analyses for other devices, each showing its device, primary user, when it ran, and its compliance score.
Requirements
License: Active customer (any tier). Currently available to beta customers only while the feature is being rolled out.
Permissions required: your account needs read access to managed devices and configuration policies in your tenant — the same access already used by other device and analyzer tools in IntuneAssistant. If it's missing, you'll be prompted to grant consent.
The export tool must be run on the device itself, by someone with access to read its local policy state.
Keeping a history of past analyses ("Recent analyses") requires the Troubleshooter add-on. Without it, you can still run and view every analysis — it just won't be remembered afterward.
Common Questions
Why does a setting show as "Mismatch" when I'm sure the device has the right value? Intune and a device's local registry don't always represent a value in the exact same text format (for example, an option name versus a raw number). The table shows both raw values side by side so you can judge for yourself — a mismatch is always worth a look, but it isn't always a real configuration problem.
Why does a setting show as "Missing"? Intune has this setting assigned to the device, but the exported file didn't include it at all. This can mean the device hasn't applied the policy yet, or the export tool didn't capture that particular setting.
Why does a setting show as "Unexpected"? The device reported a setting that the analyzer couldn't tie back to anything currently assigned to it in Intune — often left over from a policy that used to apply but no longer does.
Do I need the device user file? No. Without it the analysis works as before, and the Primary user card shows "Unknown".
Is my data shared across devices or customers? No. Each analysis is scoped to your own tenant, and the history list only ever shows analyses you've run in your own tenant.
Last updated