Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Find the report in the Intune admin center at Reports > Device management > Device attestation status. It shows whether Windows enrollment attestation is Completed, Failed, or Not started, with device and TPM details to help explain the result. Filter by attestation status or ownership, then generate or regenerate the report to retrieve updated data.
What the report tells you
Device attestation status is an enrollment-attestation report. It combines a device’s current attestation status with information that can help you identify the device and assess whether it meets the feature’s requirements. Select a report row to inspect additional device details.
As an Amazon Associate I earn from qualifying purchases.
- Device name and device ID
- User principal name (UPN)
- Attestation status and status detail
- Operating system and version
- Ownership type, last check-in, and enrollment date
- TPM version and manufacturer, and device model
Microsoft’s Intune reports guide describes the enrollment-attestation status groups as Completed, Failed, and Not started. The more specific Windows enrollment attestation documentation lists the report fields and explains the feature’s requirements.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOpen and generate the report
- Sign in to the Intune admin center.
- Go to Reports > Device management > Device attestation status.
- Filter by Attestation status or Ownership type to narrow the results.
- Select Generate report. To retrieve updated data later, select Generate again.
- Review the status and detail columns. Select a device row for additional information.
Check whether a Windows device is eligible
Windows enrollment attestation uses TPM technology. Microsoft documents the following prerequisites; confirm the current requirements in its documentation before using them to assess a device:
#1 Best Overall
- A TPM version of 2.0 or later.
- A physical device. Hyper-V and Azure virtual machines, Azure Virtual Desktop session hosts, Windows 365 Cloud PCs, and Microsoft Dev Box are not supported by this feature, including configurations with a virtual TPM (vTPM).
- Windows 10 build 19045.3996 or later, or Windows 11 build 22000.2713, 22621.2792, or 22631.2792 or later, as listed in Microsoft’s documentation.
Attestation occurs during Intune device-management enrollment, after TPM attestation in Windows Autopilot pre-provisioning and Shared device mode. Microsoft also identifies the applicable Windows CSPs as InitiateRecovery, RecoveryStatus, and MDMClientCertAttestation.
Interpret the status detail before troubleshooting
A Failed or Not started status is not, by itself, a diagnosis. Use the device’s status detail to determine what the report actually indicates. Microsoft lists examples such as:
| Status detail | What it indicates |
|---|---|
| Entra key can’t be attested | The Entra key could not be attested. |
| Attestation is in process | The attestation has not finished processing. |
| TPM isn’t trusted | The TPM was not accepted as trusted. |
| Feature isn’t supported | The device or configuration does not support the feature. |
| Entra token doesn’t match device identity | The token’s device identity does not match the device identity. |
| Entra token is missing device identity | The token does not contain a device identity. |
These details point to different conditions; do not treat every unsuccessful status as the same TPM problem. Check device eligibility and the reported detail before choosing an action.
Retry attestation with Attest device
An administrator with the relevant Remote tasks permission for MDM attestation can use Attest device for devices with Not started TPM attestation and certain listed failure details. Microsoft’s documented operating limits are:
Rank #3
- Select no more than 100 devices for one action.
- Wait at least one minute between actions.
- Allow up to 15 minutes for completion; processing time depends on device activity and the number of selected devices.
After allowing time for processing, refresh the report to check for an updated result. Microsoft cautions that TPM troubleshooting may require Wipe and Reset, which can result in data loss. Ensure backups are in place before taking an action that could erase device data.
Do not confuse it with the Windows hardware attestation report
Intune has another report with a similar name, but it answers a different question. Device attestation status covers enrollment attestation. The Windows hardware attestation report covers Intune-enrolled devices assigned compliance policy settings that are hardware-attested.
| Device attestation status | Windows hardware attestation report | |
|---|---|---|
| Purpose | Enrollment attestation | Hardware-attested compliance settings assigned through a compliance policy |
| Location | Reports > Device management | Reports > Device Compliance > Reports tab |
| Useful output | Enrollment status, device and TPM fields, and status detail | Status for assigned hardware-attested settings; errors include a detected type and code |
For the hardware report, the Latest report column reflects the date of the last health certificate issuance or report generation. See Microsoft’s Windows hardware attestation report documentation for its scope and output.
Recommended Free Tools
Graph and automation considerations
Microsoft Graph v1.0 documents a deviceHealthAttestationState resource with attestation-state properties, including last update and issue timestamps. Microsoft notes that using Graph for Intune requires an active Intune license for the tenant.
The Graph beta deviceIdentityAttestationStatus enumeration includes unknown, trusted, unTrusted, notSupported, and incompleteData. Beta APIs can change more frequently; check whether the needed functionality is available in v1.0 and prefer v1.0 when possible before building automation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
