Endpoint management

Checks whether every managed Mac in a Jamf Pro tenant has FileVault disk encryption enabled. First exchanges a client ID and secret for a bearer token at POST /api/v1/oauth/token, then paginates GET /v4/computers-inventory/filevault and reads each computer's bootPartitionEncryptionDetails.partitionFileVault2State.

jamfTenantUrl

the tenant's Jamf Cloud or self-hosted base URL, also used as the target.

clientId, clientSecret

a Jamf Pro API client credential pair with permission to view disk encryption recovery keys.

Only a state of ENCRYPTED counts as passing. Transitional states such as ENCRYPTING or DECRYPTING do not, since none of them represent a completed, currently encrypted boot partition. A 401 or 403 response, at either the token exchange or the inventory call, is reported as needs-review, never fail.

Checks whether every device managed by Microsoft Intune reports as compliant with its assigned policy. Calls GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices with a Microsoft Graph bearer token and reads each device's complianceState.

tenantId

the tenant identifier, used as the target label.

accessToken

a Microsoft Graph bearer token with permission to read device compliance state.

Only a complianceState of compliant passes. Every other documented value, including noncompliant, conflict, error, inGracePeriod, unknown, and configManager (evaluated by Configuration Manager co-management instead of Intune), is treated as not compliant. A 401 or 403 response is reported as needs-review, never fail.