Intune Graph API deviceStatuses missing device shown in portal

The permission is sufficient, so first rule out paging. Graph can return a partial collection; follow every @odata.nextLink exactly until none remains, then compare IntuneDeviceId rather than display name.

There is also a reporting-model mismatch. The admin center's current Device and user check-in and Device assignment reports use Intune's newer reporting service, while deviceConfigurations/{id}/deviceStatuses returns the legacy deviceConfigurationDeviceStatus resource. Microsoft now marks that entity deprecated from May 2026, so it should not be treated as the authoritative replacement for the portal report. Data can also differ briefly because device check-in and report generation are asynchronous.

For automation, use deviceManagement/reports/exportJobs with the DeviceConfigurationPolicyStatuses, or current V3, report and explicitly select PolicyId, IntuneDeviceId, DeviceName, PolicyStatus, and PspdpuLastModifiedTimeUtc. Filter where supported, poll the export job, and compare timestamps. If one device remains missing after a fresh sync and report generation, capture the request-id and timestamps for Microsoft support.