Create one with pipx install git+https://github.com/dallascrilley/intune-why then intune-why collect --tenant your-tenant.onmicrosoft.com. It is read-only and writes intune-snapshot.json. This page analyzes it in your browser.
Rules cover standard settings. Custom compliance settings can go to Jev, a typed decision model, through OpenRouter with your own key. Only the setting name and counts are sent, never device or user names. A run costs a fraction of a cent.