Query Details
Agented Devicesnot AD Joined
Query
//Agented devices that are not AD-joined SigninLogs | union Heartbeat | where Category == "Direct Agent" and DeviceDetail <> "Azure AD joined" | distinct Computer
Explanation
This query is looking for devices that are not joined to Active Directory (AD) but are still being used to sign in or send heartbeats. It retrieves the computer names of these devices.
Details
Rod Trent
Released: August 7, 2020
Tables
SigninLogsHeartbeat
Keywords
Devices,Intune,User,SigninLogs,Heartbeat,Category,DirectAgent,DeviceDetail,AzureADjoined,Computer
Operators
| unionwhere==<>distinct