Audit Number Of Device Wipes And Deletions
Query
IntuneAuditLogs
| where TimeGenerated > ago(30d)
| where OperationName contains "Wipe" or OperationName contains "Delete"
| extend OperationType = iif(OperationName contains "Wipe", "Wipe", "Delete")
| summarize Count = count() by OperationTypeAbout this query
Description: Shows the Number of device Wipes and Deletions Actions in Intune.
Query:
Explanation
This query retrieves the number of device wipe and deletion actions in Intune within the last 30 days. It filters the Intune audit logs based on the operation names containing "Wipe" or "Delete". Then, it creates a new column called OperationType to categorize the operations as either "Wipe" or "Delete". Finally, it summarizes the count of each operation type.
Details
Ugur Koc
Released: January 10, 2024
Tables
IntuneAuditLogs
Keywords
IntuneAuditLogsTimeGeneratedOperationNameWipeDeleteOperationTypeCount
Operators
where>agocontainsorextendiifsummarizecountby