Query Details
Audit Show Feature Update Policies
Query
// Show changes to Feature Update Policies and who created or changed them. IntuneAuditLogs | where OperationName has "WindowsFeatureUpdateProfile" | extend User = todynamic(Properties).Actor.UPN | extend ['Name of Policy'] = todynamic(Properties).TargetDisplayNames[0] | extend Changes = todynamic(Properties).Targets[0].ModifiedProperties[0].Name | project ['Name of Policy'], Changes, User
Explanation
This query is designed to display changes made to Windows Feature Update Policies in Intune Audit Logs. It shows the name of the policy that was changed, what changes were made, and the user who made these changes.
Details
Ugur Koc
Released: July 23, 2022
Tables
IntuneAuditLogs
Keywords
IntuneAuditLogs,OperationName,WindowsFeatureUpdateProfile,User,Properties,Actor,UPN,NameofPolicy,TargetDisplayNames,Changes,Targets,ModifiedProperties,Name
Operators
whereextendtodynamicproject