EntraID - Microsoft Defender for Endpoint - Security Settings Management - Device Registrations

Entra ID MDE Device Registrations

Query

CloudAppEvents
| where ActionType == "Add device." or ActionType == 'Update device.'
| where AccountDisplayName == "Microsoft Intune"
| extend modifiedProperties = parse_json(RawEventData).ModifiedProperties
| mv-expand modifiedProperties
| where modifiedProperties.Name == "DeviceOSType"
| extend NewValue = tostring(parse_json(tostring(modifiedProperties.NewValue))[0])
| extend OldValue = tostring(parse_json(tostring(modifiedProperties.OldValue))[0])
| project TimeGenerated, OldValue, NewValue, ActionType, AccountDisplayName, RawEventData
| mv-apply TargetResource = RawEventData.ModifiedProperties on (
    extend TargetResourcesTypes = extract_json("$.DisplayName","Name",typeof(string))
    | where TargetResource.Name == "DisplayName"
    )
| extend DeviceName = tostring(parse_json(tostring(TargetResource.NewValue))[0])
| project TimeGenerated, DeviceName, OldValue, NewValue, ActionType, AccountDisplayName

About this query

Explanation

This query helps to track device registrations and changes in device operating system type in Entra ID initiated by Microsoft Defender for Endpoint Security Management. It uses AuditLogs and CloudAppEvents data sources to monitor updates and additions of devices, specifically focusing on the DeviceOSType property. The query extracts relevant information such as the old and new values of the DeviceOSType, device name, and the operation type.

Details

Alex Verboon

Released: April 26, 2024

Tables

AuditLogs CloudAppEvents

Keywords

DeviceIntuneMicrosoftDefenderEndpointSecurityManagementDeviceOSTypeAuditLogsCloudAppEventsAccountDisplayNameTargetResourcesTargetResourceActionTypeRawEventDataModifiedPropertiesTimeGeneratedIdentityAADOperationTypeDisplayNameNameNewValueOldValue.

Operators

whereextendparse_jsonmv-expandprojectmv-applyextract_json|==or&&tostring

Actions

GitHub

KQL Search