Query Details
Intune Auto Pilot Failed Enrollment1day
Query
//Autopilot devices that failed enrollment in the last day IntuneOperationalLogs | where TimeGenerated > ago(24h) | extend IsAutopilot_ = tostring(parse_json(Properties).IsAutopilot) | extend DeviceName_ = tostring(parse_json(Properties).DeviceName) | where IsAutopilot_ == "True" | where OperationName == "Enrollment" and Result == "Failure"
Explanation
This query retrieves the Intune operational logs for devices that failed enrollment in the last 24 hours. It filters the logs based on the IsAutopilot property being "True" and the OperationName being "Enrollment" with a Result of "Failure".
Details
Rod Trent
Released: August 12, 2020
Tables
IntuneOperationalLogs
Keywords
Devices,Intune,User,Autopilot,Enrollment,Failure
Operators
where>agoextendtostringparse_json==and==