Intune Enrollmentsabandonedbytheuser

//Enrollments abandoned by the user //For details, see (https://docs.microsoft.com/en-us/mem/intune/enrollment/enrollment-report-company-portal-abandon) IntuneOperationalLogs | where OperationName == "Enrollment" | where Result == "Fail" | extend myJson=todynamic(Properties) | extend FailureReason = tostring(myJson ["FailureReason"]) | extend Os_ = tostring(parse_json(Properties).Os) | extend IntuneUserId_ = tostring(parse_json(Properties).IntuneUserId) | where FailureReason == "UserAbandonment" | summarize OperationCount=count() by FailureReason , IntuneUserId_ , Os_ | sort by OperationCount desc

Explanation

This query is looking at the Intune operational logs to find enrollments that were abandoned by the user. It filters for operations with the name "Enrollment" and a result of "Fail". It then extracts the failure reason, operating system, and Intune user ID from the properties of the log entry. It further filters for failure reasons that indicate user abandonment. Finally, it summarizes the count of these operations by failure reason, Intune user ID, and operating system, and sorts the results by the count in descending order.

Details

Rod Trent

Released: August 25, 2020

Tables

IntuneOperationalLogs

Keywords

Enrollments,UserAbandonment,IntuneUserId_,Os_

Operators

where==|extendmyJson=todynamic()FailureReason=tostring[]Os_=parse_json()IntuneUserId_=parse_json()summarizeOperationCount=count()byFailureReasonIntuneUserId_Os_sortbyOperationCountdesc

KQL Search