Query Details
Intune Enrollment Failurereasons
Query
//Enrollment Failure reasons IntuneOperationalLogs | where OperationName == "Enrollment" | where Result == "Fail" | extend myJson=todynamic(Properties) | extend FailureReason = tostring(myJson ["FailureReason"]) | summarize OperationCount=count() by FailureReason | sort by OperationCount desc
Explanation
This query is looking at operational logs in Intune and filtering for enrollment operations that have failed. It then converts the properties of the log entry into a dynamic object and extracts the failure reason. The query then summarizes the count of each failure reason and sorts them in descending order based on the count.
Details
Rod Trent
Released: July 10, 2020
Tables
IntuneOperationalLogs
Keywords
Enrollment,Intune,OperationalLogs,OperationName,Result,Properties,FailureReason,OperationCount
Operators
where==|extendmyJson=todynamic[]tostringsummarizecount()bysort bydesc