Intune Enrollment Failurereasons
Query
//Enrollment Failure reasons
IntuneOperationalLogs
| where OperationName == "Enrollment"
| where Result == "Fail"
| extend myJson=todynamic(Properties)
| extend FailureReason = tostring(myJson ["FailureReason"])
| summarize OperationCount=count() by FailureReason
| sort by OperationCount descExplanation
This query is looking at operational logs in Intune and filtering for enrollment operations that have failed. It then converts the properties of the log entry into a dynamic object and extracts the failure reason. The query then summarizes the count of each failure reason and sorts them in descending order based on the count.
Details
Rod Trent
Released: July 10, 2020
Tables
IntuneOperationalLogs
Keywords
EnrollmentIntuneOperationalLogsOperationNameResultPropertiesFailureReasonOperationCount
Operators
where==|extendmyJson=todynamic[]tostringsummarizecount()bysort bydesc