Query Details
Intune Remoteactionsbyactiontype
Query
//Remote actions by action type IntuneAuditLogs | where OperationName contains "ManagedDevice" | summarize OperationCount=count() by OperationName | sort by OperationCount desc
Explanation
This query is looking at Intune audit logs and filtering for actions related to managed devices. It then counts the number of times each action occurs and sorts them in descending order based on the count.
Details
Rod Trent
Released: July 10, 2020
Tables
IntuneAuditLogs
Keywords
IntuneAuditLogs,ManagedDevice,OperationName,OperationCount
Operators
wherecontainssummarizecountbysort