Query Details
Intune Remoteactionstopusers
Query
//Remote actions top users IntuneAuditLogs | where OperationName contains "ManagedDevice" | summarize OperationCount=count() by Identity | sort by OperationCount desc
Explanation
This query is looking at Intune audit logs and finding the top users who have performed remote actions on managed devices. It counts the number of operations performed by each user and then sorts them in descending order based on the count.
Details
Rod Trent
Released: July 10, 2020
Tables
IntuneAuditLogs
Keywords
IntuneAuditLogs,ManagedDevice,OperationName,Identity,OperationCount
Operators
wherecontainssummarizecountbysort