Query Details
Intune Topuserswithauditedactions
Query
//Top users with audited actions IntuneAuditLogs | extend myJson=todynamic(Properties) | summarize OperationCount=count() by Identity | sort by OperationCount desc
Explanation
This query is looking at the IntuneAuditLogs data and finding the top users who have performed audited actions. It does this by counting the number of operations each user has performed and then sorting them in descending order.
Details
Rod Trent
Released: July 10, 2020
Tables
IntuneAuditLogs
Keywords
IntuneAuditLogs,Properties,Identity,OperationCount
Operators
extendsummarizesort by