KQL Search

Query Details

HomeAI ToolsDevice Query

Operational Enrollment Types

Query

IntuneOperationalLogs 
| where TimeGenerated > ago(30d) // look for devices that were active in the last 30 days
| where OperationName == "Enrollment" // Filter for enrollments
| extend Type = todynamic(Properties).EnrollmentType // Look into properties for the enrollment type
| summarize count(OperationName) by tostring(Type)

Explanation

This query is looking at operational logs from Intune, a Microsoft service for managing mobile devices. It's specifically looking for logs from the past 30 days where a device has been enrolled. It then categorizes these enrollments by the type of enrollment, which is found in the properties of each log. Finally, it counts the number of each type of enrollment.

Details

Ugur Koc profile picture

Ugur Koc

Released: July 21, 2022

Tables

IntuneOperationalLogs

Keywords

IntuneOperationalLogs,TimeGenerated,Devices,OperationName,Enrollment,Properties,EnrollmentType,Type

Operators

IntuneOperationalLogswhereTimeGeneratedagoOperationNameextendTypetodynamicPropertiesEnrollmentTypesummarizecountbytostring.

Actions