KQL Search

Query Details

HomeAI ToolsDevice Query

Operational Latest Device Enrollments

Query

// Show a list of Devices, with Device Name, Result and OS that have been enrolled to Intune.
IntuneOperationalLogs 
| where TimeGenerated > ago(7d) // Change the value in () as you desire e.g. 12h, 10d, 30d. d = day, h = hour.
| extend DeviceId = tostring(todynamic(Properties).IntuneDeviceId)
| extend OS = tostring(todynamic(Properties).Os)
| where Result == "Success"
| where OperationName has "Enrollment"
//| where OS == "Windows" // You can filter by OS Platform e.g. iOS, Android, Windows. Just replace the vaule between the " " and delete the // infront of |.
| join kind=leftouter IntuneDevices on DeviceId // DeviceName from IntuneDevices. Can be delayed.
| project TimeGenerated, DeviceId, DeviceName, Result, OperationName, OS
| summarize TimeGenerated = max(TimeGenerated) by DeviceId, DeviceName, Result, OperationName, OS
| sort by TimeGenerated desc

Explanation

This query is designed to display a list of devices that have been successfully enrolled to Intune within the last 7 days. The list includes the device's name, the result of the operation, and the device's operating system. The query also allows for the option to filter the results by operating system, such as iOS, Android, or Windows. The results are then sorted by the time the device was enrolled, with the most recent enrollments appearing first.

Details

Ugur Koc profile picture

Ugur Koc

Released: June 28, 2022

Tables

IntuneOperationalLogsIntuneDevices

Keywords

Devices,DeviceName,Result,OS,Intune,TimeGenerated,OperationName,IntuneOperationalLogs,IntuneDevices

Operators

IntuneOperationalLogswhereagoextendtostringtodynamicjoinkind=leftouterprojectsummarizemaxsort bydesc.

Actions