KQL Search

Query Details

HomeAI ToolsDevice Query

Operational Number Of Successful Enrollmentsby OS

Query

// Number of Successful Enrollments by OS
// See here: https://github.com/rod-trent/SentinelKQL/blob/master/IntuneCountofSuccessfulEnrollmentsbyOS.txt
IntuneOperationalLogs 
| where OperationName == "Enrollment" and Result == "Success"
| extend OS = tostring(todynamic(Properties).Os
| summarize count() by OS

// Failed enrollments
IntuneOperationalLogs 
| where OperationName == "Enrollment" and Result == "Failed"
| extend OS = tostring(todynamic(Properties).Os
| summarize count() by OS

Explanation

This query is divided into two parts.

The first part is counting the number of successful enrollments for each operating system (OS). It does this by looking at the operational logs from Intune, filtering for entries where the operation was an "Enrollment" and the result was a "Success". It then groups these successful enrollments by the OS.

The second part of the query is doing a similar operation, but for failed enrollments. It filters the operational logs for "Enrollment" operations that have "Failed", groups these by the OS, and counts the number of failed enrollments for each OS.

Details

Ugur Koc profile picture

Ugur Koc

Released: August 6, 2022

Tables

IntuneOperationalLogs

Keywords

IntuneOperationalLogs,OperationName,Enrollment,Result,Success,OS,Properties,Failed,Count

Operators

IntuneOperationalLogswhereOperationNameResultextendOStostringtodynamicPropertiessummarizecount.

Actions