KQL Search

Query Details

HomeAI ToolsDevice Query

Operational Visualize Enrollment Statistics

Query

// Visualize Enrollment Statistics (Success and Fail) over time
IntuneOperationalLogs
| where  OperationName == "Enrollment"
| where TimeGenerated > ago(365d)
| extend DeviceId = tostring(todynamic(Properties).IntuneDeviceId)
| join kind=leftouter IntuneDevices on DeviceId 
| summarize arg_max(DeviceId, *) by DeviceId, startofweek(TimeGenerated)
//| where Result == "Success" // Filter for success or Fail
| summarize EnrollmentCount=count()by Result, startofweek(TimeGenerated)
| render timechart  
    with (
    ytitle="Device Count",
    xtitle="Week",
    title="Enrollments per week over time")

Explanation

This query is designed to visualize the statistics of device enrollments, both successful and failed, over the past year. It pulls data from the IntuneOperationalLogs, specifically focusing on the "Enrollment" operation. It then identifies each device by its unique ID and joins this data with information from the IntuneDevices.

The query then groups the data by device ID and the start of the week when the operation was generated. It counts the number of enrollments (both successful and failed) for each week and presents this data in a time chart. The chart displays the number of devices on the y-axis and the week on the x-axis, providing a visual representation of enrollments per week over time.

Details

Ugur Koc profile picture

Ugur Koc

Released: August 13, 2022

Tables

IntuneOperationalLogsIntuneDevices

Keywords

EnrollmentStatistics,IntuneOperationalLogs,OperationName,TimeGenerated,DeviceId,Properties,IntuneDeviceId,IntuneDevices,Result,DeviceCount,Week,Enrollments

Operators

whereOperationNameTimeGeneratedagoextendtostringtodynamicPropertiesjoinkindleftouterIntuneDevicesDeviceIdsummarizearg_maxstartofweekResultcountrendertimechartwithytitlextitletitle.

Actions