Reporting and monitoring¶

Intune has plenty of data. The trick is knowing which view answers which question, how fresh it is, and when to take it somewhere else for history and alerting.

Where reports live¶

Endpoint analytics¶

Endpoint analytics scores the user experience on Windows devices:

• Startup performance: boot and sign-in times, and the processes slowing them down.
• Application reliability: which apps crash most, by app, model and OS version.
• Work from anywhere: readiness for cloud management, cloud identity, cloud provisioning and Windows 11.
• Remediations: the script packages that detect and fix issues.

Devices need to be enrolled in endpoint analytics, which Intune handles with a data collection policy when you turn it on.

Advanced Analytics and device query¶

Advanced Analytics is included in Intune Plan 2, the Intune Suite, and Microsoft 365 E3 and E5 from July 2026. It adds battery health, resource performance and anomaly reports, a device timeline, and device query, which lets you run KQL against live inventory.

Example queries for multiple devices:

EncryptableVolume
| where ProtectionStatus != "PROTECTED"
| join LogicalDrive on Device

OsVersion
| summarize DeviceCount = count() by OsVersion
| order by DeviceCount desc

MemoryInfo
| where PhysicalMemoryTotalBytes < 8000000000
| project Device, PhysicalMemoryGB = PhysicalMemoryTotalBytes / (1000 * 1000 * 1000)
| order by PhysicalMemoryGB asc

Battery
| project Device, Model, CycleCount,
          HealthPercent = (FullChargedCapacity * 100) / DesignedCapacity
| where HealthPercent < 70
| order by HealthPercent asc

Tpm
| where Enabled != true

Device query supports a subset of KQL: where, project, summarize, join, order by, top, take, count and distinct, plus common scalar and aggregation functions. Refer to device properties with Device.<Property>, for example Device.SerialNumber. Copilot in Intune can write device queries from plain-language questions if you have Security Copilot.

Log Analytics¶

Send Intune data to a Log Analytics workspace under Reports > Diagnostic settings (needs an Azure subscription). You get history beyond the portal, alerting, workbooks, and a path to your SIEM through Event Hubs.

Column names and values can change. When a query doesn't return what you expect, run TableName | getschema or TableName | take 5 and adjust.

let Lookback = 2d;
IntuneDeviceComplianceOrg
| where TimeGenerated >= ago(Lookback)
| summarize arg_max(TimeGenerated, *) by DeviceId
| where ComplianceState != "Compliant"
| project DeviceName, UPN, OS, OSVersion, ComplianceState, InGracePeriodUntil, LastContact
| order by DeviceName asc

let Lookback = 7d;
IntuneAuditLogs
| where TimeGenerated >= ago(Lookback)
| where OperationName has_any ("wipe", "retire", "delete")
| project TimeGenerated, OperationName, Identity, ResultType, Properties
| order by TimeGenerated desc

let Lookback = 30d;
IntuneAuditLogs
| where TimeGenerated >= ago(Lookback)
| summarize Changes = count() by Identity, Category
| order by Changes desc

Turn the second query into an alert rule that fires when more than a handful of wipes happen in an hour. It's a cheap early warning for a compromised admin account.

Exporting reports with Graph¶

Most reports in the admin center can be exported with the exportJobs API: create a job, poll it until its status is completed, then download the zipped CSV from the returned url. Always name the columns you want with select, because default columns can change. See the example in Automation with Graph.

Audit logs¶

Tenant administration > Audit logs records who did what, when, and from which app. Filter by category (for example Device, Compliance, Role) or activity. For long-term retention and alerting, send them to Log Analytics as shown above.

Learn more¶

• Intune reports
• Device query for multiple devices
• Send Intune log data to Azure Monitor
• Export Intune reports using Graph APIs