How to Monitor Device Actions and Audit Logs in Microsoft Intune (Step-by-Step Guide)

---

Part 1: View Device Actions

Goal: Find who ran an action (e.g. Wipe) on a device and when.

1. Sign in to the Microsoft Intune admin center.
2. Go to Devices → Overview.
3. Click the Device actions box.
4. Review the list — it shows the action taken, date/time, and who triggered it across all platforms.[learn.microsoft]​
5. Use the Filter option to narrow by action type (e.g. Wipe, Sync, Restart).
6. Click Export if you need the data for an incident report.

Note: There is no search bar and you cannot sort columns in the UI. Use the PowerShell script below to get sortable output.

PowerShell — Export Device Actions:

powershell$exportpath = "c:\temp\deviceactions.csv"
$url = "https://graph.microsoft.com/beta/deviceManagement/remoteActionAudits"
$fulloutput = getallpagination -url $url
$fulloutput | Select-Object * | Export-Csv $exportpath -NoTypeInformation

The API returns only 25 entries by default, so pagination is required.learn.microsoft+1

---

Part 2: Set Up Device Query

Goal: Configure Intune to collect real-time device properties you can query with KQL.

1. Go to Devices → Windows → Configuration.
2. Click Create → New Policy.
3. Set Platform to Windows 10 and later.
4. Set Profile type to Properties catalog.
5. Click Create.
6. Give the policy a Name and Description, then click Next.
7. Click Add properties and select the properties you need (e.g. CPU, TPM, OS version).learn.microsoft+1
8. Click Next through Scope Tags.
9. Assign the policy to All Devices or a specific group, then click Next.
10. Review and click Create.

Important: Wait at least 24 hours after policy assignment before data starts appearing in Device query.

Device query requires an Intune Advanced Analytics license (part of Intune Suite).

---

Part 3: Run a Device Query

Multiple Devices

1. Go to Devices → Device query.
2. On the left panel, browse available properties or type a KQL query directly in the text box.[niklasrast]​
3. Click Run.
4. Results appear below. Click Export if needed.

Single Device (Live Data)

1. Go to Devices → All devices and select a device.
2. Click Device query.
3. Enter your KQL query (or use an example from the bottom of the panel).
4. Click Run and check the Results tab.

Example KQL query:

textDeviceInfo
| project DeviceName, OSVersion, TotalMemory

Learn KQL basics at: https://learn.microsoft.com/en-us/azure/data-explorer/kql-learning-resources

---

Part 4: Review Audit Logs

Goal: Track tenant-level changes like policy edits, creations, or deletions.learn.microsoft+1

1. Go to Tenant administration → Audit logs.
2. Use the Filter at the top to narrow by activity type, date range, or category.
3. Use the Search box to find changes made by a specific user (enter their UPN).
4. Click any row to see full details — including old value and new value of what changed.controlaltdeletetechbits+1
5. Click Export to download what is currently shown on screen.

Tip: The export only captures what’s visible on screen. Use the Graph API script below to pull full details including modified property values.

PowerShell — Export Audit Logs with Drill-Down:

powershell$exportpath = "c:\temp\auditlog.csv"
$uri = "https://graph.microsoft.com/beta/deviceManagement/auditEvents"

# Get all paginated results and expand the Actor object
$eventsvalues = getallpagination -url $uri
$eventsvalues = $eventsvalues | Select-Object * -ExpandProperty Actor
$eventsvalues = $eventsvalues | Select-Object resources, userPrincipalName,
    displayName, category, activityType, activityDateTime,
    activityOperationType, id

# Build clean output array
$listofevents = foreach ($event in $eventsvalues) {
    [pscustomobject]@{
        changedItem       = $event.Resources.displayName
        changedBy         = $event.userPrincipalName
        change            = $event.displayName
        changeCategory    = $event.category
        activityType      = $event.activityType
        activityDateTime  = $event.activityDateTime
        id                = $event.id
    }
}

# Export or view
$listofevents | Export-Csv $exportpath -NoTypeInformation
# OR for interactive grid with drill-down:
$selected = $listofevents | Out-GridView -PassThru

Audit logs via Graph API retain up to 2 years of data.[learn.microsoft]​

---

Quick Reference

Feature	Location in Portal	Graph Endpoint

Feature	Location in Portal	Graph Endpoint
Device actions	Devices → Overview → Device actions	/deviceManagement/remoteActionAudits [learn.microsoft]​
Device query (multi)	Devices → Device query	API currently locked
Device query (single)	Devices → [Device] → Device query	API currently locked
Audit logs	Tenant administration → Audit logs	/deviceManagement/auditEvents [learn.microsoft]​