Agented Devicesnot AD Joined
Query
//Agented devices that are not AD-joined
SigninLogs
| union Heartbeat
| where Category == "Direct Agent" and DeviceDetail <> "Azure AD joined"
| distinct ComputerExplanation
This query is looking for devices that are not joined to Active Directory (AD) but are still being used to sign in or send heartbeats. It retrieves the computer names of these devices.
Details
Rod Trent
Released: August 7, 2020
Tables
SigninLogsHeartbeat
Keywords
DevicesIntuneUserSigninLogsHeartbeatCategoryDirect AgentDeviceDetailAzure AD joinedComputer
Operators
| unionwhere==<>distinct