Query Details

Audit Show Feature Update Policies

Query

// Show changes to Feature Update Policies and who created or changed them.
IntuneAuditLogs
| where OperationName has "WindowsFeatureUpdateProfile"
| extend User = todynamic(Properties).Actor.UPN
| extend ['Name of Policy'] = todynamic(Properties).TargetDisplayNames[0]
| extend Changes = todynamic(Properties).Targets[0].ModifiedProperties[0].Name
| project ['Name of Policy'], Changes, User

Explanation

This query is designed to display changes made to Windows Feature Update Policies in Intune Audit Logs. It shows the name of the policy that was changed, what changes were made, and the user who made these changes.