Query Details

Intune Enrollment Failuresby Platform

Query

//Enrollment Failures by Platform
IntuneOperationalLogs
| where  OperationName == "Enrollment" 
| where Result == "Fail"
| extend myJson=todynamic(Properties)
| extend Platform = tostring(myJson ["Os"])
| summarize OperationCount=count() by Platform 
| sort by OperationCount desc

Explanation

This query is looking at operational logs in Intune and filtering for enrollment failures. It then converts a property called "Os" into a string and groups the results by platform. Finally, it sorts the results by the count of operations in descending order.