KQL Search

Query Details

Intune Remoteactionstopusers

Query

//Remote actions top users
IntuneAuditLogs
| where OperationName contains "ManagedDevice" 
| summarize OperationCount=count() by Identity
| sort by OperationCount desc

Explanation

This query is looking at Intune audit logs and finding the top users who have performed remote actions on managed devices. It counts the number of operations performed by each user and then sorts them in descending order based on the count.