Intune Remoteactionstopusers
Query
//Remote actions top users
IntuneAuditLogs
| where OperationName contains "ManagedDevice"
| summarize OperationCount=count() by Identity
| sort by OperationCount descExplanation
This query is looking at Intune audit logs and finding the top users who have performed remote actions on managed devices. It counts the number of operations performed by each user and then sorts them in descending order based on the count.
Details
Rod Trent
Released: July 10, 2020
Tables
IntuneAuditLogs
Keywords
IntuneAuditLogsManagedDeviceOperationNameIdentityOperationCount
Operators
wherecontainssummarizecountbysort