Intune Topuserswithauditedactions
Query
//Top users with audited actions
IntuneAuditLogs
| extend myJson=todynamic(Properties)
| summarize OperationCount=count() by Identity
| sort by OperationCount descExplanation
This query is looking at the IntuneAuditLogs data and finding the top users who have performed audited actions. It does this by counting the number of operations each user has performed and then sorting them in descending order.
Details
Rod Trent
Released: July 10, 2020
Tables
IntuneAuditLogs
Keywords
IntuneAuditLogsPropertiesIdentityOperationCount
Operators
extendsummarizesort by