capability

Defender for Endpoint and Intune Integration

The Microsoft Defender for Endpoint and Intune integration connects endpoint risk, device compliance, onboarding, and security policy management across the Microsoft security and device-management planes.

capabilitiesCurrent

Relationships

Microsoft Intune
Source productproduct DeviceInfo
Related tabletable DeviceEvents
Related tabletable IntuneAuditLogs
Related tabletable IntuneOperationalLogs
Related tabletable Microsoft Defender for Endpoint APIs
API accessapi

Configuration Methods

Method	Support	Reference or Gap
Portal	Supported	Reference
PowerShell	Gap	The connector is configured in Intune rather than through a product-specific PowerShell cmdlet.
REST API	Gap	Use Microsoft Graph for Intune-side policy automation.
Graph	Supported	Reference
ARM	Gap	The cross-product connector is not an ARM resource.
Bicep	Gap	The cross-product connector is not a Bicep resource.
Terraform	Gap	The tenant connector and cross-product workflow should be automated through Intune/Graph or Microsoft365DSC rather than Azure resource Terraform.
GitHub Actions	Gap	Use Graph authentication and a dedicated automation workflow rather than a native GitHub Actions provider.
Azure DevOps	Gap	Use Graph authentication and a dedicated pipeline rather than a native Azure DevOps provider.

Related KQL

Review Intune policy changes by operator

Summarize Intune audit activity by operation, identity, and result to spot policy edits, assignment changes, and deletions.

template

beginnerintuneoperational-excellence

Run surface: Sentinel Logs, Azure Monitor Logs
Required tables: IntuneAuditLogs
License context: Microsoft Defender for Endpoint P2

kql

IntuneAuditLogs
| where TimeGenerated > ago({lookback})
| where OperationName has_any ("Create", "Update", "Delete", "Assign")
| summarize Events=count(), Failures=countif(ResultType !in ("Success", "Succeeded")), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by OperationName, Identity, ResultType
| order by LastSeen desc

Source: KQLMSPress/definitive-guide-kql Chapter 4: Operational Excellence/Query Samples. Adapted from Intune operational diagnostics themes for existing IntuneAuditLogs coverage.

Trend Intune operational failures

Chart Intune operational failures by operation and category to troubleshoot device-management service issues.

workbook dashboard

beginnerintuneoperational-excellence

Run surface: Sentinel Logs, Azure Monitor Logs
Required tables: IntuneOperationalLogs
License context: Microsoft Defender for Endpoint P2

kql

IntuneOperationalLogs
| where TimeGenerated > ago({lookback})
| summarize Events=count(), Failures=countif(Result !in ("Success", "Succeeded")) by bin(TimeGenerated, 1h), OperationName, Category
| where Failures > 0
| order by TimeGenerated desc

Source: KQLMSPress/definitive-guide-kql Chapter 4: Operational Excellence/Query Samples. Adapted from operational excellence and Intune diagnostic query themes.