table

IntuneAuditLogs

IntuneAuditLogs stores Microsoft Intune audit records for administrative and service operations captured in Azure Monitor Logs and Microsoft Sentinel-connected workspaces.

tablesCurrent

Relationships

Microsoft Intune
Source productproduct IntuneOperationalLogs
Related tabletable

Schema

Field	Type	Description
`_BilledSize`	real	The record size in bytes.
`Category`	string	The Intune audit log category for the record.
`CorrelationId`	string	Identifier used to correlate related Intune audit operations.
`Identity`	string	Identity associated with the Intune audit operation.
`_IsBillable`	string	Indicates whether ingesting the record is billable.
`OperationName`	string	Name of the Intune operation recorded in the audit log.
`Properties`	string	JSON-formatted operation details for the audit record.
`ResultDescription`	string	Additional description for the operation result.
`ResultType`	string	Result status for the Intune audit operation.
`SourceSystem`	string	Type of agent or source that collected the event.
`TimeGenerated`	datetime	Date and time when the record was generated.
`Type`	string	Name of the table.

Sample KQL

Recent Intune audit failures

Summarize Intune audit operations with non-success result values by operation and identity.

kql

IntuneAuditLogs
| where TimeGenerated > ago(7d)
| summarize Events=count(), Failures=countif(ResultType !in ("Success", "Succeeded")) by OperationName, Identity
| order by Failures desc, Events desc

Related KQL

Review Intune policy changes by operator

Summarize Intune audit activity by operation, identity, and result to spot policy edits, assignment changes, and deletions.

template

beginnerintuneoperational-excellence

Run surface: Sentinel Logs, Azure Monitor Logs
Required tables: IntuneAuditLogs
License context: Microsoft Defender for Endpoint P2

kql

IntuneAuditLogs
| where TimeGenerated > ago({lookback})
| where OperationName has_any ("Create", "Update", "Delete", "Assign")
| summarize Events=count(), Failures=countif(ResultType !in ("Success", "Succeeded")), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by OperationName, Identity, ResultType
| order by LastSeen desc

Source: KQLMSPress/definitive-guide-kql Chapter 4: Operational Excellence/Query Samples. Adapted from Intune operational diagnostics themes for existing IntuneAuditLogs coverage.