table

IntuneOperationalLogs

IntuneOperationalLogs stores Microsoft Intune operational records for service and device-management activity captured in Azure Monitor Logs and Microsoft Sentinel-connected workspaces.

tablesCurrent

Relationships

Microsoft Intune
Source productproduct IntuneAuditLogs
Related tabletable

Schema

Field	Type	Description
`_BilledSize`	real	The record size in bytes.
`Category`	string	The Intune operational log category for the record.
`_IsBillable`	string	Indicates whether ingesting the record is billable.
`OperationName`	string	Name of the Intune operation recorded in the operational log.
`Properties`	string	JSON-formatted operation details for the operational record.
`Result`	string	Result status for the Intune operational event.
`SourceSystem`	string	Type of agent or source that collected the event.
`TimeGenerated`	datetime	Date and time when the record was generated.
`Type`	string	Name of the table.

Sample KQL

Recent Intune operational failures

Summarize Intune operational events with non-success result values by operation and category.

kql

IntuneOperationalLogs
| where TimeGenerated > ago(24h)
| summarize Events=count(), Failures=countif(Result !in ("Success", "Succeeded")) by OperationName, Category
| order by Failures desc, Events desc

Related KQL

Trend Intune operational failures

Chart Intune operational failures by operation and category to troubleshoot device-management service issues.

workbook dashboard

beginnerintuneoperational-excellence

Run surface: Sentinel Logs, Azure Monitor Logs
Required tables: IntuneOperationalLogs
License context: Microsoft Defender for Endpoint P2

kql

IntuneOperationalLogs
| where TimeGenerated > ago({lookback})
| summarize Events=count(), Failures=countif(Result !in ("Success", "Succeeded")) by bin(TimeGenerated, 1h), OperationName, Category
| where Failures > 0
| order by TimeGenerated desc

Source: KQLMSPress/definitive-guide-kql Chapter 4: Operational Excellence/Query Samples. Adapted from operational excellence and Intune diagnostic query themes.