detection.wiki

Intune-AssignmentFilter

EventSampleRule
AssignmentFilter (catch-all)NN
Create DeviceAndAppManagementAssignmentFilterYN
Delete DeviceAndAppManagementAssignmentFilterYN

any: AssignmentFilter (catch-all)

#

Description

Synthetic aggregation for Intune audit rules that filter the AssignmentFilter category without a specific activityType. Not a distinct audit record.

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Create DeviceAndAppManagementAssignmentFilter

#

Description

Create AssignmentFilter.

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Example Audit Record #

{
  "id": "9c9e9b71-8248-4328-9332-e86ef4cfb547",
  "displayName": "Create AssignmentFilter.",
  "componentName": "AssignmentFilter",
  "activity": null,
  "activityDateTime": "2026-07-04T16:16:08.834677Z",
  "activityType": "Create DeviceAndAppManagementAssignmentFilter",
  "activityOperationType": "Create",
  "activityResult": "Success",
  "correlationId": "f54bf603-3d3d-47cd-aa72-a8a6d13d9689",
  "category": "AssignmentFilter",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-f61e6487",
      "auditResourceType": "DeviceAndAppManagementAssignmentFilter",
      "resourceId": "cddea21d-51ec-41a0-91f1-f540512aadc9",
      "modifiedProperties": [
        {
          "displayName": "Id",
          "oldValue": null,
          "newValue": "cddea21d-51ec-41a0-91f1-f540512aadc9"
        },
        {
          "displayName": "CreatedDateTime",
          "oldValue": null,
          "newValue": "7/4/2026 4:16:08 PM"
        },
        {
          "displayName": "LastModifiedDateTime",
          "oldValue": null,
          "newValue": "7/4/2026 4:16:08 PM"
        },
        {
          "displayName": "Description",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "Platform",
          "oldValue": null,
          "newValue": "Windows10AndLater"
        },
        {
          "displayName": "Rule",
          "oldValue": null,
          "newValue": "(device.manufacturer -eq \"Contoso\")"
        },
        {
          "displayName": "AssignmentFilterManagementType",
          "oldValue": null,
          "newValue": "Devices"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "5024-01-09"
        },
        {
          "displayName": "$Collection.RoleScopeTags[0]",
          "oldValue": null,
          "newValue": "0"
        }
      ]
    }
  ]
}

Delete DeviceAndAppManagementAssignmentFilter

#

Description

Delete AssignmentFilter.

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Example Audit Record #

{
  "id": "5e05634b-3eb3-49d9-83ee-8e077aa3c74a",
  "displayName": "Delete AssignmentFilter.",
  "componentName": "AssignmentFilter",
  "activity": null,
  "activityDateTime": "2026-07-04T16:16:09.8234456Z",
  "activityType": "Delete DeviceAndAppManagementAssignmentFilter",
  "activityOperationType": "Delete",
  "activityResult": "Success",
  "correlationId": "0064bb5b-3395-4e36-9e31-2051a595aa3a",
  "category": "AssignmentFilter",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-f61e6487",
      "auditResourceType": "DeviceAndAppManagementAssignmentFilter",
      "resourceId": "cddea21d-51ec-41a0-91f1-f540512aadc9",
      "modifiedProperties": [
        {
          "displayName": "Id",
          "oldValue": "cddea21d-51ec-41a0-91f1-f540512aadc9",
          "newValue": "<null>"
        },
        {
          "displayName": "CreatedDateTime",
          "oldValue": "7/4/2026 4:16:08 PM",
          "newValue": "<null>"
        },
        {
          "displayName": "LastModifiedDateTime",
          "oldValue": "7/4/2026 4:16:08 PM",
          "newValue": "<null>"
        },
        {
          "displayName": "Description",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "Platform",
          "oldValue": "Windows10AndLater",
          "newValue": "<null>"
        },
        {
          "displayName": "Rule",
          "oldValue": "(device.manufacturer -eq \"Contoso\")",
          "newValue": "<null>"
        },
        {
          "displayName": "AssignmentFilterManagementType",
          "oldValue": "Devices",
          "newValue": "<null>"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "5024-01-09"
        },
        {
          "displayName": "$Collection.RoleScopeTags[0]",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "$Collection.RoleScopeTags[1]",
          "oldValue": "0",
          "newValue": null
        }
      ]
    }
  ]
}

References #