Intune-Compliance

Event	Sample	Rule
Compliance (catch-all)	N	N
Create DeviceCompliancePolicy	Y	N
Create MobileThreatDefenseConnector	Y	N
Delete DeviceCompliancePolicy	Y	N
Create NotificationMessageTemplate	Y	N
Delete NotificationMessageTemplate	Y	N

any: Compliance (catch-all)

Description

Synthetic aggregation for Intune audit rules that filter the Compliance category without a specific activityType. Not a distinct audit record.

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Create DeviceCompliancePolicy

Description

Create Microsoft.Management.Services.Api.Windows10CompliancePolicy

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Example Audit Record #

{
  "id": "8862dba5-18be-418e-885f-aa0978afea07",
  "displayName": "Create Microsoft.Management.Services.Api.Windows10CompliancePolicy",
  "componentName": "DeviceCompliancePolicy",
  "activity": null,
  "activityDateTime": "2026-07-04T16:16:07.0389721Z",
  "activityType": "Create DeviceCompliancePolicy",
  "activityOperationType": "Create",
  "activityResult": "Success",
  "correlationId": "e5a3feef-2ffe-456c-b9e6-8ac21a161e7b",
  "category": "Compliance",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-f61e6487",
      "auditResourceType": "Windows10CompliancePolicy",
      "resourceId": "3c6a95d2-c951-4fe1-a65f-9fad0658fce3",
      "modifiedProperties": [
        {
          "displayName": "PasswordRequired",
          "oldValue": null,
          "newValue": "True"
        },
        {
          "displayName": "PasswordMinimumLength",
          "oldValue": null,
          "newValue": "null"
        },
        {
          "displayName": "OsMaximumVersion",
          "oldValue": null,
          "newValue": "null"
        },
        {
          "displayName": "OsMinimumVersion",
          "oldValue": null,
          "newValue": "null"
        },
        {
          "displayName": "StorageRequireEncryption",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "PasswordBlockSimple",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "PasswordRequiredToUnlockFromIdle",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "PasswordMinutesOfInactivityBeforeLock",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordExpirationDays",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordMinimumCharacterSetCount",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordRequiredType",
          "oldValue": null,
          "newValue": "DeviceDefault"
        },
        {
          "displayName": "PasswordPreviousPasswordBlockCount",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "RequireHealthyDeviceReport",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "MobileOsMinimumVersion",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "MobileOsMaximumVersion",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "EarlyLaunchAntiMalwareDriverEnabled",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "BitLockerEnabled",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SecureBootEnabled",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "CodeIntegrityEnabled",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "Id",
          "oldValue": null,
          "newValue": "3c6a95d2-c951-4fe1-a65f-9fad0658fce3"
        },
        {
          "displayName": "CreatedDateTime",
          "oldValue": null,
          "newValue": "7/4/2026 4:16:06 PM"
        },
        {
          "displayName": "Description",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "LastModifiedDateTime",
          "oldValue": null,
          "newValue": "7/4/2026 4:16:06 PM"
        },
        {
          "displayName": "Version",
          "oldValue": null,
          "newValue": "1"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "2022-06-13"
        }
      ]
    }
  ]
}

Create MobileThreatDefenseConnector

Description

Create Mobile Threat Defense Connector.

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Example Audit Record #

{
  "id": "797e462e-b617-4a9e-a496-f664e5dec661",
  "displayName": "Create Mobile Threat Defense Connector.",
  "componentName": "DeviceConfiguration",
  "activity": null,
  "activityDateTime": "2026-01-17T02:44:12.3778309Z",
  "activityType": "Create MobileThreatDefenseConnector",
  "activityOperationType": "Create",
  "activityResult": "Success",
  "correlationId": "4aa7f0c7-c555-48fd-a2d8-f6a1affc4f15",
  "category": "Compliance",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "5926fc8e-304e-4f59-8bed-58ca97cc39a4",
    "applicationDisplayName": "Microsoft Intune portal extension",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "<null>",
      "auditResourceType": "MobileThreatDefenseConnector",
      "resourceId": "fc780465-2017-40d4-a0c5-307022471b92",
      "modifiedProperties": [
        {
          "displayName": "AndroidEnabled",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "AndroidDeviceBlockedOnMissingPartnerData",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "IosEnabled",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "IosDeviceBlockedOnMissingPartnerData",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WindowsEnabled",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WindowsDeviceBlockedOnMissingPartnerData",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "MacEnabled",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "MacDeviceBlockedOnMissingPartnerData",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "PartnerUnresponsivenessThresholdInDays",
          "oldValue": null,
          "newValue": "7"
        },
        {
          "displayName": "AllowPartnerToCollectIOSApplicationMetadata",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "AndroidMobileApplicationManagementEnabled",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "IosMobileApplicationManagementEnabled",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WindowsMobileApplicationManagementEnabled",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "MicrosoftDefenderForEndpointAttachEnabled",
          "oldValue": null,
          "newValue": "True"
        },
        {
          "displayName": "AllowPartnerToCollectIOSPersonalApplicationMetadata",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "AllowPartnerToCollectIosCertificateMetadata",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "AllowPartnerToCollectIosPersonalCertificateMetadata",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "Id",
          "oldValue": null,
          "newValue": "fc780465-2017-40d4-a0c5-307022471b92"
        },
        {
          "displayName": "LastHeartbeatDateTime",
          "oldValue": null,
          "newValue": "1/1/0001 12:00:00 AM"
        },
        {
          "displayName": "PartnerState",
          "oldValue": null,
          "newValue": "NotSetUp"
        },
        {
          "displayName": "PartnerUnsupportedOsVersionBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "5025-03-20"
        }
      ]
    }
  ]
}

Delete DeviceCompliancePolicy

Description

Delete device compliance policy and associated ScheduledActionForRule.

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Example Audit Record #

{
  "id": "df2f8ca6-ba4b-4b59-8c5b-81fec360473c",
  "displayName": "Delete device compliance policy and associated ScheduledActionForRule.",
  "componentName": "DeviceCompliancePolicy",
  "activity": null,
  "activityDateTime": "2026-07-04T16:16:07.9500142Z",
  "activityType": "Delete DeviceCompliancePolicy",
  "activityOperationType": "Delete",
  "activityResult": "Success",
  "correlationId": "786614dc-d257-4179-ac57-370f79dd0d93",
  "category": "Compliance",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-f61e6487",
      "auditResourceType": "Windows10CompliancePolicy",
      "resourceId": "3c6a95d2-c951-4fe1-a65f-9fad0658fce3",
      "modifiedProperties": [
        {
          "displayName": "PasswordRequired",
          "oldValue": "True",
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordBlockSimple",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordRequiredToUnlockFromIdle",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordMinutesOfInactivityBeforeLock",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordExpirationDays",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordMinimumLength",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordMinimumCharacterSetCount",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordRequiredType",
          "oldValue": "DeviceDefault",
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordPreviousPasswordBlockCount",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "RequireHealthyDeviceReport",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "OsMinimumVersion",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "OsMaximumVersion",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "MobileOsMinimumVersion",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "MobileOsMaximumVersion",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "EarlyLaunchAntiMalwareDriverEnabled",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "BitLockerEnabled",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SecureBootEnabled",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "CodeIntegrityEnabled",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StorageRequireEncryption",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "Id",
          "oldValue": "3c6a95d2-c951-4fe1-a65f-9fad0658fce3",
          "newValue": "<null>"
        },
        {
          "displayName": "CreatedDateTime",
          "oldValue": "7/4/2026 4:16:06 PM",
          "newValue": "<null>"
        },
        {
          "displayName": "Description",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "LastModifiedDateTime",
          "oldValue": "7/4/2026 4:16:06 PM",
          "newValue": "<null>"
        },
        {
          "displayName": "Version",
          "oldValue": "1",
          "newValue": "<null>"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "2022-06-13"
        }
      ]
    }
  ]
}

Create NotificationMessageTemplate

Description

Create notification message template.

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Example Audit Record #

{
  "id": "f31a2e44-6e33-4578-a048-e56ce7d01d96",
  "displayName": "Create notification message template.",
  "componentName": "NotificationMessageTemplate",
  "activity": null,
  "activityDateTime": "2026-07-04T18:25:06.3287058Z",
  "activityType": "Create NotificationMessageTemplate",
  "activityOperationType": "Create",
  "activityResult": "Success",
  "correlationId": "f240bd92-dd5a-4618-baf4-ac47842d6a47",
  "category": "Compliance",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-a9779b97",
      "auditResourceType": "NotificationMessageTemplate",
      "resourceId": "d54b68a1-5f43-49b2-a92f-12f278cd9b4a",
      "modifiedProperties": [
        {
          "displayName": "BrandingOptions",
          "oldValue": null,
          "newValue": "No Branding"
        },
        {
          "displayName": "Id",
          "oldValue": null,
          "newValue": "d54b68a1-5f43-49b2-a92f-12f278cd9b4a"
        },
        {
          "displayName": "LastModifiedDateTime",
          "oldValue": null,
          "newValue": "7/4/2026 6:25:06 PM"
        },
        {
          "displayName": "Description",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "DefaultLocale",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "2023-12-04"
        },
        {
          "displayName": "$Collection.RoleScopeTagIds[0]",
          "oldValue": null,
          "newValue": "Default"
        }
      ]
    }
  ]
}

Delete NotificationMessageTemplate

Description

Delete notification message template.

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Example Audit Record #

{
  "id": "25e25108-bb69-47cd-86cb-e13e655f1dd3",
  "displayName": "Delete notification message template.",
  "componentName": "NotificationMessageTemplate",
  "activity": null,
  "activityDateTime": "2026-07-04T18:25:06.99731Z",
  "activityType": "Delete NotificationMessageTemplate",
  "activityOperationType": "Delete",
  "activityResult": "Success",
  "correlationId": "bf913ed0-8da9-4e05-92dc-a60012a8b8cd",
  "category": "Compliance",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-a9779b97",
      "auditResourceType": "NotificationMessageTemplate",
      "resourceId": "d54b68a1-5f43-49b2-a92f-12f278cd9b4a",
      "modifiedProperties": [
        {
          "displayName": "Id",
          "oldValue": "d54b68a1-5f43-49b2-a92f-12f278cd9b4a",
          "newValue": "<null>"
        },
        {
          "displayName": "LastModifiedDateTime",
          "oldValue": "7/4/2026 6:25:06 PM",
          "newValue": "<null>"
        },
        {
          "displayName": "Description",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "DefaultLocale",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "BrandingOptions",
          "oldValue": "None",
          "newValue": "<null>"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "2023-12-04"
        },
        {
          "displayName": "$Collection.RoleScopeTagIds[0]",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "$Collection.RoleScopeTagIds[1]",
          "oldValue": "Default",
          "newValue": null
        }
      ]
    }
  ]
}

Intune-Compliance

any: Compliance (catch-all)

Description

Fields #

Create DeviceCompliancePolicy

Description

Fields #

Example Audit Record #

Create MobileThreatDefenseConnector

Description

Fields #

Example Audit Record #

Delete DeviceCompliancePolicy

Description

Fields #

Example Audit Record #

Create NotificationMessageTemplate

Description

Fields #

Example Audit Record #

Delete NotificationMessageTemplate

Description

Fields #

Example Audit Record #

References #