Intune-DeviceConfiguration

Event	Sample	Rule
DeviceConfiguration (catch-all)	N	N
Create DeviceConfiguration	Y	N
Delete DeviceConfiguration	Y	N
Create GroupPolicyConfiguration	Y	N
Delete GroupPolicyConfiguration	Y	N
Create DeviceManagementConfigurationPolicy	Y	Y
Delete DeviceManagementConfigurationPolicy	Y	Y

any: DeviceConfiguration (catch-all)

Description

Synthetic aggregation for Intune audit rules that filter the DeviceConfiguration category without a specific activityType. Not a distinct audit record.

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Create DeviceConfiguration

Description

Create device configuration.

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Example Audit Record #

{
  "id": "8e1861fb-c59f-4647-9355-851903bd7b06",
  "displayName": "Create device configuration.",
  "componentName": "DeviceConfiguration",
  "activity": null,
  "activityDateTime": "2026-07-04T16:16:05.1560509Z",
  "activityType": "Create DeviceConfiguration",
  "activityOperationType": "Create",
  "activityResult": "Success",
  "correlationId": "20a6e621-983b-4879-a5b9-80109432c186",
  "category": "DeviceConfiguration",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-f61e6487",
      "auditResourceType": "Windows10GeneralConfiguration",
      "resourceId": "22fd7cd9-cadc-4e2a-b7e6-560ee58f0f78",
      "modifiedProperties": [
        {
          "displayName": "NetworkProxyApplySettingsDeviceWide",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "NetworkProxyDisableAutoDetect",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "NetworkProxyAutomaticConfigurationUrl",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "PersonalizationDesktopImageUrl",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "PersonalizationLockScreenImageUrl",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "BluetoothBlockAdvertising",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "BluetoothBlockDiscoverableMode",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "BluetoothBlockPrePairing",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeBlockAutofill",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeCookiePolicy",
          "oldValue": null,
          "newValue": "UserDefined"
        },
        {
          "displayName": "EdgeBlockDeveloperTools",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeBlockSendingDoNotTrackHeader",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeBlockExtensions",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeBlockInPrivateBrowsing",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeBlockJavaScript",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeBlockPasswordManager",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeBlockAddressBarDropdown",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeBlockCompatibilityList",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeClearBrowsingDataOnExit",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeAllowStartPagesModification",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeDisableFirstRunPage",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeBlockLiveTileDataCollection",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeSyncFavoritesWithInternetExplorer",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "CellularBlockDataWhenRoaming",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "CellularBlockVpn",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "CellularBlockVpnWhenRoaming",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DefenderRequireRealTimeMonitoring",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DefenderRequireBehaviorMonitoring",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DefenderRequireNetworkInspectionSystem",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DefenderScanDownloads",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DefenderScanScriptsLoadedInInternetExplorer",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DefenderBlockEndUserAccess",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DefenderSignatureUpdateIntervalInHours",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderMonitorFileActivity",
          "oldValue": null,
          "newValue": "UserDefined"
        },
        {
          "displayName": "DefenderDaysBeforeDeletingQuarantinedMalware",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderScanMaxCpu",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderScanArchiveFiles",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DefenderScanIncomingMail",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DefenderScanRemovableDrivesDuringFullScan",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DefenderScanMappedNetworkDrivesDuringFullScan",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DefenderScanNetworkFiles",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DefenderRequireCloudProtection",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DefenderCloudBlockLevel",
          "oldValue": null,
          "newValue": "NotConfigured"
        },
        {
          "displayName": "DefenderPromptForSampleSubmission",
          "oldValue": null,
          "newValue": "UserDefined"
        },
        {
          "displayName": "DefenderScanType",
          "oldValue": null,
          "newValue": "UserDefined"
        },
        {
          "displayName": "DefenderSystemScanSchedule",
          "oldValue": null,
          "newValue": "UserDefined"
        },
        {
          "displayName": "EnterpriseCloudPrintDiscoveryEndPoint",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "EnterpriseCloudPrintOAuthAuthority",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "EnterpriseCloudPrintOAuthClientIdentifier",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "EnterpriseCloudPrintResourceIdentifier",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "EnterpriseCloudPrintDiscoveryMaxLimit",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "EnterpriseCloudPrintMopriaDiscoveryResourceIdentifier",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "LockScreenAllowTimeoutConfiguration",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "LockScreenBlockActionCenterNotifications",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "LockScreenBlockCortana",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "LockScreenBlockToastNotifications",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "LockScreenTimeoutInSeconds",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordBlockSimple",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "PasswordExpirationDays",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordMinimumLength",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordMinutesOfInactivityBeforeScreenTimeout",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordMinimumCharacterSetCount",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordPreviousPasswordBlockCount",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordRequired",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "PasswordRequireWhenResumeFromIdleState",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "PasswordRequiredType",
          "oldValue": null,
          "newValue": "DeviceDefault"
        },
        {
          "displayName": "PasswordSignInFailureCountBeforeFactoryReset",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "PrivacyAdvertisingId",
          "oldValue": null,
          "newValue": "NotConfigured"
        },
        {
          "displayName": "PrivacyAutoAcceptPairingAndConsentPrompts",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "PrivacyBlockInputPersonalization",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SearchBlockDiacritics",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SearchDisableAutoLanguageDetection",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SearchDisableIndexingEncryptedItems",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SearchEnableRemoteQueries",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SearchDisableIndexerBackoff",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SearchDisableIndexingRemovableDrive",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SearchEnableAutomaticIndexSizeManangement",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockSettingsApp",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockSystemPage",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockDevicesPage",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockNetworkInternetPage",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockPersonalizationPage",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockAccountsPage",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockTimeLanguagePage",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockEaseOfAccessPage",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockPrivacyPage",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockUpdateSecurityPage",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockAppsPage",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockGamingPage",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SmartScreenEnableAppInstallControl",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StartBlockUnpinningAppsFromTaskbar",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StartMenuAppListVisibility",
          "oldValue": null,
          "newValue": "UserDefined"
        },
        {
          "displayName": "StartMenuHideChangeAccountSettings",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StartMenuHideFrequentlyUsedApps",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StartMenuHideHibernate",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StartMenuHideLock",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StartMenuHidePowerButton",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StartMenuHideRecentJumpLists",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StartMenuHideRecentlyAddedApps",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StartMenuHideRestartOptions",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StartMenuHideShutDown",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StartMenuHideSignOut",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StartMenuHideSleep",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StartMenuHideSwitchAccount",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StartMenuHideUserTile",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StartMenuMode",
          "oldValue": null,
          "newValue": "UserDefined"
        },
        {
          "displayName": "StartMenuPinnedFolderDocuments",
          "oldValue": null,
          "newValue": "NotConfigured"
        },
        {
          "displayName": "StartMenuPinnedFolderDownloads",
          "oldValue": null,
          "newValue": "NotConfigured"
        },
        {
          "displayName": "StartMenuPinnedFolderFileExplorer",
          "oldValue": null,
          "newValue": "NotConfigured"
        },
        {
          "displayName": "StartMenuPinnedFolderHomeGroup",
          "oldValue": null,
          "newValue": "NotConfigured"
        },
        {
          "displayName": "StartMenuPinnedFolderMusic",
          "oldValue": null,
          "newValue": "NotConfigured"
        },
        {
          "displayName": "StartMenuPinnedFolderNetwork",
          "oldValue": null,
          "newValue": "NotConfigured"
        },
        {
          "displayName": "StartMenuPinnedFolderPersonalFolder",
          "oldValue": null,
          "newValue": "NotConfigured"
        },
        {
          "displayName": "StartMenuPinnedFolderPictures",
          "oldValue": null,
          "newValue": "NotConfigured"
        },
        {
          "displayName": "StartMenuPinnedFolderSettings",
          "oldValue": null,
          "newValue": "NotConfigured"
        },
        {
          "displayName": "StartMenuPinnedFolderVideos",
          "oldValue": null,
          "newValue": "NotConfigured"
        },
        {
          "displayName": "DiagnosticsDataSubmissionMode",
          "oldValue": null,
          "newValue": "UserDefined"
        },
        {
          "displayName": "OneDriveDisableFileSync",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WindowsSpotlightBlockConsumerSpecificFeatures",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WindowsSpotlightBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WindowsSpotlightBlockOnActionCenter",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WindowsSpotlightBlockTailoredExperiences",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WindowsSpotlightBlockThirdPartyNotifications",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WindowsSpotlightBlockWelcomeExperience",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WindowsSpotlightBlockWindowsTips",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WindowsSpotlightConfigureOnLockScreen",
          "oldValue": null,
          "newValue": "NotConfigured"
        },
        {
          "displayName": "AccountsBlockAddingNonMicrosoftAccountEmail",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "AntiTheftModeBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "BluetoothBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "CameraBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "ConnectedDevicesServiceBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "CertificatesBlockManualRootCertificateInstallation",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "CopyPasteBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "CortanaBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DeviceManagementBlockFactoryResetOnMobile",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DeviceManagementBlockManualUnenroll",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SafeSearchFilter",
          "oldValue": null,
          "newValue": "UserDefined"
        },
        {
          "displayName": "EdgeBlockPopups",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeBlockSearchSuggestions",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeBlockSendingIntranetTrafficToInternetExplorer",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeSendIntranetTrafficToInternetExplorer",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeRequireSmartScreen",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "EdgeEnterpriseModeSiteListLocation",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeFirstRunUrl",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeBlockAccessToAboutFlags",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SmartScreenBlockPromptOverride",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SmartScreenBlockPromptOverrideForFiles",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WebRtcBlockLocalhostIpAddress",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "InternetSharingBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockAddProvisioningPackage",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockRemoveProvisioningPackage",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockChangeSystemTime",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockEditDeviceName",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockChangeRegion",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockChangeLanguage",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "SettingsBlockChangePowerSleep",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "LocationServicesBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "MicrosoftAccountBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "MicrosoftAccountBlockSettingsSync",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "NfcBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "ResetProtectionModeBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "ScreenCaptureBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StorageBlockRemovableStorage",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StorageRequireMobileDeviceEncryption",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "UsbBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "VoiceRecordingBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WiFiBlockAutomaticConnectHotspots",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WiFiBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WiFiBlockManualConfiguration",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WiFiScanInterval",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "WirelessDisplayBlockProjectionToThisDevice",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WirelessDisplayBlockUserInputFromReceiver",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WirelessDisplayRequirePinForPairing",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WindowsStoreBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "AppsAllowTrustedAppsSideloading",
          "oldValue": null,
          "newValue": "NotConfigured"
        },
        {
          "displayName": "WindowsStoreBlockAutoUpdate",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DeveloperUnlockSetting",
          "oldValue": null,
          "newValue": "NotConfigured"
        },
        {
          "displayName": "SharedUserAppDataAllowed",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "AppsBlockWindowsStoreOriginatedApps",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "WindowsStoreEnablePrivateStoreOnly",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StorageRestrictAppDataToSystemVolume",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "StorageRestrictAppInstallToSystemVolume",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "GameDvrBlocked",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "ExperienceBlockDeviceDiscovery",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "ExperienceBlockErrorDialogWhenNoSIM",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "ExperienceBlockTaskSwitcher",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "LogonBlockFastUserSwitching",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "TenantLockdownRequireNetworkDuringOutOfBoxExperience",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "Id",
          "oldValue": null,
          "newValue": "22fd7cd9-cadc-4e2a-b7e6-560ee58f0f78"
        },
        {
          "displayName": "LastModifiedDateTime",
          "oldValue": null,
          "newValue": "7/4/2026 4:16:05 PM"
        },
        {
          "displayName": "CreatedDateTime",
          "oldValue": null,
          "newValue": "7/4/2026 4:16:05 PM"
        },
        {
          "displayName": "Description",
          "oldValue": null,
          "newValue": "detection.wiki intune harness"
        },
        {
          "displayName": "Version",
          "oldValue": null,
          "newValue": "1"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "2022-06-13"
        }
      ]
    }
  ]
}

Delete DeviceConfiguration

Description

Delete device configuration.

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Example Audit Record #

{
  "id": "cdcf6cd7-8e87-4615-80e6-6b5f030984c7",
  "displayName": "Delete device configuration.",
  "componentName": "DeviceConfiguration",
  "activity": null,
  "activityDateTime": "2026-07-04T16:16:06.0054382Z",
  "activityType": "Delete DeviceConfiguration",
  "activityOperationType": "Delete",
  "activityResult": "Success",
  "correlationId": "7ff2f88c-2a4f-4120-8f9c-6c7c19c09711",
  "category": "DeviceConfiguration",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-f61e6487",
      "auditResourceType": "Windows10GeneralConfiguration",
      "resourceId": "22fd7cd9-cadc-4e2a-b7e6-560ee58f0f78",
      "modifiedProperties": [
        {
          "displayName": "assignments",
          "oldValue": null,
          "newValue": ""
        },
        {
          "displayName": "NetworkProxyApplySettingsDeviceWide",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "NetworkProxyDisableAutoDetect",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "NetworkProxyAutomaticConfigurationUrl",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "PersonalizationDesktopImageUrl",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "PersonalizationLockScreenImageUrl",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "BluetoothBlockAdvertising",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "BluetoothBlockDiscoverableMode",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "BluetoothBlockPrePairing",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeBlockAutofill",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeCookiePolicy",
          "oldValue": "UserDefined",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeBlockDeveloperTools",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeBlockSendingDoNotTrackHeader",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeBlockExtensions",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeBlockInPrivateBrowsing",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeBlockJavaScript",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeBlockPasswordManager",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeBlockAddressBarDropdown",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeBlockCompatibilityList",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeClearBrowsingDataOnExit",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeAllowStartPagesModification",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeDisableFirstRunPage",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeBlockLiveTileDataCollection",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeSyncFavoritesWithInternetExplorer",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "CellularBlockDataWhenRoaming",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "CellularBlockVpn",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "CellularBlockVpnWhenRoaming",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderRequireRealTimeMonitoring",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderRequireBehaviorMonitoring",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderRequireNetworkInspectionSystem",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderScanDownloads",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderScanScriptsLoadedInInternetExplorer",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderBlockEndUserAccess",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderSignatureUpdateIntervalInHours",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderMonitorFileActivity",
          "oldValue": "UserDefined",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderDaysBeforeDeletingQuarantinedMalware",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderScanMaxCpu",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderScanArchiveFiles",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderScanIncomingMail",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderScanRemovableDrivesDuringFullScan",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderScanMappedNetworkDrivesDuringFullScan",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderScanNetworkFiles",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderRequireCloudProtection",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderCloudBlockLevel",
          "oldValue": "NotConfigured",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderPromptForSampleSubmission",
          "oldValue": "UserDefined",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderScanType",
          "oldValue": "UserDefined",
          "newValue": "<null>"
        },
        {
          "displayName": "DefenderSystemScanSchedule",
          "oldValue": "UserDefined",
          "newValue": "<null>"
        },
        {
          "displayName": "EnterpriseCloudPrintDiscoveryEndPoint",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "EnterpriseCloudPrintOAuthAuthority",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "EnterpriseCloudPrintOAuthClientIdentifier",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "EnterpriseCloudPrintResourceIdentifier",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "EnterpriseCloudPrintDiscoveryMaxLimit",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "EnterpriseCloudPrintMopriaDiscoveryResourceIdentifier",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "LockScreenAllowTimeoutConfiguration",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "LockScreenBlockActionCenterNotifications",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "LockScreenBlockCortana",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "LockScreenBlockToastNotifications",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "LockScreenTimeoutInSeconds",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordBlockSimple",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordExpirationDays",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordMinimumLength",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordMinutesOfInactivityBeforeScreenTimeout",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordMinimumCharacterSetCount",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordPreviousPasswordBlockCount",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordRequired",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordRequireWhenResumeFromIdleState",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordRequiredType",
          "oldValue": "DeviceDefault",
          "newValue": "<null>"
        },
        {
          "displayName": "PasswordSignInFailureCountBeforeFactoryReset",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "PrivacyAdvertisingId",
          "oldValue": "NotConfigured",
          "newValue": "<null>"
        },
        {
          "displayName": "PrivacyAutoAcceptPairingAndConsentPrompts",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "PrivacyBlockInputPersonalization",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SearchBlockDiacritics",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SearchDisableAutoLanguageDetection",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SearchDisableIndexingEncryptedItems",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SearchEnableRemoteQueries",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SearchDisableIndexerBackoff",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SearchDisableIndexingRemovableDrive",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SearchEnableAutomaticIndexSizeManangement",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockSettingsApp",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockSystemPage",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockDevicesPage",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockNetworkInternetPage",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockPersonalizationPage",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockAccountsPage",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockTimeLanguagePage",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockEaseOfAccessPage",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockPrivacyPage",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockUpdateSecurityPage",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockAppsPage",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockGamingPage",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SmartScreenEnableAppInstallControl",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StartBlockUnpinningAppsFromTaskbar",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuAppListVisibility",
          "oldValue": "UserDefined",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuHideChangeAccountSettings",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuHideFrequentlyUsedApps",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuHideHibernate",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuHideLock",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuHidePowerButton",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuHideRecentJumpLists",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuHideRecentlyAddedApps",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuHideRestartOptions",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuHideShutDown",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuHideSignOut",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuHideSleep",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuHideSwitchAccount",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuHideUserTile",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuMode",
          "oldValue": "UserDefined",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuPinnedFolderDocuments",
          "oldValue": "NotConfigured",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuPinnedFolderDownloads",
          "oldValue": "NotConfigured",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuPinnedFolderFileExplorer",
          "oldValue": "NotConfigured",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuPinnedFolderHomeGroup",
          "oldValue": "NotConfigured",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuPinnedFolderMusic",
          "oldValue": "NotConfigured",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuPinnedFolderNetwork",
          "oldValue": "NotConfigured",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuPinnedFolderPersonalFolder",
          "oldValue": "NotConfigured",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuPinnedFolderPictures",
          "oldValue": "NotConfigured",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuPinnedFolderSettings",
          "oldValue": "NotConfigured",
          "newValue": "<null>"
        },
        {
          "displayName": "StartMenuPinnedFolderVideos",
          "oldValue": "NotConfigured",
          "newValue": "<null>"
        },
        {
          "displayName": "DiagnosticsDataSubmissionMode",
          "oldValue": "UserDefined",
          "newValue": "<null>"
        },
        {
          "displayName": "OneDriveDisableFileSync",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "WindowsSpotlightBlockConsumerSpecificFeatures",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "WindowsSpotlightBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "WindowsSpotlightBlockOnActionCenter",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "WindowsSpotlightBlockTailoredExperiences",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "WindowsSpotlightBlockThirdPartyNotifications",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "WindowsSpotlightBlockWelcomeExperience",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "WindowsSpotlightBlockWindowsTips",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "WindowsSpotlightConfigureOnLockScreen",
          "oldValue": "NotConfigured",
          "newValue": "<null>"
        },
        {
          "displayName": "AccountsBlockAddingNonMicrosoftAccountEmail",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "AntiTheftModeBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "BluetoothBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "CameraBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "ConnectedDevicesServiceBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "CertificatesBlockManualRootCertificateInstallation",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "CopyPasteBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "CortanaBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "DeviceManagementBlockFactoryResetOnMobile",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "DeviceManagementBlockManualUnenroll",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SafeSearchFilter",
          "oldValue": "UserDefined",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeBlockPopups",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeBlockSearchSuggestions",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeBlockSendingIntranetTrafficToInternetExplorer",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeSendIntranetTrafficToInternetExplorer",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeRequireSmartScreen",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeEnterpriseModeSiteListLocation",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeFirstRunUrl",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "EdgeBlockAccessToAboutFlags",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SmartScreenBlockPromptOverride",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SmartScreenBlockPromptOverrideForFiles",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "WebRtcBlockLocalhostIpAddress",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "InternetSharingBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockAddProvisioningPackage",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockRemoveProvisioningPackage",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockChangeSystemTime",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockEditDeviceName",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockChangeRegion",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockChangeLanguage",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingsBlockChangePowerSleep",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "LocationServicesBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "MicrosoftAccountBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "MicrosoftAccountBlockSettingsSync",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "NfcBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "ResetProtectionModeBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "ScreenCaptureBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StorageBlockRemovableStorage",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StorageRequireMobileDeviceEncryption",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "UsbBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "VoiceRecordingBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "WiFiBlockAutomaticConnectHotspots",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "WiFiBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "WiFiBlockManualConfiguration",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "WiFiScanInterval",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "WirelessDisplayBlockProjectionToThisDevice",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "WirelessDisplayBlockUserInputFromReceiver",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "WirelessDisplayRequirePinForPairing",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "WindowsStoreBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "AppsAllowTrustedAppsSideloading",
          "oldValue": "NotConfigured",
          "newValue": "<null>"
        },
        {
          "displayName": "WindowsStoreBlockAutoUpdate",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "DeveloperUnlockSetting",
          "oldValue": "NotConfigured",
          "newValue": "<null>"
        },
        {
          "displayName": "SharedUserAppDataAllowed",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "AppsBlockWindowsStoreOriginatedApps",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "WindowsStoreEnablePrivateStoreOnly",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StorageRestrictAppDataToSystemVolume",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "StorageRestrictAppInstallToSystemVolume",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "GameDvrBlocked",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "ExperienceBlockDeviceDiscovery",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "ExperienceBlockErrorDialogWhenNoSIM",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "ExperienceBlockTaskSwitcher",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "LogonBlockFastUserSwitching",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "TenantLockdownRequireNetworkDuringOutOfBoxExperience",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "Id",
          "oldValue": "22fd7cd9-cadc-4e2a-b7e6-560ee58f0f78",
          "newValue": "<null>"
        },
        {
          "displayName": "LastModifiedDateTime",
          "oldValue": "7/4/2026 4:16:05 PM",
          "newValue": "<null>"
        },
        {
          "displayName": "CreatedDateTime",
          "oldValue": "7/4/2026 4:16:05 PM",
          "newValue": "<null>"
        },
        {
          "displayName": "Description",
          "oldValue": "detection.wiki intune harness",
          "newValue": "<null>"
        },
        {
          "displayName": "Version",
          "oldValue": "1",
          "newValue": "<null>"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "2022-06-13"
        }
      ]
    }
  ]
}

Create GroupPolicyConfiguration

Description

Created a group policy configuration.

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Example Audit Record #

{
  "id": "b42c6f21-193b-485c-a071-5e273b1a764f",
  "displayName": "Created a group policy configuration.",
  "componentName": "DeviceConfiguration",
  "activity": null,
  "activityDateTime": "2026-07-04T18:25:07.5042348Z",
  "activityType": "Create GroupPolicyConfiguration",
  "activityOperationType": "Create",
  "activityResult": "Success",
  "correlationId": "bc972396-4ff5-407a-b28c-964982f941b5",
  "category": "DeviceConfiguration",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-a9779b97",
      "auditResourceType": "GroupPolicyConfiguration",
      "resourceId": "a06b2430-8836-416b-9183-ac10a3cf90f5",
      "modifiedProperties": [
        {
          "displayName": "Description",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "PolicyConfigurationIngestionType",
          "oldValue": null,
          "newValue": "Unknown"
        },
        {
          "displayName": "Id",
          "oldValue": null,
          "newValue": "a06b2430-8836-416b-9183-ac10a3cf90f5"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "5018-11-06"
        },
        {
          "displayName": "$Collection.RoleScopeTagIds[0]",
          "oldValue": null,
          "newValue": "Default"
        }
      ]
    }
  ]
}

Delete GroupPolicyConfiguration

Description

Deleted a group policy configuration.

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Example Audit Record #

{
  "id": "e0ecf92a-a333-4b55-a1b6-e504304a10d1",
  "displayName": "Deleted a group policy configuration.",
  "componentName": "DeviceConfiguration",
  "activity": null,
  "activityDateTime": "2026-07-04T18:25:08.6164006Z",
  "activityType": "Delete GroupPolicyConfiguration",
  "activityOperationType": "Delete",
  "activityResult": "Success",
  "correlationId": "78a80962-88d8-4f58-abd0-5ced23aed7ab",
  "category": "DeviceConfiguration",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-a9779b97",
      "auditResourceType": "GroupPolicyConfiguration",
      "resourceId": "a06b2430-8836-416b-9183-ac10a3cf90f5",
      "modifiedProperties": [
        {
          "displayName": "Description",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "PolicyConfigurationIngestionType",
          "oldValue": "Unknown",
          "newValue": "<null>"
        },
        {
          "displayName": "Id",
          "oldValue": "a06b2430-8836-416b-9183-ac10a3cf90f5",
          "newValue": "<null>"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "5018-11-06"
        },
        {
          "displayName": "$Collection.RoleScopeTagIds[0]",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "$Collection.RoleScopeTagIds[1]",
          "oldValue": "Default",
          "newValue": null
        }
      ]
    }
  ]
}

Create DeviceManagementConfigurationPolicy

Description

Create device configuration 2.0 (beta)

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Example Audit Record #

{
  "id": "9979abc4-b453-4ec8-9ce3-cbd67c589c99",
  "displayName": "Create device configuration 2.0 (beta)",
  "componentName": "DeviceConfiguration",
  "activity": null,
  "activityDateTime": "2026-07-04T19:03:10.5188017Z",
  "activityType": "Create DeviceManagementConfigurationPolicy",
  "activityOperationType": "Create",
  "activityResult": "Success",
  "correlationId": "58224643-b123-45d8-9708-add003770399",
  "category": "DeviceConfiguration",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-e40c500f",
      "auditResourceType": "DeviceManagementConfigurationPolicy",
      "resourceId": "43860c0d-9126-459b-9299-7b9e26c2604d",
      "modifiedProperties": [
        {
          "displayName": "Name",
          "oldValue": null,
          "newValue": "dwharn-e40c500f"
        },
        {
          "displayName": "Description",
          "oldValue": null,
          "newValue": ""
        },
        {
          "displayName": "Platforms",
          "oldValue": null,
          "newValue": "Windows10"
        },
        {
          "displayName": "SettingCount",
          "oldValue": null,
          "newValue": "1"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "5026-04-28"
        }
      ]
    }
  ]
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

Microsoft Intune DeviceManagementConfigurationPolicies source: Microsoft Intune device management configuration policies are a tool administrators can use to remotely manage policies and settings on intune managed devices. This functionality can also be abused to disable defences & evade detection.…T1021, T1021.007, T1072, T1484, T1685, T1686↳ also matches Delete DeviceManagementConfigurationPolicy

Delete DeviceManagementConfigurationPolicy

Description

Delete device configuration 2.0 (beta)

Fields #

Name	Description
`activity` Edm.String	Friendly name of the activity.
`activityDateTime` Edm.DateTimeOffset	The date time in UTC when the activity was performed.
`activityOperationType` Edm.String	The HTTP operation type of the activity.
`activityResult` Edm.String	The result of the activity.
`activityType` Edm.String	The type of activity that was being performed.
`actor` graph.auditActor	AAD user and application that are associated with the audit event.
`category` Edm.String	Audit category.
`componentName` Edm.String	Component name.
`correlationId` Edm.Guid	The client request Id that is used to correlate activity within the system.
`displayName` Edm.String	Event display name.
`resources` Collection(graph.auditResource)	Resources being modified.

Example Audit Record #

{
  "id": "a6597381-114c-406a-b0c5-9977a3f854a9",
  "displayName": "Delete device configuration 2.0 (beta)",
  "componentName": "DeviceConfiguration",
  "activity": null,
  "activityDateTime": "2026-07-04T19:03:11.1172622Z",
  "activityType": "Delete DeviceManagementConfigurationPolicy",
  "activityOperationType": "Delete",
  "activityResult": "Success",
  "correlationId": "f1d0913f-8b1d-4852-a210-5aeb07e42201",
  "category": "DeviceConfiguration",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "<null>",
      "auditResourceType": "DeviceManagementConfigurationPolicy",
      "resourceId": "43860c0d-9126-459b-9299-7b9e26c2604d",
      "modifiedProperties": [
        {
          "displayName": "Name",
          "oldValue": "dwharn-e40c500f",
          "newValue": "<null>"
        },
        {
          "displayName": "Description",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "Platforms",
          "oldValue": "Windows10",
          "newValue": "<null>"
        },
        {
          "displayName": "SettingCount",
          "oldValue": "1",
          "newValue": "<null>"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "5026-04-28"
        }
      ]
    }
  ]
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

Microsoft Intune DeviceManagementConfigurationPolicies source: Microsoft Intune device management configuration policies are a tool administrators can use to remotely manage policies and settings on intune managed devices. This functionality can also be abused to disable defences & evade detection.…T1021, T1021.007, T1072, T1484, T1685, T1686↳ also matches Create DeviceManagementConfigurationPolicy

Intune-DeviceConfiguration

any: DeviceConfiguration (catch-all)

Description

Fields #

Create DeviceConfiguration

Description

Fields #

Example Audit Record #

Delete DeviceConfiguration

Description

Fields #

Example Audit Record #

Create GroupPolicyConfiguration

Description

Fields #

Example Audit Record #

Delete GroupPolicyConfiguration

Description

Fields #

Example Audit Record #

Create DeviceManagementConfigurationPolicy

Description

Fields #

Example Audit Record #

Detection Rules #

Splunk #

Delete DeviceManagementConfigurationPolicy

Description

Fields #

Example Audit Record #

Detection Rules #

Splunk #

References #