Intune-DeviceIntent
| Event | Sample | Rule |
|---|---|---|
| DeviceIntent (catch-all) | N | N |
| Create | N | N |
| Delete | N | N |
| Patch | N | N |
| Action | N | N |
| SetReference | N | N |
| RemoveReference | N | N |
any: DeviceIntent (catch-all)
#Description
Synthetic aggregation for Intune audit rules that filter the DeviceIntent category without a specific activityType. Not a distinct audit record.
Fields #
| Name | Description |
|---|---|
activity Edm.String | Friendly name of the activity. |
activityDateTime Edm.DateTimeOffset | The date time in UTC when the activity was performed. |
activityOperationType Edm.String | The HTTP operation type of the activity. |
activityResult Edm.String | The result of the activity. |
activityType Edm.String | The type of activity that was being performed. |
actor graph.auditActor | AAD user and application that are associated with the audit event. |
category Edm.String | Audit category. |
componentName Edm.String | Component name. |
correlationId Edm.Guid | The client request Id that is used to correlate activity within the system. |
displayName Edm.String | Event display name. |
resources Collection(graph.auditResource) | Resources being modified. |
Create
#Description
Generic 'Create' activityOperationType recorded in the Intune DeviceIntent audit category. The specific Graph `activityType` name (what was actually done) has no documented enum and is capture-gated; enumerate real values via getAuditActivityTypes('DeviceIntent').
Fields #
| Name | Description |
|---|---|
activity Edm.String | Friendly name of the activity. |
activityDateTime Edm.DateTimeOffset | The date time in UTC when the activity was performed. |
activityOperationType Edm.String | The HTTP operation type of the activity. |
activityResult Edm.String | The result of the activity. |
activityType Edm.String | The type of activity that was being performed. |
actor graph.auditActor | AAD user and application that are associated with the audit event. |
category Edm.String | Audit category. |
componentName Edm.String | Component name. |
correlationId Edm.Guid | The client request Id that is used to correlate activity within the system. |
displayName Edm.String | Event display name. |
resources Collection(graph.auditResource) | Resources being modified. |
Delete
#Description
Generic 'Delete' activityOperationType recorded in the Intune DeviceIntent audit category. The specific Graph `activityType` name (what was actually done) has no documented enum and is capture-gated; enumerate real values via getAuditActivityTypes('DeviceIntent').
Fields #
| Name | Description |
|---|---|
activity Edm.String | Friendly name of the activity. |
activityDateTime Edm.DateTimeOffset | The date time in UTC when the activity was performed. |
activityOperationType Edm.String | The HTTP operation type of the activity. |
activityResult Edm.String | The result of the activity. |
activityType Edm.String | The type of activity that was being performed. |
actor graph.auditActor | AAD user and application that are associated with the audit event. |
category Edm.String | Audit category. |
componentName Edm.String | Component name. |
correlationId Edm.Guid | The client request Id that is used to correlate activity within the system. |
displayName Edm.String | Event display name. |
resources Collection(graph.auditResource) | Resources being modified. |
Patch
#Description
Generic 'Patch' activityOperationType recorded in the Intune DeviceIntent audit category. The specific Graph `activityType` name (what was actually done) has no documented enum and is capture-gated; enumerate real values via getAuditActivityTypes('DeviceIntent').
Fields #
| Name | Description |
|---|---|
activity Edm.String | Friendly name of the activity. |
activityDateTime Edm.DateTimeOffset | The date time in UTC when the activity was performed. |
activityOperationType Edm.String | The HTTP operation type of the activity. |
activityResult Edm.String | The result of the activity. |
activityType Edm.String | The type of activity that was being performed. |
actor graph.auditActor | AAD user and application that are associated with the audit event. |
category Edm.String | Audit category. |
componentName Edm.String | Component name. |
correlationId Edm.Guid | The client request Id that is used to correlate activity within the system. |
displayName Edm.String | Event display name. |
resources Collection(graph.auditResource) | Resources being modified. |
Action
#Description
Generic 'Action' activityOperationType recorded in the Intune DeviceIntent audit category. The specific Graph `activityType` name (what was actually done) has no documented enum and is capture-gated; enumerate real values via getAuditActivityTypes('DeviceIntent').
Fields #
| Name | Description |
|---|---|
activity Edm.String | Friendly name of the activity. |
activityDateTime Edm.DateTimeOffset | The date time in UTC when the activity was performed. |
activityOperationType Edm.String | The HTTP operation type of the activity. |
activityResult Edm.String | The result of the activity. |
activityType Edm.String | The type of activity that was being performed. |
actor graph.auditActor | AAD user and application that are associated with the audit event. |
category Edm.String | Audit category. |
componentName Edm.String | Component name. |
correlationId Edm.Guid | The client request Id that is used to correlate activity within the system. |
displayName Edm.String | Event display name. |
resources Collection(graph.auditResource) | Resources being modified. |
SetReference
#Description
Generic 'SetReference' activityOperationType recorded in the Intune DeviceIntent audit category. The specific Graph `activityType` name (what was actually done) has no documented enum and is capture-gated; enumerate real values via getAuditActivityTypes('DeviceIntent').
Fields #
| Name | Description |
|---|---|
activity Edm.String | Friendly name of the activity. |
activityDateTime Edm.DateTimeOffset | The date time in UTC when the activity was performed. |
activityOperationType Edm.String | The HTTP operation type of the activity. |
activityResult Edm.String | The result of the activity. |
activityType Edm.String | The type of activity that was being performed. |
actor graph.auditActor | AAD user and application that are associated with the audit event. |
category Edm.String | Audit category. |
componentName Edm.String | Component name. |
correlationId Edm.Guid | The client request Id that is used to correlate activity within the system. |
displayName Edm.String | Event display name. |
resources Collection(graph.auditResource) | Resources being modified. |
RemoveReference
#Description
Generic 'RemoveReference' activityOperationType recorded in the Intune DeviceIntent audit category. The specific Graph `activityType` name (what was actually done) has no documented enum and is capture-gated; enumerate real values via getAuditActivityTypes('DeviceIntent').
Fields #
| Name | Description |
|---|---|
activity Edm.String | Friendly name of the activity. |
activityDateTime Edm.DateTimeOffset | The date time in UTC when the activity was performed. |
activityOperationType Edm.String | The HTTP operation type of the activity. |
activityResult Edm.String | The result of the activity. |
activityType Edm.String | The type of activity that was being performed. |
actor graph.auditActor | AAD user and application that are associated with the audit event. |
category Edm.String | Audit category. |
componentName Edm.String | Component name. |
correlationId Edm.Guid | The client request Id that is used to correlate activity within the system. |
displayName Edm.String | Event display name. |
resources Collection(graph.auditResource) | Resources being modified. |