detection.wiki

Intune-Enrollment

EventSampleRule
Enrollment (catch-all)NN
Create DeviceCategoryYN
Create DeviceEnrollmentConfigurationYN
DeleteDeviceCategory DeviceCategoryYN
DeleteDeviceEnrollmentLimit DeviceEnrollmentConfigurationYN
Create ClientCertificateYN

any: Enrollment (catch-all)

#

Description

Synthetic aggregation for Intune audit rules that filter the Enrollment category without a specific activityType. Not a distinct audit record.

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Create DeviceCategory

#

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Example Audit Record #

{
  "id": "f61b6043-9571-42b3-941a-24f27dcb032f",
  "displayName": "Create DeviceCategory",
  "componentName": "Enrollment",
  "activity": null,
  "activityDateTime": "2026-07-04T18:40:34.5073289Z",
  "activityType": "Create DeviceCategory",
  "activityOperationType": "Create",
  "activityResult": "Success",
  "correlationId": "c039f8ec-097a-48d2-b72a-48c0d50c80fd",
  "category": "Enrollment",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-2d37281a",
      "auditResourceType": "DeviceCategory",
      "resourceId": "1da388ad-c635-4681-9888-9e874d07ede2",
      "modifiedProperties": [
        {
          "displayName": "Id",
          "oldValue": null,
          "newValue": "1da388ad-c635-4681-9888-9e874d07ede2"
        },
        {
          "displayName": "Description",
          "oldValue": null,
          "newValue": "detection.wiki intune harness"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "2024-10-28"
        }
      ]
    }
  ]
}

Create DeviceEnrollmentConfiguration

#

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Example Audit Record #

{
  "id": "04a53127-561a-4627-aa58-d454803d249a",
  "displayName": "Create DeviceEnrollmentConfiguration",
  "componentName": "Enrollment",
  "activity": null,
  "activityDateTime": "2026-07-04T18:40:36.2836422Z",
  "activityType": "Create DeviceEnrollmentConfiguration",
  "activityOperationType": "Create",
  "activityResult": "Success",
  "correlationId": "657dbd14-2fe7-453c-9255-2bda580a71c5",
  "category": "Enrollment",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-2d37281a",
      "auditResourceType": "DeviceEnrollmentLimitConfiguration",
      "resourceId": "bf174805-7022-4640-be19-5415cbdf1bd8_Limit",
      "modifiedProperties": [
        {
          "displayName": "Id",
          "oldValue": null,
          "newValue": "bf174805-7022-4640-be19-5415cbdf1bd8_Limit"
        },
        {
          "displayName": "Limit",
          "oldValue": null,
          "newValue": "10"
        },
        {
          "displayName": "Description",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "Priority",
          "oldValue": null,
          "newValue": "1"
        },
        {
          "displayName": "CreatedDateTime",
          "oldValue": null,
          "newValue": "7/4/2026 6:40:36 PM"
        },
        {
          "displayName": "LastModifiedDateTime",
          "oldValue": null,
          "newValue": "7/4/2026 6:40:36 PM"
        },
        {
          "displayName": "Version",
          "oldValue": null,
          "newValue": "1"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "2024-10-28"
        }
      ]
    }
  ]
}

DeleteDeviceCategory DeviceCategory

#

Description

Deleting Devices Category

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Example Audit Record #

{
  "id": "16de7777-200e-4c31-ac20-b8ce9ef288bc",
  "displayName": "Deleting Devices Category",
  "componentName": "Enrollment",
  "activity": null,
  "activityDateTime": "2026-07-04T18:40:35.1660948Z",
  "activityType": "DeleteDeviceCategory DeviceCategory",
  "activityOperationType": "Delete",
  "activityResult": "Success",
  "correlationId": "ff4540ec-ed96-4e94-9b0f-1e3f2e88747b",
  "category": "Enrollment",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": null,
      "auditResourceType": "DeviceCategory",
      "resourceId": "1da388ad-c635-4681-9888-9e874d07ede2",
      "modifiedProperties": [
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "2024-10-28"
        }
      ]
    }
  ]
}

DeleteDeviceEnrollmentLimit DeviceEnrollmentConfiguration

#

Description

Deleting Device Enrollment Limit

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Example Audit Record #

{
  "id": "12ca0f64-6b71-44f4-a8e3-58b50dadce12",
  "displayName": "Deleting Device Enrollment Limit",
  "componentName": "Enrollment",
  "activity": null,
  "activityDateTime": "2026-07-04T18:40:36.9390621Z",
  "activityType": "DeleteDeviceEnrollmentLimit DeviceEnrollmentConfiguration",
  "activityOperationType": "Delete",
  "activityResult": "Success",
  "correlationId": "013061f9-fe23-4332-ac48-0562b8ccb41c",
  "category": "Enrollment",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": null,
      "auditResourceType": "DeviceEnrollmentLimitConfiguration",
      "resourceId": "bf174805-7022-4640-be19-5415cbdf1bd8",
      "modifiedProperties": [
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "2024-10-28"
        }
      ]
    }
  ]
}

Create ClientCertificate

#

Description

ClientCertificate stored in certificate inventory

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Example Audit Record #

{
  "id": "093c9328-6498-463b-b0e4-c170bf238c59",
  "displayName": "ClientCertificate stored in certificate inventory",
  "componentName": "CertificateAuthority",
  "activity": null,
  "activityDateTime": "2026-07-04T20:52:19.3263448Z",
  "activityType": "Create ClientCertificate",
  "activityOperationType": "Create",
  "activityResult": "Success",
  "correlationId": "38f54147-4d27-4adc-97ca-41637660b385",
  "category": "Enrollment",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": null,
    "applicationDisplayName": null,
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": null,
      "auditResourceType": "Microsoft.Management.Services.CertVNextCommonLibrary.ClientCertificate",
      "resourceId": "618095DF9E382305A1FBF9AD1D748E0A1E7CF8D4",
      "modifiedProperties": [
        {
          "displayName": "AccountContextId",
          "oldValue": null,
          "newValue": "11111111-1111-1111-1111-111111111111"
        },
        {
          "displayName": "deviceID",
          "oldValue": null,
          "newValue": "9cd8d483-9ed2-4326-85a5-09712053920d"
        },
        {
          "displayName": "DeviceEnrollmentType",
          "oldValue": null,
          "newValue": "43"
        },
        {
          "displayName": "Thumbprint",
          "oldValue": null,
          "newValue": "618095DF9E382305A1FBF9AD1D748E0A1E7CF8D4"
        }
      ]
    }
  ]
}

References #