detection.wiki

Intune-Other

EventSampleRule
Other (catch-all)NN
Create TermsAndConditionsYN
Delete TermsAndConditionsYN

any: Other (catch-all)

#

Description

Synthetic aggregation for Intune audit rules that filter the Other category without a specific activityType. Not a distinct audit record.

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Create TermsAndConditions

#

Description

Add TermsAndConditions

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Example Audit Record #

{
  "id": "88206406-0dc0-4e33-bc65-1f4d6aad9840",
  "displayName": "Add TermsAndConditions",
  "componentName": "Enrollment",
  "activity": null,
  "activityDateTime": "2026-07-04T18:40:37.6164449Z",
  "activityType": "Create TermsAndConditions",
  "activityOperationType": "Create",
  "activityResult": "Success",
  "correlationId": "9262c161-6f50-4eab-80ac-c1a79b6a2baf",
  "category": "Other",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-2d37281a",
      "auditResourceType": "TermsAndConditions",
      "resourceId": "5b7362eb-67cc-43e7-b0c0-e5f2a25e7cd7",
      "modifiedProperties": [
        {
          "displayName": "Id",
          "oldValue": null,
          "newValue": "5b7362eb-67cc-43e7-b0c0-e5f2a25e7cd7"
        },
        {
          "displayName": "CreatedDateTime",
          "oldValue": null,
          "newValue": "7/4/2026 6:40:37 PM"
        },
        {
          "displayName": "LastModifiedDateTime",
          "oldValue": null,
          "newValue": "7/4/2026 6:40:37 PM"
        },
        {
          "displayName": "Description",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "Title",
          "oldValue": null,
          "newValue": "dwharn"
        },
        {
          "displayName": "BodyText",
          "oldValue": null,
          "newValue": "detection.wiki intune harness"
        },
        {
          "displayName": "AcceptanceStatement",
          "oldValue": null,
          "newValue": "ok"
        },
        {
          "displayName": "Version",
          "oldValue": null,
          "newValue": "1"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "2020-01-15"
        }
      ]
    }
  ]
}

Delete TermsAndConditions

#

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Example Audit Record #

{
  "id": "f7ffd687-a2da-4d8c-8805-1e0523bb5b99",
  "displayName": "Delete TermsAndConditions",
  "componentName": "Enrollment",
  "activity": null,
  "activityDateTime": "2026-07-04T18:40:38.5032147Z",
  "activityType": "Delete TermsAndConditions",
  "activityOperationType": "Delete",
  "activityResult": "Success",
  "correlationId": "884df287-3266-4836-bac1-1dd6be69d3ce",
  "category": "Other",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-2d37281a",
      "auditResourceType": "TermsAndConditions",
      "resourceId": "5b7362eb-67cc-43e7-b0c0-e5f2a25e7cd7",
      "modifiedProperties": [
        {
          "displayName": "Id",
          "oldValue": "5b7362eb-67cc-43e7-b0c0-e5f2a25e7cd7",
          "newValue": "<null>"
        },
        {
          "displayName": "CreatedDateTime",
          "oldValue": "7/4/2026 6:40:37 PM",
          "newValue": "<null>"
        },
        {
          "displayName": "LastModifiedDateTime",
          "oldValue": "7/4/2026 6:40:37 PM",
          "newValue": "<null>"
        },
        {
          "displayName": "Description",
          "oldValue": "<null>",
          "newValue": "<null>"
        },
        {
          "displayName": "Title",
          "oldValue": "dwharn",
          "newValue": "<null>"
        },
        {
          "displayName": "BodyText",
          "oldValue": "detection.wiki intune harness",
          "newValue": "<null>"
        },
        {
          "displayName": "AcceptanceStatement",
          "oldValue": "ok",
          "newValue": "<null>"
        },
        {
          "displayName": "Version",
          "oldValue": "1",
          "newValue": "<null>"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "2020-01-15"
        }
      ]
    }
  ]
}

References #