detection.wiki

Intune-SoftwareUpdates

EventSampleRule
SoftwareUpdates (catch-all)NN
Create WindowsFeatureUpdateProfileYN
Delete WindowsFeatureUpdateProfileYN

any: SoftwareUpdates (catch-all)

#

Description

Synthetic aggregation for Intune audit rules that filter the SoftwareUpdates category without a specific activityType. Not a distinct audit record.

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Create WindowsFeatureUpdateProfile

#

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Example Audit Record #

{
  "id": "bf3ef54f-b629-45ac-ba19-13287b26e478",
  "displayName": "Create WindowsFeatureUpdateProfile",
  "componentName": "SoftwareUpdateConfiguration",
  "activity": null,
  "activityDateTime": "2026-07-04T18:40:40.2787966Z",
  "activityType": "Create WindowsFeatureUpdateProfile",
  "activityOperationType": "Create",
  "activityResult": "Success",
  "correlationId": "77516a98-072c-45a1-ab71-870ccccade06",
  "category": "SoftwareUpdates",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-2d37281a",
      "auditResourceType": "WindowsFeatureUpdateProfile",
      "resourceId": "b3182f89-776b-42a9-a943-67cc39dfd504",
      "modifiedProperties": [
        {
          "displayName": "InstallLatestWindows10OnWindows11IneligibleDevice",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "InstallFeatureUpdatesOptional",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "Id",
          "oldValue": null,
          "newValue": "b3182f89-776b-42a9-a943-67cc39dfd504"
        },
        {
          "displayName": "Description",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "FeatureUpdateVersion",
          "oldValue": null,
          "newValue": "Windows 11, version 23H2"
        },
        {
          "displayName": "RolloutSettings.OfferIntervalInDays",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "DeployableContentDisplayName",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "EndOfSupportDate",
          "oldValue": null,
          "newValue": "11/10/2026 12:00:00 AM"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "5026-04-17"
        },
        {
          "displayName": "$Collection.RoleScopeTagIds[0]",
          "oldValue": null,
          "newValue": "Default"
        }
      ]
    }
  ]
}

Delete WindowsFeatureUpdateProfile

#

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Example Audit Record #

{
  "id": "73acfc90-0cbb-46f1-a32d-43a25924e0b2",
  "displayName": "Delete WindowsFeatureUpdateProfile",
  "componentName": "SoftwareUpdateConfiguration",
  "activity": null,
  "activityDateTime": "2026-07-04T18:40:40.834092Z",
  "activityType": "Delete WindowsFeatureUpdateProfile",
  "activityOperationType": "Delete",
  "activityResult": "Success",
  "correlationId": "e490b03e-082d-4982-b91c-3b15c96ac3a9",
  "category": "SoftwareUpdates",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": null,
      "auditResourceType": "Microsoft.Management.Services.Api.WindowsFeatureUpdateProfile",
      "resourceId": "b3182f89-776b-42a9-a943-67cc39dfd504",
      "modifiedProperties": [
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "5026-04-17"
        }
      ]
    }
  ]
}

References #