Microsoft Intune
Search the rule library.Category Description ID Activities Sample Rules OtherAudit events without a more specific admin-center pane. Audit events without a more specific admin-center pane. 0 2 2 0 EnrollmentDevice or user enrollment into Intune. Device or user enrollment into Intune. 1 5 5 0 ComplianceCompliance policy creation, assignment, and evaluation-state changes. Compliance policy creation, assignment, and evaluation-state changes. 2 5 5 0 Device Configuration profile creation, assignment, and update. 3 6 6 1 DevicePer-device commands: retire, wipe, remote lock, sync. Per-device commands: retire, wipe, remote lock, sync. 4 8 2 2 ApplicationApp creation, assignment, and app protection policy changes. App creation, assignment, and app protection policy changes. 5 8 8 2 EBook Managed eBook creation and assignment. 6 6 0 0 Conditional Conditional Access policy changes surfaced in the audit log. 7 6 0 0 On On-premises access and Exchange ActiveSync access rule changes. 8 6 0 0 RoleCustom Intune role and role-assignment changes. Custom Intune role and role-assignment changes. 9 4 4 0 Software Update ring and update policy creation and assignment. 10 2 2 0 Device Autopilot deployment profile and Enrollment Status Page changes. 11 6 0 0 Device Device management intent (templated settings-catalog policy) changes. 12 6 0 0 Device Individual setting changes within a device management intent. 13 6 0 0 Device Endpoint security policy changes: antivirus, encryption, firewall, attack surface reduction. 14 6 0 0 Group Group Policy Analytics import and analysis actions. 15 6 0 0 Assignment Assignment filter creation and scoping changes. 16 2 2 0 Remote Remote Help session actions. 17 6 0 0 Organizational Organizational message creation and assignment. 18 6 0 0 Endpoint Endpoint Privilege Management elevation-rule changes. 19 6 0 0 Device Device inventory collection policy changes. 20 6 0 0 Admin Discovered with getAuditCategories. 21 0 0 0 DeploymentDiscovered with getAuditCategories. Discovered with getAuditCategories. 22 0 0 0 AutopilotDiscovered with getAuditCategories. Discovered with getAuditCategories. 23 0 0 0 References