Microsoft Intune
Search the rule library.Category Description ID Activities Sample Rule OtherAudit events without a more specific admin-center pane. Audit events without a more specific admin-center pane. 0 2 2 N EnrollmentDevice or user enrollment into Intune. Device or user enrollment into Intune. 1 5 5 N ComplianceCompliance policy creation, assignment, and evaluation-state changes. Compliance policy creation, assignment, and evaluation-state changes. 2 5 5 N Device Configuration profile creation, assignment, and update. 3 6 6 Y DevicePer-device commands: retire, wipe, remote lock, sync. Per-device commands: retire, wipe, remote lock, sync. 4 8 2 Y ApplicationApp creation, assignment, and app protection policy changes. App creation, assignment, and app protection policy changes. 5 8 8 Y EBook Managed eBook creation and assignment. 6 6 0 N Conditional Conditional Access policy changes surfaced in the audit log. 7 6 0 N On On-premises access and Exchange ActiveSync access rule changes. 8 6 0 N RoleCustom Intune role and role-assignment changes. Custom Intune role and role-assignment changes. 9 4 4 N Software Update ring and update policy creation and assignment. 10 2 2 N Device Autopilot deployment profile and Enrollment Status Page changes. 11 6 0 N Device Device management intent (templated settings-catalog policy) changes. 12 6 0 N Device Individual setting changes within a device management intent. 13 6 0 N Device Endpoint security policy changes: antivirus, encryption, firewall, attack surface reduction. 14 6 0 N Group Group Policy Analytics import and analysis actions. 15 6 0 N Assignment Assignment filter creation and scoping changes. 16 2 2 N Remote Remote Help session actions. 17 6 0 N Organizational Organizational message creation and assignment. 18 6 0 N Endpoint Endpoint Privilege Management elevation-rule changes. 19 6 0 N Device Device inventory collection policy changes. 20 6 0 N Admin Discovered with getAuditCategories. 21 0 0 N DeploymentDiscovered with getAuditCategories. Discovered with getAuditCategories. 22 0 0 N AutopilotDiscovered with getAuditCategories. Discovered with getAuditCategories. 23 0 0 N References