# Azure administration — reference notes

Compare Azure Log Analytics and Defender hunting syntax, then look up the captured Intune device and action-query examples for the Azure workspace.

!!!warning Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
!!!

## Azure Log Analytics KQL Query {#source-4f6f28f620e83bfd}

These queries work in an Azure Log Workbook.

The tables you can use in an Azure Log Workbook are different to those in Defender's Advanced Hunting.

Some of defenders tables use cut down versions of the tables found in here.

Some functions are different as well.

**Example**

**Azure KQL:** \| where UserPrincipalName notcontains "@student"

**Defender Advanced Hunting KQL**

\| where UserPrincipalName \*\*!\*\*contains "@student"

## Find Device In Intune {#source-a25c5fe8238256d4}

Basic search for an Intune Device.

This one looks for all the devices whose hostname starts with "GCC"

[**Where To Run The Query**](where-to-run-the-query.md)

**OUTPUT**

[Screenshot retained for review](../../review/Review-status.md#asset-d859283b00c10ae25311)

**QUERY**

IntuneDevices

\| where DeviceName contains "GCC"

\| extend QLD_TIME = datetime_add("hour", 10, TimeGenerated)

\| sort by TimeGenerated

\| project TimeGenerated,QLD_TIME,DeviceName,DeviceId,ReferenceId,DeviceRegistrationState,PrimaryUser,SkuFamily,SerialNumber,StorageFree,StorageTotal,OS,Ownership

## Actions Performed in Intune {#source-42f34dc18cb1aefb}

See a basic list of actions that are getting performmed in InTune.

[**Where To Run The Query**](where-to-run-the-query.md)

**OUTPUT**

There is more detail about what was changed inside the Properties column.

[Screenshot retained for review](../../review/Review-status.md#asset-606f6e759b8db2217fb7)

**QUERY**

IntuneAuditLogs

\| extend QLD_TIME = datetime_add("hour", 10, TimeGenerated)

\| project TimeGenerated,OperationName,ResultType,Identity,Properties

\| top 20 by Identity

\| sort by TimeGenerated

## Related guidance

- [Topic overview](Introduction.md)
- [Source review status](../../review/Review-status.md)