Azure administration — reference notes

IT Managers

Compare Azure Log Analytics and Defender hunting syntax, then look up the captured Intune device and action-query examples for the Azure workspace.

Source-derived reference

These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.

Azure Log Analytics KQL Query

These queries work in an Azure Log Workbook.

The tables you can use in an Azure Log Workbook are different to those in Defender's Advanced Hunting.

Some of defenders tables use cut down versions of the tables found in here.

Some functions are different as well.

Example

Azure KQL: | where UserPrincipalName notcontains "@student"

Defender Advanced Hunting KQL

| where UserPrincipalName **!**contains "@student"

Find Device In Intune

Basic search for an Intune Device.

This one looks for all the devices whose hostname starts with "GCC"

Where To Run The Query

OUTPUT

Screenshot retained for review

QUERY

IntuneDevices

| where DeviceName contains "GCC"

| extend QLD_TIME = datetime_add("hour", 10, TimeGenerated)

| sort by TimeGenerated

| project TimeGenerated,QLD_TIME,DeviceName,DeviceId,ReferenceId,DeviceRegistrationState,PrimaryUser,SkuFamily,SerialNumber,StorageFree,StorageTotal,OS,Ownership

Actions Performed in Intune

See a basic list of actions that are getting performmed in InTune.

Where To Run The Query

OUTPUT

There is more detail about what was changed inside the Properties column.

Screenshot retained for review

QUERY

IntuneAuditLogs

| extend QLD_TIME = datetime_add("hour", 10, TimeGenerated)

| project TimeGenerated,OperationName,ResultType,Identity,Properties

| top 20 by Identity