Intune Admin Activity (30 days)
The question it answers: Which wipes, retires, deletes and policy changes were made in Intune in the last 30 days, and by whom?
Every wipe, retire, delete and policy change made in Intune, by whom. A burst of wipes from one account, or policy changes nobody announced, are exactly what you want to see first.
At a glance
Section titled “At a glance”| Where in the app | Intune › Service & Operations › Intune Admin Activity |
| Workload | Intune |
| Kind | Table |
| Data | Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once. |
| Licence | Microsoft Intune. |
| Report id (API and MCP) | intune.service.intune-audit-log |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| When | ActivityDateTime | DateTime |
| Activity | DisplayName | Status |
| Operation | OperationType | Text |
| By | Actor | Text |
| Target | Resources | Text |
| Category | Category | Text |
| Result | Result | Text |
Filters
Section titled “Filters”| Filter | Key (API) | On when the page opens |
|---|---|---|
| Only destructive actions and changes (hide reads and syncs) | changes | Yes |
What it needs
Section titled “What it needs”Licence: Microsoft Intune.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
DeviceManagementApps.Read.All | Microsoft Graph | Read Microsoft Intune apps |
Data sources it reads
GET /v1.0/deviceManagement/auditEvents?$filter=activityDateTime ge ...
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/intune.service.intune-audit-log?size=100GET /ir-api/v1/reports/intune.service.intune-audit-log?filter=changesAn AI assistant reads it with the MCP tool get_report and the id intune.service.intune-audit-log. The client needs the Read grant for Intune. See Using the API.