# Query Examples  The following examples cover the most common use cases. Each query can be copied directly into the Query Explorer editor and run as-is, or adapted to your needs. --- ## Device Inventory **All non-compliant Windows devices with their primary user:** ```text Devices | where ComplianceState == "NonCompliant" and OperatingSystem contains "Windows" | project DeviceName, OSVersion, ComplianceState, PrimaryUserUPN ``` --- **Devices with low disk space (less than 10 GB free), sorted by available space:** ```text Devices | where FreeStorageSpaceGB < "10" | project DeviceName, FreeStorageSpaceGB, TotalStorageSpaceGB | sort by FreeStorageSpaceGB asc ``` --- **Corporate-owned laptops without BitLocker encryption:** ```text Devices | where Ownership == "Corporate" and IsEncrypted == "false" | project DeviceName, Manufacturer, Model, PrimaryUserUPN, LastSyncDateTime ``` --- **Devices that have not synced in the last 30 days:** ```text Devices | where LastSyncDateTime < "2025-04-01" | project DeviceName, PrimaryUserUPN, LastSyncDateTime | sort by LastSyncDateTime asc ``` --- **Personal devices enrolled in Intune:** ```text Devices | where Ownership == "Personal" | project DeviceName, OperatingSystem, PrimaryUserUPN, EnrolledDateTime | sort by EnrolledDateTime desc ``` --- **Top 20 devices by total storage:** ```text Devices | project DeviceName, Manufacturer, Model, TotalStorageSpaceGB | sort by TotalStorageSpaceGB desc | top 20 ``` --- ## Applications **All installed versions of a specific application:** ```text Apps | where AppName contains "Microsoft Teams" | project AppName, AppVersion, AppPublisher, InstallState | sort by AppVersion desc ``` --- **Applications in a failed install state:** ```text Apps | where InstallState == "Failed" | project AppName, AppVersion, AppPublisher, InstallState ``` --- ## Compliance **Devices with BitLocker not compliant:** ```text Compliance | where BitLockerStatus != "Compliant" | project PolicyName, BitLockerStatus, EncryptionStatus, ComplianceStatus ``` --- **Policies where antivirus or firewall is non-compliant:** ```text Compliance | where AntivirusStatus == "NonCompliant" or FirewallStatus == "NonCompliant" | project PolicyName, AntivirusStatus, FirewallStatus, ComplianceStatus ``` --- ## Drivers **Unsigned drivers across the fleet:** ```text Drivers | where Firmato == "false" | project NomeDriver, Vendor, NomeDevice, Versione ``` --- **Drivers in an error state:** ```text Drivers | where Stato contains "Error" | project NomeDriver, Classe, Versione, Stato, NomeDevice | sort by NomeDevice asc ``` --- ## Windows Updates **Updates pending installation:** ```text WindowsUpdates | where Stato contains "Pending" | project UpdateName, KB, Categoria, Stato | sort by UpdateName asc ``` --- ## Audit Log **Last 50 audit events, most recent first:** ```text AuditLog | sort by CreatedAt desc | top 50 ``` --- **Audit events for a specific action type:** ```text AuditLog | where Action contains "Delete" | project Action, EntityType, EntityId, IpAddress, CreatedAt | sort by CreatedAt desc | top 100 ``` --- ## SNMP Devices **All SNMP-discovered devices at a specific site:** ```text SnmpDevices | where Site == "HQ" | project Hostname, IpAddress, Model, Manufacturer, LastScannedAtUtc | sort by Hostname asc ``` --- **SNMP devices not scanned recently:** ```text SnmpDevices | where LastScannedAtUtc < "2025-04-01" | project Hostname, IpAddress, Site, LastScannedAtUtc | sort by LastScannedAtUtc asc ```