Query Examples
The following examples cover the most common use cases. Each query can be copied directly into the Query Explorer editor and run as-is, or adapted to your needs.
Device Inventory
All non-compliant Windows devices with their primary user:
Devices
| where ComplianceState == "NonCompliant" and OperatingSystem contains "Windows"
| project DeviceName, OSVersion, ComplianceState, PrimaryUserUPN
Devices with low disk space (less than 10 GB free), sorted by available space:
Devices
| where FreeStorageSpaceGB < "10"
| project DeviceName, FreeStorageSpaceGB, TotalStorageSpaceGB
| sort by FreeStorageSpaceGB asc
Corporate-owned laptops without BitLocker encryption:
Devices
| where Ownership == "Corporate" and IsEncrypted == "false"
| project DeviceName, Manufacturer, Model, PrimaryUserUPN, LastSyncDateTime
Devices that have not synced in the last 30 days:
Devices
| where LastSyncDateTime < "2025-04-01"
| project DeviceName, PrimaryUserUPN, LastSyncDateTime
| sort by LastSyncDateTime asc
Personal devices enrolled in Intune:
Devices
| where Ownership == "Personal"
| project DeviceName, OperatingSystem, PrimaryUserUPN, EnrolledDateTime
| sort by EnrolledDateTime desc
Top 20 devices by total storage:
Devices
| project DeviceName, Manufacturer, Model, TotalStorageSpaceGB
| sort by TotalStorageSpaceGB desc
| top 20
Applications
All installed versions of a specific application:
Apps
| where AppName contains "Microsoft Teams"
| project AppName, AppVersion, AppPublisher, InstallState
| sort by AppVersion desc
Applications in a failed install state:
Apps
| where InstallState == "Failed"
| project AppName, AppVersion, AppPublisher, InstallState
Compliance
Devices with BitLocker not compliant:
Compliance
| where BitLockerStatus != "Compliant"
| project PolicyName, BitLockerStatus, EncryptionStatus, ComplianceStatus
Policies where antivirus or firewall is non-compliant:
Compliance
| where AntivirusStatus == "NonCompliant" or FirewallStatus == "NonCompliant"
| project PolicyName, AntivirusStatus, FirewallStatus, ComplianceStatus
Drivers
Unsigned drivers across the fleet:
Drivers
| where Firmato == "false"
| project NomeDriver, Vendor, NomeDevice, Versione
Drivers in an error state:
Drivers
| where Stato contains "Error"
| project NomeDriver, Classe, Versione, Stato, NomeDevice
| sort by NomeDevice asc
Windows Updates
Updates pending installation:
WindowsUpdates
| where Stato contains "Pending"
| project UpdateName, KB, Categoria, Stato
| sort by UpdateName asc
Audit Log
Last 50 audit events, most recent first:
AuditLog
| sort by CreatedAt desc
| top 50
Audit events for a specific action type:
AuditLog
| where Action contains "Delete"
| project Action, EntityType, EntityId, IpAddress, CreatedAt
| sort by CreatedAt desc
| top 100
SNMP Devices
All SNMP-discovered devices at a specific site:
SnmpDevices
| where Site == "HQ"
| project Hostname, IpAddress, Model, Manufacturer, LastScannedAtUtc
| sort by Hostname asc
SNMP devices not scanned recently:
SnmpDevices
| where LastScannedAtUtc < "2025-04-01"
| project Hostname, IpAddress, Site, LastScannedAtUtc
| sort by LastScannedAtUtc asc