What's new in Microsoft Intune (2405)

[@catman-n-robin]

I really love your videos. Keep up the excellent work!

[@MSEndpointMgr]

Thank you very much!

[@NickolajAndersen]

Sorry for the terrible sound, I had forgotten to move my mic closer (it's standing behind my monitor) 😅

[@paulwoodward8265]

Great insight with the Bitlocker policy. Maybe Mattias could show us how he set up the log analytics workspace and show us some more example queries?

[@MSEndpointMgr]

Yep I can indeed do that.

[@pellejpellej]

Thanks guys - looking forward to the macOS stuff :)

[@MSEndpointMgr]

Thanks Pelle.

[@paulwoodward8265]

Nickolaj, I know your office isn't done yet, but maybe grab some cushions or towels or something to reduce the echo in the room a bit?? It's hard to hear you. Thanks!

[@MSEndpointMgr]

Noted. Thanks for the feedback!

[@MrMarcLaflamme]

11:55 - We were too eager and added many of our computer to Autopilot in the beginning before we knew what it would do in the back end and ended up with a whole load of these temporary entra objects (they show up as NO_SERIAL in many reports). Is there any way of removing them? We have since removed all but required devices from the AP Device list. 18:28 - I added the correct SP as the owner of the group but the ADP Profile keeps removing it after I save the profile. No idea what's happening. I also don't have the tuple csv upload option yet so I'm wondering if those are related. Finally - first time watching this series, well done! The only critique I have is Nickolaj's voice is a bit difficult to hear due to the room echo. Perhaps a headset mic or dedicated lapel mic would be better?

[@MSEndpointMgr]

I see that can become a problem. I don’t think there really is any solution to it other that what you already done. Could be issues in your tenant. Do you see same behaviour if you try another one? I will buy a new Mic for Nickolaj 😂 thanks for the comment 👌🏻

[@MrMarcLaflamme]

@@MSEndpointMgr Ah okay, maybe I will need to open a support ticket because the Object ID's of these NO_SERIAL devices don't show up anywhere (Entra or Intune). I don't have another tenant to try with but I will try creating a new group to test with. Hooray for Nickolaj 😛

[@MSEndpointMgr]

@@MrMarcLaflamme sounds like a good idea!

[@MrMarcLaflamme]

@@MSEndpointMgr it didn’t work 🙁. I’ve only found one other user so far who has experienced this (on Michael Niehaus’s blog). It’s very odd. I dread having to open a support ticket with MS.

[@MSEndpointMgr]

@@MrMarcLaflamme sounds like it. Let us know how it went

[@sys8dmin_595]

Thanks again guys. Would be interested to hear how you guys are exporting the log files to do your own reporting? Is it Automated?

[@MSEndpointMgr]

Hey thank you for the message. Can you elaborate on what logs you would like to export in terms of reporting?

[@TheCheondervara]

hello guys, may i get your query to find out changes described in video? :)

[@MSEndpointMgr]

Sure 😀 IntuneAuditLogs | extend AdminAccount = tostring(parse_json(tostring(parse_json(Properties).Actor)).UPN) | extend AdminAccount = iff(isnotempty(AdminAccount), AdminAccount, tostring(parse_json(tostring(parse_json(Properties).Actor)).ApplicationName)) | extend AdminDetailsURI = iif(AdminAccount !contains "System", strcat('portal.azure.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/overview/userId/', AdminAccount), "") | extend ApplicationName_ = tostring(parse_json(tostring(parse_json(Properties).Actor)).ApplicationName) | extend Application = tostring(parse_json(tostring(parse_json(Properties).Actor)).Application) | extend ModifiedProps = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).Targets))[0].ModifiedProperties))[0].Name) | extend New_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).Targets))[0].ModifiedProperties))[0].New) | extend Old_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).Targets))[0].ModifiedProperties))[0].Old) | extend IsDelegatedAdmin_ = tostring(parse_json(tostring(parse_json(Properties).Actor)).IsDelegatedAdmin) | extend ObjectId_ = tostring(parse_json(tostring(parse_json(Properties).Actor)).ObjectId) | extend Action = tostring(parse_json(tostring(parse_json(Properties).TargetDisplayNames))[0]) | extend AuditEventId = tostring(parse_json(Properties).AuditEventId) | where isnotempty(Application) | project TimeGenerated, AdminAccount, OperationName, Action, ResultType, AdminDetailsURI, AuditEventId

[@miggoogle]

1st 😀

[@MSEndpointMgr]

Lovely 🥳👏🏻