remoteActionAudit resource type

Namespace: microsoft.graph

Important: Microsoft Graph APIs under the /beta version are subject to change; production use is not supported.

Note: The Microsoft Graph API for Intune requires an active Intune license for the tenant.

Report of remote actions initiated on the devices belonging to a certain tenant.

Methods

Method	Return Type	Description
List remoteActionAudits	remoteActionAudit collection	List properties and relationships of the remoteActionAudit objects.
Get remoteActionAudit	remoteActionAudit	Read properties and relationships of the remoteActionAudit object.
Create remoteActionAudit	remoteActionAudit	Create a new remoteActionAudit object.
Delete remoteActionAudit	None	Deletes a remoteActionAudit.
Update remoteActionAudit	remoteActionAudit	Update the properties of a remoteActionAudit object.

Properties

Property	Type	Description
id	String	Report Id.
deviceDisplayName	String	Intune device name.
userName	String	[deprecated] Please use InitiatedByUserPrincipalName instead.
initiatedByUserPrincipalName	String	User who initiated the device action, format is UPN.
action	remoteAction	The action name. Possible values are: unknown, factoryReset, removeCompanyData, resetPasscode, remoteLock, enableLostMode, disableLostMode, locateDevice, rebootNow, recoverPasscode, cleanWindowsDevice, logoutSharedAppleDeviceActiveUser, quickScan, fullScan, windowsDefenderUpdateSignatures, factoryResetKeepEnrollmentData, updateDeviceAccount, automaticRedeployment, shutDown, rotateBitLockerKeys, rotateFileVaultKey, getFileVaultKey, setDeviceName, activateDeviceEsim, deprovision, disable, reenable, moveDeviceToOrganizationalUnit, initiateMobileDeviceManagementKeyRecovery, initiateOnDemandProactiveRemediation, rotateLocalAdminPassword, unknownFutureValue, launchRemoteHelp, revokeAppleVppLicenses, removeDeviceFirmwareConfigurationInterfaceManagement, pauseConfigurationRefresh, initiateDeviceAttestation, changeAssignments, delete.
requestDateTime	DateTimeOffset	Time when the action was issued, given in UTC.
deviceOwnerUserPrincipalName	String	Upn of the device owner.
deviceIMEI	String	IMEI of the device.
actionState	actionState	Action state. Possible values are: none, pending, canceled, active, done, failed, notSupported.
managedDeviceId	String	Action target.
deviceActionDetails	keyValuePair_2OfString_String collection	DeviceAction details
deviceActionCategory	deviceActionCategory	DeviceAction category. Possible values are: single, bulk.
bulkDeviceActionId	String	BulkAction ID

Relationships

None

JSON Representation

Here is a JSON representation of the resource.

{
  "@odata.type": "#microsoft.graph.remoteActionAudit",
  "id": "String (identifier)",
  "deviceDisplayName": "String",
  "userName": "String",
  "initiatedByUserPrincipalName": "String",
  "action": "String",
  "requestDateTime": "String (timestamp)",
  "deviceOwnerUserPrincipalName": "String",
  "deviceIMEI": "String",
  "actionState": "String",
  "managedDeviceId": "String",
  "deviceActionDetails": [
    {
      "@odata.type": "microsoft.graph.keyValuePair_2OfString_String"
    }
  ],
  "deviceActionCategory": "String",
  "bulkDeviceActionId": "String"
}