Device troubleshooting with Copilot in Intune
While Security Copilot excels at investigating security threats, it's equally powerful for IT operations—specifically troubleshooting device compliance issues, policy conflicts, and configuration problems in Microsoft Intune. Traditionally, troubleshooting requires manually reviewing device properties, policy assignments, compliance reports, and Intune logs—a process taking 30-60 minutes per device. Copilot reduces this to 5-10 minutes by instantly analyzing device data and explaining root causes in plain language.
In this unit, you learn how to use Copilot in Intune to diagnose device issues, compare configurations, and get actionable remediation guidance.
Core troubleshooting capabilities
Copilot embedded in Intune (https://intune.microsoft.com) eliminates context switching by bringing all device information into a single pane. Navigate to Devices > All devices, select a device, and select Summarize with Copilot.
| Capability | How to Use | What Copilot Provides | Example Prompt |
|---|---|---|---|
| Device summary | Select Summarize with Copilot on device page | Basic information (name, OS, user), compliance status with failure reasons, applied policies, installed apps, group memberships | Automatic when opening Copilot |
| Compliance diagnosis | Ask about noncompliance | Exact setting violations, actual device state, root cause explanation (e.g., "TPM disabled in BIOS" not just "BitLocker disabled"), specific remediation steps | "Why is this device noncompliant?"; "How do I enable TPM?"; "Show me other devices with the same issue" |
| Device comparison | Prompt to compare two devices | Similarities (OS, policies, groups, apps), differences table (BitLocker status, TPM status, password length, sync time), root cause identification, recommendation to match working device | "Compare this device to DESKTOP-FINANCE05" |
| Policy analysis | Select policy, click Copilot | Plain-English explanation of policy purpose, key settings breakdown, security impact assessment, deployment status (success/conflicts/errors), common issues | "Explain what this policy does" |
| App deployment troubleshooting | Ask about app installation failures | Failure reason, root cause, remediation steps, alternative solutions | "Why didn't Microsoft Project install on this device?" |
| Natural language queries | Ask questions about device data | Table of results with summary statistics and suggested actions | "Show me Windows 11 devices that are noncompliant"; "Which devices have Adobe Acrobat installed?" |
Device comparison example
Prompt: "Compare this device to DESKTOP-FINANCE05"
Comparison: DESKTOP-FINANCE12 vs. DESKTOP-FINANCE05
Similarities:
- Both running Windows 11 Enterprise 23H2
- Same primary policies applied (8 shared policies)
- Same group memberships (Finance Department Devices, All Company Devices)
- Both have Microsoft 365 Apps installed
Differences:
Attribute DESKTOP-FINANCE12 (Noncompliant) DESKTOP-FINANCE05 (Compliant) BitLocker Status Not enabled Enabled on all drives TPM Status Disabled in firmware Enabled (TPM 2.0) Password Length 6 characters 12 characters Last Policy Sync 2 hours ago 1 hour ago Defender Health Healthy Healthy Root Cause:
The key difference is TPM status. DESKTOP-FINANCE05 has TPM enabled, allowing BitLocker to activate. DESKTOP-FINANCE12's TPM is disabled, preventing BitLocker encryption.Recommendation:
Enable TPM on DESKTOP-FINANCE12's firmware (BIOS/UEFI) to match DESKTOP-FINANCE05's configuration.
Common help desk scenarios
Copilot accelerates help desk troubleshooting by correlating information across multiple consoles instantly:
| User Issue | Investigation Prompt | What Copilot Reveals | Resolution |
|---|---|---|---|
| "I can't access company email" | "Why is this device noncompliant?" | Device blocked by Conditional Access due to password policy violation | Guide user to reset password to meet 12-character requirement |
| "My apps won't install" | "Why didn't [App Name] install?" | Insufficient disk space (4 GB required, 1.2 GB available) | Run Disk Cleanup script, move files to OneDrive, retry installation |
| "Device shows as noncompliant" | "Compare this device to [working device]" | TPM disabled in firmware while working device has TPM enabled | Enable TPM in BIOS/UEFI settings |
| "Can't find devices needing updates" | "Show me devices that haven't checked in to Intune in 30 days" | List of stale devices with last check-in dates | Contact users to reconnect devices to network |
Best practices for using Copilot in Intune
- Start with Copilot for initial triage: Get device summary before diving into detailed logs and reports—saves 15-20 minutes per troubleshooting session
- Ask for remediation steps: Don't just ask "What's wrong?"—ask "How do I fix this?" to get actionable guidance with specific commands or configuration changes
- Use device comparison for isolation problems: When one device fails while similar devices work, compare configurations to identify the exact difference causing the issue
What's next?
You've learned how to use Copilot in both Microsoft Defender (for security incident investigation) and Microsoft Intune (for device troubleshooting). Next, you apply these skills in a hands-on exercise where you investigate a security incident affecting Contoso Healthcare's endpoints, combining Defender threat data with Intune device management insights to fully understand and remediate the attack.