Explore advanced reporting with Intune Suite analytics
While standard Intune reporting tells you whether a device is compliant or if an application successfully installed, Intune Advanced Analytics (part of the premium Microsoft Intune Suite) digs deeper into the actual end-user experience and real-time device health.
It transitions your IT team from reacting to helpdesk tickets to proactively identifying and resolving hardware and software issues before users are even impacted.
Here is a look at the advanced reporting capabilities and how they apply to real-world scenarios.
Real-time Device Query
Standard Intune hardware inventory can take hours or days to fully sync. Advanced Analytics introduces Device Query, allowing you to use Kusto Query Language (KQL) to ask live questions to your fleet and get answers in seconds.
- Example: A critical zero-day vulnerability is announced that relies on a specific local service running. Instead of waiting for a vulnerability scanner to run overnight, you can execute a live KQL query across your Windows and macOS devices to instantly identify exactly which machines have that specific service running right now, allowing you to immediately target them with a remediation script.
Anomaly Detection
Instead of making you hunt through logs to find problems, Intune uses machine learning to establish a baseline of "normal" behavior for your specific environment and proactively flags deviations.
- Example: You deploy a routine update to your corporate VPN client. Shortly after, the Anomaly Detection dashboard flags a "High Severity Anomaly," noting a 400% spike in application crashes specifically on Lenovo laptops running Windows 11. You can immediately pause the deployment ring for those devices and investigate the driver conflict before the helpdesk gets flooded with calls.
Endpoint Privilege Management (EPM) Reporting
If your organization is moving toward a Zero Trust model by stripping local administrator rights, the EPM reporting dashboard provides visibility into exactly what users are trying to do when they hit permission blocks.
Resource Performance Reporting
The Resource Performance dashboard provides fleet-wide visibility into CPU, memory, and disk performance across enrolled Windows devices.
- Example: You can review the Elevation Report and see that 50 developers in the engineering department are consistently requesting admin rights to run a specific debugging tool. Instead of granting them full local admin rights, you use this data to create a targeted EPM rule that automatically elevates only that specific, trusted application executable.
Requirements
To use these capabilities, your organization must be licensed for either the standalone Microsoft Intune Advanced Analytics add-on or the Microsoft Intune Suite.