UCDeviceAlert
These alerts are activated as a result of an issue that is device-specific. It isn't specific to the combination of a specific update and a specific device. Like UpdateAlerts, the AlertType indicates where the Alert comes from (ServiceDeviceAlert, ClientDeviceAlert). For example, an EndOfService alert is a ClientDeviceAlert, as a build no longer being serviced (EOS) is a client-wide state. Meanwhile, DeviceRegistrationIssues in Windows Autopatch will be a ServiceDeviceAlert, as it's a device-wide state in the service to not be correctly registered.
Schema for UCDeviceAlert
| Field | Type | Enumerated type | Example | Description |
|---|---|---|---|---|
| AlertClassification | string | Yes | Error |
Whether this alert is an Error, a Warning, or Informational |
| AlertData | string | No | Currently, data isn't gathered to populate this field. An optional string formatted as a json payload containing metadata for the alert. | |
| AlertId | string | No | 9e107d9d372bb6826bd81d3542a419d6 |
The unique identifier of this alert |
| AlertRank | int | No | 1000 |
Integer ranking of alert for prioritization during troubleshooting |
| AlertStatus | string | Yes | Active |
Whether this alert is Active, Resolved, or Deleted |
| AlertSubtype | string | Yes | DiskFull |
The subtype of alert. |
| AlertType | string | Yes | ClientUpdateAlert |
The type of alert such as ClientUpdateAlert or ServiceUpdateAlert. Indicates which fields are present. |
| AzureADDeviceId | string | No | 71db1a1a-f1a6-4a25-b88f-79c2f513dae0 |
Microsoft Entra Device ID |
| AzureADTenantId | string | No | 69ca04b0-703d-4b3a-9184-c4e3c15d6f5e |
Microsoft Entra tenant ID |
| Description | string | No | Disk full |
A localized string translated from a combination of other alert fields + language preference that describes the issue in detail. |
| DeviceName | string | No | JohnPC-Contoso |
The given device's name |
| ErrorCode | string | No | Currently, data isn't gathered to populate this field. The Error Code, if any, that triggered this Alert. In the case of Client-based explicit alerts, error codes can have extended error codes, which are appended to the error code with an underscore separator. | |
| ErrorSymName | string | No | Currently, data isn't gathered to populate this field. The symbolic name that maps to the Error Code, if any. Otherwise empty. | |
| GlobalDeviceId | string | No | g:1298371934870 |
Internal Microsoft global identifier, if available. |
| Recommendation | string | No | Free up disk space. |
A localized string translated from RecommendedAction, Message, and other fields (depending on source of alert) that provides a recommended action. |
| ResolvedTime [UTC] | datetime | No | 2020-05-14 09:26:03.478039 |
The time this alert was resolved, else empty. |
| SCCMClientId | string | No | 5AB72FAC-93AB-4954-9AB0-6557D0EFA245 |
Configuration Manager client ID of the device, if available. |
| SourceSystem | string | No | Azure |
|
| StartTime [UTC] | datetime | No | 2020-05-14 09:26:03.478039 |
The time this alert was activated. |
| TenantId | string | No | 69ca04b0-703d-4b3a-9184-c4e3c15d6f5e |
Microsoft Entra tenant ID of the device. |
| TimeGenerated [UTC] | datetime | No | 2020-05-14 09:26:03.478039 |
The time the snapshot generated this specific record. This is to determine to which batch snapshot this record belongs. |
| Type | string | No | UCDeviceAlert |
The entity type |
| URL | string | No | aka.ms/errordetail32152 |
Currently, data isn't gathered to populate this field. An optional URL to get more in-depth information related to this alert. |