Device query in Intune: KQL answers about one device or your whole fleet

Which laptops still have an unprotected volume? How many ARM64 devices do we own? Whose battery is worn out? Intune's device query answers questions like these with Kusto Query Language (KQL), either live against one Windows device or across the inventory your devices upload. In this post I'll cover licensing and permissions, set up inventory collection and give you queries you can paste and adapt.

Single device or many devices?#

Both work only with devices that are managed by Intune and marked as corporate-owned. Personal devices simply don't appear.

Prerequisites#

• Licence for Intune Advanced Analytics (see the status note above). Also check the general Advanced Analytics prerequisites that Microsoft's device query pages point to.
• Permissions: a custom Intune role that includes Managed devices › Query, plus permissions to see devices, such as Organization › Read and Managed devices › Read.
• WNS for single-device queries: Intune uses Windows Push Notification Services to deliver the query and return results. If WNS is blocked, the query fails, and there's no way around it.
• Inventory for fleet queries: Windows devices need a properties catalog policy (step 1). iOS/iPadOS, macOS and Android devices report inventory without one.

Step 1: Collect inventory with a properties catalog policy#

1. Go to Devices › Manage devices › Configuration › Create › New policy, choose Windows 10 and later and the Properties catalog profile type.
2. Add the properties you want to query, for example Battery, Bios Info, Cpu, Disk Drive, Encryptable Volume, Logical Drive, Memory Info, Network Adapter, Os Version, System Enclosure, Tpm, Video Controller and Windows Qfe.
3. Assign it to your corporate Windows device groups.
4. Allow time for the first upload. A device that hasn't uploaded yet doesn't cause an error; it's just missing from results. The device's Resource explorer view shows what it has sent.

Step 2: Query a single device in real time#

Open the device from Devices › All devices, select Device query, enter a query and select Run. Results come back while you wait, which makes this the tool for "what is true on this PC right now?" Unprotected volumes on this device:

EncryptableVolume
| where ProtectionStatus != "PROTECTED"

Processor details:

Cpu
| project Model, Architecture, CoreCount, LogicalProcessorCount

The single-device schema goes beyond inventory, with live entities such as Process, Certificate, LocalGroup, WindowsAppCrashEvent, FileInfo and WindowsRegistry; the last two take a file path or registry key as a parameter, so check Microsoft's schema reference for the exact syntax. Supported table operators are where, project, join, order by, top, take, distinct and count, along with comparison operators such as ==, contains and like.

Step 3: Query the whole fleet#

Go to Devices › Device query, write the query and run it. Every row carries a Device column, which is also what join matches on, and fleet queries can aggregate with summarize. Devices by processor architecture:

Cpu
| summarize DeviceCount = count() by Architecture

Unprotected volumes across the fleet, with the drive details alongside:

EncryptableVolume
| where ProtectionStatus != "PROTECTED"
| join LogicalDrive on Device

Batteries holding less than 60% of their design capacity, worst first:

Battery
| where DesignedCapacity > 0
| project Device, Model, CycleCount, HealthPercent = (FullChargedCapacity * 100) / DesignedCapacity
| where HealthPercent < 60
| order by HealthPercent asc

Devices with less than 8 GB of physical memory, a quick input for refresh planning:

MemoryInfo
| project Device, PhysicalMemoryGB = PhysicalMemoryTotalBytes / (1000*1000*1000)
| where PhysicalMemoryGB < 8

Verify#

• Inventory is flowing: run the architecture query and compare the total with the number of corporate-owned devices in scope. A big gap usually means devices without the properties catalog policy, devices enrolled as personal, or devices that haven't uploaded yet.
• Single-device query works: Cpu on an online device returns a result within seconds. If it times out, check that the device is online, corporate-owned and can reach WNS.
• Results match reality: spot-check a device. For volumes, compare with manage-bde -status run from an elevated prompt on that device.

Tips & gotchas#

• Fleet results are a snapshot. They reflect each device's last upload, so a fix deployed this morning may not show until tomorrow. Confirm on one device with a single-device query.
• It's a KQL subset. Stick to the documented operators and functions; queries copied from Log Analytics may need trimming. For devices onboarded to Defender for Endpoint, advanced hunting answers a different set of questions.
• Ownership matters. Fix devices wrongly marked as personal before you trust a count.
• Keep WNS open. Proxies or firewalls that block it break single-device queries, along with Intune's push notifications that prompt devices to sync.
• Act on the answers. Pair queries with Remediations to fix what you find, and use Graph PowerShell reports when you need scheduled exports.

References#

• Device query (Microsoft Intune)
• Device query for multiple devices (Microsoft Intune)