Endpoint analytics shows no data in Intune: prerequisites, data collection and fixes

You turn on endpoint analytics, wait a day, and the startup performance score is still zero, or only a fraction of your devices appear. Endpoint analytics depends on a policy, a restart, a processing cycle and an unobstructed network path, and any one of them can leave the reports empty. In this post I'll go through each link in that chain for Intune-managed, co-managed and Configuration Manager devices, with the checks that prove which one is broken.

Symptoms#

• The endpoint analytics overview shows a startup performance score of zero with a banner saying it's waiting for data.
• The Device performance tab of the startup performance report lists fewer devices than you manage.
• Devices show a health status of Insufficient data, or the per-device score export contains -1 or -2 in EndpointAnalyticsScore: no score is available for that device yet.
• For Configuration Manager devices, hardware inventory stops processing after onboarding and Dataldr.log shows Violation of PRIMARY KEY constraint 'BROWSER_USAGE_HIST_PK'.

Why it happens#

• The device isn't eligible. Intune-enrolled and co-managed devices must be Windows 10 or 11 and Microsoft Entra joined or hybrid joined; Entra registered devices aren't supported. Devices that don't meet Intune's requirements, such as Windows Home, can be added through Configuration Manager instead. Each device also needs a valid Intune license.
• The data collection policy doesn't reach it. Starting data collection creates a profile named Intune data collection policy. Intune-managed and co-managed devices need it; if you picked Selected devices or I'll choose later, many devices were never targeted.
• No restart, or not enough time. After the policy applies, the device must restart, and it can take up to 25 hours to appear on the device performance tab. Data is processed every 24 hours, so an hour after setup is too early to judge.
• The network path is blocked. Devices send their data to https://*.events.data.microsoft.com. Windows pins Microsoft's certificate for these endpoints, so SSL inspection breaks the upload, and an authenticating proxy that the device can't satisfy drops it. Blocking these endpoints to limit Windows telemetry stops endpoint analytics as well.
• Configuration Manager isn't uploading. Endpoint analytics upload isn't enabled for the hierarchy, a custom client setting overrides data collection, or the service connection point can't reach the cloud.

How to fix it#

1. Check eligibility#

In the Microsoft Intune admin center, open the device and confirm the OS, ownership and join type: Microsoft Entra joined or Microsoft Entra hybrid joined, enrolled in Intune or co-managed. Check that the primary user has an Intune license. Fix these before anything else, because no setting will make an unsupported device report.

2. Fix the data collection policy assignment#

Go to Devices › Configuration, open Intune data collection policy and select Properties › Assignments › Edit. Make sure it targets every device group you expect to see. Then check its device status: devices in error or pending never send data. If you need different targeting, create another Windows health monitoring profile with the scope set to Endpoint analytics and assign it to those devices. For co-managed devices, Microsoft recommends configuring endpoint analytics through Intune.

3. Restart and wait#

Once the policy shows success on a device, restart it and allow up to 25 hours before you look again. For a quick test, pick three devices, sync them, restart them and check the device performance tab the next day.

4. Open the network path#

Microsoft recommends bypassing the proxy for the data sharing endpoints. If you can't, choose one of the two documented models:

• User proxy authentication: devices use the signed-in user's WinINET proxy and the users have proxy permission. It doesn't suit headless devices and is incompatible with Defender for Endpoint, which needs DisableEnterpriseAuthProxy set to 1 while this model needs 0.
• Device proxy authentication: devices reach the proxy through WinHTTP in the local system context (netsh winhttp set proxy, WPAD or a transparent proxy), WinINET proxy is per machine (Make proxy settings per-machine (rather than per-user)), and the proxy authenticates computer accounts with Windows Integrated Authentication.

Either way, exclude the endpoints from SSL inspection. On a device, check the system proxy that local system services use:

netsh winhttp show proxy

5. Configuration Manager devices#

1. In the console, go to Administration › Cloud Services › Cloud Attach, open CoMgmtSettingsProd and confirm the endpoint analytics option on the Configure upload tab is enabled.
2. On the server with the service connection point, read UXAnalyticsUploadWorker.log for upload errors.
3. In the Devices workspace, check Resultant client settings for a missing device. If endpoint analytics is disabled there, an overriding custom client setting is to blame.
4. Custom client settings with the Computer Agent group that existed before onboarding can show Enable Endpoint analytics data collection as Yes without deploying it. Set it to No, select OK, then reopen it, set Yes and select OK.
5. On the client, check C:\Windows\CCM\Logs\SensorEndpoint.log for Message sent lines and SensorManagedProvider.log for errors processing boot events, then restart the client.
6. If Dataldr.log shows the BROWSER_USAGE_HIST_PK violation, disable the Browser Usage hardware inventory class. Endpoint analytics doesn't use it.

Devices enrolled through both Intune and Configuration Manager appear only once, so you can't create duplicates by fixing both paths. Background on cloud attach is in tenant attach.

Verify the fix#

• Intune data collection policy shows success for the devices you care about.
• After a restart and up to 25 hours, the devices appear on the startup performance Device performance tab with boot and sign-in times.
• The waiting-for-data banner is gone and health statuses move from Insufficient data to Needs attention or Meeting goals.
• For Configuration Manager clients, SensorEndpoint.log keeps logging Message sent and UXAnalyticsUploadWorker.log shows no errors.

Prevent it next time#

• Assign the data collection policy to a broad dynamic device group, so new devices are included automatically.
• Add the endpoint analytics endpoints to your proxy bypass and SSL inspection exclusion lists before rollout, alongside the Intune and Defender endpoints.
• Keep stale devices out of the reports: an Unknown Windows 11 readiness status usually means an inactive device, and device cleanup rules remove them.
• Once data flows, act on it with Remediations, and treat a device that stops reporting like any other sync problem, as in Intune device not checking in.

References#

• Troubleshooting endpoint analytics
• Configure endpoint analytics
• Endpoint analytics overview