Intune Advanced Analytics & Multi-Device Query
Implementation Effort: Medium – Requires enabling Properties Catalog collection policies and training admins on KQL for Multi-Device Query.
User Impact: Low – Operates silently in the background; no end-user interaction required.
Video Walkthrough
Overview
Microsoft Intune Advanced Analytics provides real-time, fleet-wide visibility into endpoint health, hardware/software inventory, registry state, and security posture using Kusto Query Language (KQL) Multi-Device Query and anomaly detection.
Key 2025–2026 updates include:
- Included in Microsoft 365 E3 and E5 (June 2026 / 2606): Advanced Analytics is now included in Microsoft 365 E3 (EMS E3) and Microsoft 365 E5 without requiring a separate add-on.
- Properties Catalog – Windows Registry & System Info Collection (2510 / July 2026): Admins can define Properties Catalog policies to collect
System Info, Local AI Agent (OpenClaw) presence, and custom Windows Registry keys and values (HKEY_LOCAL_MACHINE) across enrolled Windows devices without deploying custom PowerShell scripts. - Enhanced App Inventory & Multi-Device App Query (May 2026 / In Development): Delivers faster, richer application inventory on Windows and extends KQL Multi-Device Query to search installed applications across the entire fleet for vulnerability triage and compliance.
- Actionable Query Results (April 2026 / 2604): Admins can search and filter across multi-device query results, click directly into device pages, and create Microsoft Entra security groups directly from a KQL query's device results for immediate remediation targeting.
- Android BYOD Work Profile Inventory (August 2026 / 2608): Extends Device Inventory and Multi-Device Query to personally owned Android Enterprise devices with a work profile (via AMAPI).