跳到主要內容

Intune Advanced Analytics & Multi-Device Query

Implementation Effort: Medium – Requires enabling Properties Catalog collection policies and training admins on KQL for Multi-Device Query.

User Impact: Low – Operates silently in the background; no end-user interaction required.

Video Walkthrough​

Overview​

Microsoft Intune Advanced Analytics provides real-time, fleet-wide visibility into endpoint health, hardware/software inventory, registry state, and security posture using Kusto Query Language (KQL) Multi-Device Query and anomaly detection.

Key 2025–2026 updates include:

  • Included in Microsoft 365 E3 and E5 (June 2026 / 2606): Advanced Analytics is now included in Microsoft 365 E3 (EMS E3) and Microsoft 365 E5 without requiring a separate add-on.
  • Properties Catalog – Windows Registry & System Info Collection (2510 / July 2026): Admins can define Properties Catalog policies to collect System Info, Local AI Agent (OpenClaw) presence, and custom Windows Registry keys and values (HKEY_LOCAL_MACHINE) across enrolled Windows devices without deploying custom PowerShell scripts.
  • Enhanced App Inventory & Multi-Device App Query (May 2026 / In Development): Delivers faster, richer application inventory on Windows and extends KQL Multi-Device Query to search installed applications across the entire fleet for vulnerability triage and compliance.
  • Actionable Query Results (April 2026 / 2604): Admins can search and filter across multi-device query results, click directly into device pages, and create Microsoft Entra security groups directly from a KQL query's device results for immediate remediation targeting.
  • Android BYOD Work Profile Inventory (August 2026 / 2608): Extends Device Inventory and Multi-Device Query to personally owned Android Enterprise devices with a work profile (via AMAPI).

Implementation Guidance​

  1. Confirm prerequisites first: licensing, device enrollment state, data collection readiness, and role-based access for the IT staff who will use the feature. Decide which teams need read-only visibility versus those who can act on findings.
  2. In the Intune admin center, review the Endpoint Analytics and Advanced Analytics areas and pilot with a representative set of managed Windows devices. Make sure the data you expect to analyze is actually flowing before promising outcomes to stakeholders.
  3. Define operational use cases up front. Common examples include detecting performance regressions after a policy change, investigating device startup or application issues, and using device query capabilities to find machines with a risky configuration or outdated component.
  4. Link findings to action. If analytics identifies poor restart behavior, app failures, or resource issues, route those findings into your support, engineering, or security workflows rather than treating the tool as a passive dashboard.
  5. Review analytics trend lines after major policy, image, or update changes. This makes the feature much more valuable than occasional ad hoc troubleshooting.

Reference​