Looking at Reporting

After looking at the more basic monitoring in the last chapter, we will now continue to look at the out-of-the-box reports available. We will then extend that to demonstrate how to export the data to use in Power BI and Azure and look at the more advanced Windows Update reporting available using Log Analytics.

Reporting is an important part of any Intune environment for a point-in-time (PIT) snapshot of where you stand, especially if requested by executive members of the organization. This chapter will show you the reports available within Intune, how to run them manually, and how to automate them.

In this chapter, we will cover the following recipes:

• Checking device management reports
• Reviewing endpoint security reports
• Reviewing endpoint analytics reports
• Using Intune Data Warehouse with Power BI
• Checking Windows updates via reporting
• Expanding Windows Update reporting
• Exporting diagnostics to Azure

Technical requirements

For this chapter, you will need a modern web browser and a PowerShell code editor such as Visual Studio Code or PowerShell Integrated Scripting Environment (PowerShell ISE).

All scripts referenced can be found here: https://github.com/PacktPublishing/Microsoft-Intune-Cookbook.

If you wish to test the policies, you will need a corporate-managed device running each device platform for testing. For Linux, it will need to be running Ubuntu Operating System (OS)

Checking device management reports

We will start our review of available reports with those covering all aspects of device management.

Note

These reports are also available within the individual policies in Intune.

Getting ready

To access the device management reports, click the Reports button in the menu. We can find all these under Device management.

Now we have access to the reports, we can review each in turn.

How to do it…

Here, we will run through the large selection of reports available and the data within them.

Reviewing device compliance

We will use the following steps to review device compliance:

1. For device compliance reports, click on the Device compliance option and then click the Reports tab at the top.

   We will start by running through what each of the following reports offers and then how to run them. Apart from device compliance trends, they all have the same mechanism, so the guide to run the reports will apply to all others...

Reviewing endpoint security reports

We now move on to look at all-important security reports. Even if you do not monitor these yourself, you may have security teams or a security operations center (SOC) that need to keep an eye on the security status of your machines. Ideally, everything monitored here will be picked up in a compliance policy, but it is always useful to have reports to fall back on.

How to do it…

All endpoint security report references in this recipe are available under Reports and then Endpoint security.

Once we have accessed the Reports menu in the UI, we can run through each report.

Reviewing Microsoft Defender Antivirus

Within the Endpoint security reports section, click on Microsoft Defender Antivirus and then click the Reports tab, where you will find our two available reports. Here, we will cover them both in further detail.

Antivirus agent status

This report shows the full status of all aspects of the antivirus agent on all devices...

Reviewing endpoint analytics reports

Endpoint analytics is a veritable treasure trove of information that displays not only information for your estate but also a baseline against similar-sized organizations.

As all of the endpoint analytics reports are display-and-export-type reports, which we have covered in the previous recipes in this chapter, rather than providing instructions on how to run them, we will instead cover what each individual report does and how it can help you.

We will then create a single automation script to grab the output from any of the reports quickly and easily.

Getting ready

To find these reports, navigate to Reports and click on Endpoint analytics.

Click on Settings, and make sure the Intune data collection policy setting is showing as Connected.

Now that we know where to find our endpoint analytics reports, we can run through what they all display.

Startup performance

This selection of reports looks at the startup performance, from...

Using Intune Data Warehouse with Power BI

Anyone experienced with Power BI will know that it is a very powerful reporting tool that adds a lot of extra functionality and the ability to customize what you can get out of the box with Intune.

Fortunately, you can use Power BI with Intune Data Warehouse, and, better still, there are preconfigured templates to get you started.

How to do it…

Follow these steps to configure Data Warehouse with your tenant:

1. Navigate to Reports and click on Data warehouse.

   On this screen, you can grab the URL for manual data ingestion, but in this example, we will use the preconfigured template instead.

   At the end of this section, we will include some links to useful blog posts and a video for more of a deep dive into the functionality.

2. For now, click on the Get Power BI app link.
3. In the Intune Compliance (Data Warehouse) application window, click Get it now.
4. This will transfer you to Power BI, and after a few minutes, it will...

Checking Windows updates via reporting

Windows Update reports are likely to be the most useful and most used reports within Intune, as tracking the status of Windows Updates is key to security across the estate. We will start by looking at the built-in reports, and then in the next recipe will take things further and introduce Log Analytics for finer control.

Due to the extra selections required to generate these reports, the inputs do not lend themselves to automation as it would be a similar number of textboxes and clicks to achieve the same result. Therefore, in this recipe, we will not cover automating them. If, however, this is of interest, it uses the same export/import POST requests as with many of the earlier reports here.

Getting ready

Within the Intune portal, click on Reports, then click Windows updates, and finally, click the Reports tab.

How to do it…

There are multiple reports available here, so we will start by looking at how to run them, and then...

Expanding Windows Update reporting

While the built-in Intune reports are excellent, we can take this one step further by leveraging Log Analytics to give us further data and manipulation and real-time analytics.

Getting ready

For this recipe, we will need to create a Log Analytics workspace within Azure (there is no charge for Windows Update data, though).

How to do it…

Follow these steps to configure Windows Update for Business reports:

1. Navigate to https://portal.azure.com and search for Log Analytics workspaces.
2. Click Create.
3. Select your Subscription type and either select or create a new Resource group type.
4. Then, name your workspace and click Review and Create.
5. If all looks OK, click Create.
6. Back in the Azure portal, click Monitor.
7. Then, click on View under Workbooks.
8. Scroll down to Insights and select Windows Update for Business Reports.
9. Click Get Started.
10. Select your subscription and the workspace we created earlier...

Exporting diagnostics to Azure

The final recipe in this chapter also uses Azure, but this time to store Intune logs and diagnostic data in a variety of locations, listed as follows:

• A Log Analytics workspace
• Azure Blob storage
• An event hub: You can learn more about this at the following URL:

  https://learn.microsoft.com/en-gb/azure/azure-monitor//partners?WT.mc_id=Portal-Microsoft_Azure_Monitoring

• A partner solution: Learn more about this at the following URL:

  https://learn.microsoft.com/en-us/azure/partner-solutions/overview

In this example, we are going to use a Log Analytics workspace as it offers a greater feature set than Blob storage.

Getting ready

Again, for this one, we are going to need a Log Analytics workspace. This one will incur costs, though, so make sure you set up a cost warning if you deploy and then forget you have done so.

In the Azure portal, select Log Analytics workspace and press Create new. Create your workspace and make a note...