Monitoring Your New Environment

One of the best aspects of modern device management is that a well-configured environment can free up staff resources to work on being more proactive, spotting and resolving issues before the end users find them. To do that, we are going to use the tools included in Intune, starting in this chapter with a look at monitoring tools, and then continuing the theme in the next chapter when we will look at reporting.

In this chapter, we will cover the following recipes:

• Monitoring applications
• Monitoring device configuration
• Monitoring device compliance
• Monitoring device enrollment
• Monitoring updates across platforms
• Monitoring device actions
• Reviewing audit logs

Technical requirements

For this chapter, you will need a modern web browser and a PowerShell code editor such as Visual Studio Code or PowerShell ISE.

All the scripts referenced can be found here: https://github.com/PacktPublishing/Microsoft-Intune-Cookbook.

If you wish to test the policies, you will need a corporate-managed device running each supported platform (Windows, iOS, macOS, Linux, and Android). For Linux, it will need to be running Ubuntu OS.

Monitoring applications

In this recipe, we will be looking at application monitoring. There are a few options within this category, so we will cover each of them and then look at how to grab the same information via Graph. As these reports are all output-only, there is nothing to create, but we will cover the export functionality.

Getting ready

For all of the monitoring reports covered here, we need to navigate to Apps and then click on Monitor.

How to do it...

We will start by looking at monitoring application licenses and then run through the others in the order they appear within Intune:

Figure 9.1 – Monitor apps menu

App licenses

Our first menu option is App licenses.

This is for store-based applications only (Apple, Microsoft, and Google Play Store). As we covered in Chapter 6, when deploying an application using Apple Volume Purchase, you select the number of licenses to make available for each application. If you have free...

Monitoring device configuration

Now that we know how to monitor our applications, we can look at monitoring the devices themselves, starting with the configuration profiles applied to them.

Getting ready

At the time of writing, the New Devices Experience view is in preview and is available via opt-in. As it is expected that this will become the default, we have used the New Devices Experience view throughout. To enable it, click on Devices, then Overview, and then click the text at the top:

Figure 9.2 – Devices overview screen

In the fly-out, click Try it now.

How to do it...

There are three available monitoring options for device configuration, which we will run through one at a time. To find them, click on Devices and then Configuration (under Manage devices).

In the new experience, you will then be taken to the Monitor tab where you can find our options, which we will now run through.

Devices with restricted apps

This option...

Monitoring device compliance

After monitoring device configuration, we also need to keep an eye on device compliance, especially as this is going to cause the most complaints once users are restricted to non-compliant devices.

Getting ready

To access these reports, click on Devices and then Compliance.

You will then be taken to the Monitor tab where we can access our next six reports.

How to do it...

We will start by looking at non-compliant devices and then run through the other available reports.

Noncompliant devices

Starting with noncompliant devices, this report is fairly self-explanatory and displays any devices across all platforms (including Linux) that are failing any compliance policy applied. If a device has multiple policies, a single failure will send the whole device into non-compliance.

You have the standard columns and Export button, along with a search option to search device name, device ID, username, user email, user ID, IMEI, or serial number...

Monitoring device enrollment

While we can now monitor our device compliance and configuration, that is of no use if the devices have failed to enroll. For that, we need to use the device enrollment monitoring options. These are especially useful when users are self-enrolling devices to look for any errors and to assist in troubleshooting.

Getting ready

To access these reports, click on Devices and then Enrollment.

This will take you to the Monitor panel where you can find our available options, which we will now cover in more detail.

How to do it...

We will start by looking at enrollment failures and then run through each report available.

Enrollment failures

We start with enrollment failures, which is a cross-platform report on all failed enrollments using any supported enrollment method. It also includes error details, which are especially useful.

The first thing to check is the powerful filter available here, which can look at the platform, error type, enrollment...

Monitoring updates across platforms

One key requirement for most environments is keeping your devices updated with the latest security patches. While Intune has systems to do the updating for you, there is always the chance that some devices will have issues installing the updates. To check these, we have the functionality to check the update status for Windows, iOS, and macOS (no Android at present).

Getting ready

To access these reports, we need to navigate to Devices in the Intune menu. Each is in a different location, which will be covered for each individual report.

How to do it...

We will start this recipe by looking at Windows updates before moving on to iOS and macOS.

Windows updates

Within Devices, click on Windows 10 and later updates.

This then gives you an overview of the following:

• Update ring device status – This shows any devices that have issues with the update ring policies themselves, not at the individual update level.
• Feature...

Monitoring device actions

As an Intune administrator, especially in a larger organization, it is essential to have an audit trail as there are buttons within the console that can have serious effects. Imagine someone accidentally clicks Wipe on the wrong device and you need to find out what happened for an incident report. Fortunately, these are all logged in Device actions, which we will cover now.

Getting ready

To access these logs, click on Devices, then Overview, and finally, click on the Device actions box.

How to do it...

On this screen, you will be presented with a list of all actions taken against all devices (cross-platform), including what was performed, when, and by whom.

There is no search functionality and you cannot sort on the headers (use the automated script to add this functionality), but it does have a powerful filter that includes every possible action across all device types:

Figure 9.8 – Device actions filter

...

Reviewing audit logs

In the last recipe, we covered auditing actions taken directly on devices, which, while they can have a high impact, are on an individual device level, so less likely to cause significant issues. If, however, policies are amended, deleted, or created, there is a far greater chance of issues at a larger level. To monitor for such changes, we need to delve into the audit logs.

Getting ready

To access audit logs, click on Tenant administration | Audit logs.

How to do it...

Once you are on the Audit logs page, you will be presented with a familiar report-type screen. Again, there is a powerful filter option at the top, including the ability to filter on the activity. Be warned, however, that this is a long list and does not have any search functionality built in, so make sure you are selecting the correct option when using it.

The search box allows you to find the person who made the change and you can also sort by date and activity (but not the other...