Intune DeviceType Reference for Azure Sentinel KQL

As you start to connect your Intune/Endpoint Manager logs to Azure Sentinel, you may see right away that there’s a DeviceType column exposed that looks valuable but the results show ID numbers instead of just device names. This DeviceType column is directly related to the DeviceTypeID for Intune device entities.

As an example, the following simple KQL query queries the IntuneDeviceComplianceOrg table that is generated due to following the instructions for connecting Intune/Endpoint Manager to your Azure Sentinel Log Analytics workspace.

IntuneDeviceComplianceOrg
| where TimeGenerated > ago(3d)
| where isnotempty(DeviceName)
| distinct DeviceName, DeviceType, SerialNumber

The results look like the following:

Querying the IntuneDeviceComplianceOrg table in Azure Sentinel

Notice that the DeviceType column shows a code for the actual device name. The codes are officially and permanently located at the following link: DeviceTypes

Always use the location in our Docs platform for the most current information, but, here’s a copy of that to get a quick look at what the DeviceType column provides:

deviceTypeIDNameDescription
0DesktopWindows Desktop device
1WindowsRTWindowsRT device
2WinMO6Windows Mobile 6.0 device
3NokiaNokia device
4WindowsPhoneWindows Phone device
5MacMac device
6WinCEWindows CE device
7WinEmbeddedWindows Embedded device
8IPhoneiPhone device
9IPadiPad device
10IPodiPod device
11AndroidAndroid device-managed using Device Administrator
12ISocConsumeriSoc Consumer device
14MacMDMMac OS X device managed with the built-in MDM agent
15HoloLensHoloLens device
16SurfaceHubSurface Hub device
17AndroidForWorkAndroid device-managed using Android Profile Owner
100BlackberryBlackberry Device
101PalmPalm device
255UnknownUnknown device type
Intune DeviceTypeID’s

So, now, for example, you can use KQL to identify only AndroidForWork devices by using the following KQL query:

IntuneDeviceComplianceOrg
| where TimeGenerated > ago(3d)
| where isnotempty(DeviceName)
| where DeviceType == "17"
| distinct DeviceName, DeviceType, SerialNumber

P.S. I’ve also now included this information in an Azure Sentinel workbook so you can have the information handy: https://github.com/rod-trent/SentinelWorkbooks/blob/master/Intune-EndpointMgrDeviceIDReference.json

Authors

One thought on “Intune DeviceType Reference for Azure Sentinel KQL