Using Intune Advanced Analytics for endpoint troubleshooting

Advanced Analytics extends Endpoint Analytics with deeper fleet insights and interactive troubleshooting. The value comes from embedding it into support and lifecycle processes, not simply enabling another dashboard.

Know the core capabilities

Capability	Best use	Data timing
Single-device query	Real-time investigation of a selected Windows device	On demand; device must be online and reachable through WNS
Multiple-device query	Fleet inventory and trend analysis using supported KQL	Based on available inventory data
Device timeline	Correlate crashes, boots, sign-ins and anomalies	Most events appear within 24 hours
Resource performance	Identify CPU and RAM pressure and poor-performing cohorts	Analytics refresh
Battery health	Target warranty replacement and lifecycle decisions	Analytics refresh

Check prerequisites

Eligible licensing is provisioned.
Windows devices are Intune managed or supported co-managed devices.
Devices are Microsoft Entra joined or hybrid joined as required by the feature.
Windows Push Notification Services is reachable for real-time device query.
RBAC includes Managed Devices/Query and device read visibility.
Privacy, data retention and support-use guidance are documented.

Use single-device query

Go to Devices > Windows > select a device > Device Query. Start with small, targeted queries that answer a support question.

Example KQL patterns

Processes
| where ProcessName contains "msedge"
| project ProcessName, ProcessId, WorkingSetSizeBytes
| top 10 by WorkingSetSizeBytes desc

WindowsRegistry
| where Key == @"HKEY_LOCAL_MACHINE\SOFTWARE\Contoso\Agent"
| project ValueName, ValueData

Supported tables and operators differ from full Azure Data Explorer KQL. Validate queries in the Intune interface and maintain approved examples in the service-desk knowledge base.

Use fleet query for trend analysis

Go to Devices > Device query to query multiple devices. Use it for software-version exposure, service-state checks, configuration drift and hardware inventory. Export results where needed, noting that Advanced Analytics does not provide a general-purpose connector into every monitoring platform.

Change the support workflow

Define the initial ticket symptom.
Run a saved query for service state, application version, registry configuration or resource pressure.
Use the device timeline to correlate the issue with updates, crashes or sign-ins.
Apply an approved remote action or remediation where appropriate.
Record query results and resolution in the ticket.
Escalate to Remote Help only when the issue cannot be resolved through non-interactive diagnostics.

Use analytics for lifecycle decisions

Battery health and resource-performance reports can support evidence-based replacement rather than age-only replacement. Combine the data with warranty, model, incident and user-impact information before making procurement decisions.

Validate data quality

Compare a sample of query results with device-side PowerShell or Task Manager.
Confirm offline devices and blocked WNS are not interpreted as healthy.
Check that pilot devices have restarted after policy enablement where required.
Document typical data latency for each report.
Use RBAC and scope tags to limit access to device information.

Microsoft references

Review note: Microsoft cloud licensing, rollout dates and portal labels can change. Validate your tenant, Message Centre notices and current documentation before production implementation.