Let’s discuss how to use Intune Explorer with Security Copilot to Access Devices Users Apps Compliance and Update Details. Explorer in Microsoft Intune is a powerful tool that helps IT admins search and explore their organization’s data using natural language.
Instead of writing complex queries, Explorer in Intune lets you simply type what you are looking for using natural language with simple words. Explorer will automatically understand your intent and fetch the relevant data. This makes it easier for IT admins to quickly access important device or user information without needing advanced query skills.
Explorer works by linking your natural language request to pre-defined query views available in Intune. These built-in views are used to handle common scenarios such as checking compliance status, tracking app deployments, or monitoring user activity. Depending on the query, it may prompt you to provide additional details such as the platform type or a specific device or a user name etc.
In this post, you will learn how to use Explorer in Intune to easily find information about devices, users, apps, compliance status, and updates. You will also get to know the different categories available in Explorer and how each one helps you manage and troubleshoot your devices more effectively.
Table of Contents
How to use Explorer in Intune to Find Device User App Compliance and Update Data
After the search is done, Explorer provides a Copilot summary, which gives a quick explanation of the results and even suggests what actions you might take next. You can also take action directly from the results. Use the data to create custom reports, add users or devices to Azure AD groups, or target apps and policies more effectively. This makes troubleshooting and decision-making much faster and smarter.
- How Microsoft Security Copilot Improves Intune Admin Center Efficiency
- Copilot with Endpoint Privilege Manager to Identify Potential Elevation Risks using Intune
- Best Copilot Assistance for Querying Device Inventory Data using KQL in Intune
- Easy way to Disable GitHub Copilot in Visual Studio using
Prerequisites to use Explorer in Microsoft Intune
You can easily use the Explorer feature in Intune; there are a couple of things you need to set up first. Security Copilot must be enabled in your tenant, as Explorer relies on its AI capabilities to process natural language queries.
- Also, you need to sign in to the Intune admin center using an account that has the right permissions.
- Specifically, the account should have either the Copilot Owner or Copilot Contributor role assigned.
- Without these, you won’t be able to access or use the Explorer feature effectively.
| Steps |
|---|
| Sign in to the Intune admin center |
| Tenant Administration |
| Copilot |
| Copilot in Intune > Available |
Overview of Security Copilot with Microsoft Intune
Explore Data by Device App and Management Properties
With Explorer in Intune, you can search and view data from your tenant. This allows you to quickly find specific information. By using simple search terms, you can get detailed insights and take action based on the results. Sign in to the Intune admin center.
- Go to Explorer tab on the Left side of Intune admin center
Different Categories Available in Intune Explorer
In Intune Explorer, you can use different categories to make your search easier and more focused. These categories help you find the exact information you need without going through everything manually. The below table helps you to show more details about the explorer category.
| Different Categories Available in Intune Explorer |
|---|
| App Configuration |
| App Protection |
| Apps |
| Compliance |
| Device Configuration |
| Device Updates |
| Devices |
| All categories |
All Categories in Intune Explorer
In “All Categories” within Intune Explorer, you can access a wide range of information covering different areas such as devices, device configuration, apps, compliance, app protection, and more. This category provides a broader view, allowing you to run queries across multiple data types at once.
The list below helps you explore the different types of data available under “All Categories” and gives you a better understanding of how to manage and monitor your Intune environment more effectively.
- Devices
- Get Platform devices
- Devices
- Get Platform devices that are Ownership owned and have a compliance grace period ending before Date
- Device Configuration
- Get policies that have settings configured where the setting name contains Setting Name
- Apps
- Get Managed App Type applications
- Device Configuration
- Get policies that have settings configured where the setting name contains Setting Name and the policy has the status Device Configuration Setting Status
- Compliance
- Get devices that are Compliance state
- Compliance
- Get devices that are noncompliant due to not having any compliance policy assigned
- Devices
- Get devices where encryption method type is Encryption Method and encryption is True False
- App Protection
- Get users that are using managed mobile apps that have an App Protection Policy applied and are not running on the OS Version
App Configuration Categories in Intune Explorer
The App Configuration category in Intune Explorer helps you to run queries related to managed mobile apps and the users assigned to them. You can easily find apps with App Configuration Policies applied based on OS version, Intune App SDK version, or last check-in time with Intune.
- App Configuration
- Get managed mobile apps that have an App Configuration Policy applied and are running on OS Version
- Get users who have devices where the last check in with Intune is before Last Check In Date Time and have an App Configuration Policy applied
- Get users that are using managed mobile apps that have an App Configuration Policy applied and are not running on the OS Version Os Version
- Get users that are using a managed mobile app that has an App Configuration Policy applied and is not on the Intune App SDK version Mam Sdk Version
- Get all users and apps that have received App Configuration policies
- Get managed mobile apps that have an App Configuration Policy applied and are running on OS Version less than Os Version
- Get managed mobile apps that have an App Configuration Policy applied and are running on OS Version greater than Os Version
- Get managed mobile apps that have an App Configuration Policy applied, and the Intune App SDK version is greater than Mam Sdk Version
- Get users using devices with Os Version and with an App Configuration Policy applied where the last check in with Intune is before Last Check In Date Time
App Protection
Microsoft Intune provides powerful capabilities to monitor and manage mobile apps that have App Protection Policies (APP) applied. You can identify managed apps and users based on various parameters such as OS version, Intune App SDK version, and last check-in time with Intune.
- App Protection
- Get managed mobile apps that have an App Protection Policy applied and are running on OS Version less than Os Version
- Get managed mobile apps that have an App Protection Policy applied and are running on OS Version
- Get users who have devices where the last check in with Intune is before Last Check In Date Time and have an App Protection Policy applied
- Get users that are using managed mobile apps that have an App Protection Policy applied and are not running on the OS Version
- Get users using devices with OS Version and with an App Protection Policy applied where the last check in with Intune is before Last Check In Date Time
- Get managed mobile apps that have an App Protection Policy applied, and the Intune App SDK version is less than Mam Sdk Version
- Get managed mobile apps that have an App Protection Policy applied, and the Intune App SDK version is Mam Sdk Version
- Get users that are using a managed mobile app that has an App Protection Policy applied and is not on the Intune App SDK version Mam Sdk Version
- Get users using a managed mobile app with the name Managed Mobile App Name and have an App Protection Policy applied and have devices where the last check in with Intune is before Last Check In Date Time
App Categories in Intune Explorer
Microsoft Intune helps administrators gain deep insights into the deployment and installation status of managed apps across all platforms and users. You can retrieve app install results for specific users, view the distribution of app versions by platform, and identify devices with or without specific apps installed.
- Apps
- Get the current deployment status of Managed App across all devices
- Get all managed app install results for user /User
- Get Managed App Type applications
- Get the distribution of app versions for managed app /Managed App on Platform
- Get users that have App Version or newer of App Name published by Publisher on Platform
- Get Platform devices that have discovered app with name containing App Name installed
- Get users that are not on OS version or newer of Platform and also don’t have App Name installed
- Get devices that are non-compliant for conditional access and failed to install/Managed App on Platform
- Get the top Number Of Apps apps with the highest number of App Install Status on Managed App Platform
Compliance Categories in Intune Explorer
Microsoft Intune provides robust compliance reporting to help IT admins monitor and enforce device compliance across platforms. You can retrieve lists of devices based on their compliance state, device ownership, platform type, or specific compliance settings.
- Compliance
- Get devices that are Compliance state
- Get Platform Devices that are Compliance state
- Get devices that are noncompliant due to not having any compliance policy assigned
- Get Platform devices that are noncompliant due to not having any compliance policy assigned
- Get devices thatfare Ownership owned and are Compliance state due to the compliance setting Compliance Setting
- Get Platform devices that are Ownership owned and are Compliance state due to the compliance setting Compliance Setting Name
- Get Platform devices that are Compliance state due to the compliance setting Compliance Setting Name
- Get devices that have Compliance set to “NONCOMPLIANT” or “ERROR”
Device Configuration Categories in Intune Explorer
Intune enables detailed tracking and management of device configuration policies to ensure consistent policy enforcement across the organization. You can retrieve policies based on their status, specific settings configured, policy type, or whether they were created from a particular template.
- Device Configuration
- Get device configuration policies that have the status Device Configuration Policy status
- Get policies that have settings configured where the setting name contains Setting Name
- Get device configuration policies that areof the type Device Configuration Policy Type Name
- Get policies that have settings configured where the setting name contains Setting Name and the policy has the status Device Configuration Setting Status
- Get device configuration policies that are not of the type Device Configuration Policy Type Name
- Get device configuration policies of policy type Device Configuration Policy Type Name that have the setting Name
- Get device configuration policies that were not created from the template/Device Configuration Policy Template
- Get device configuration policies that were created from the template /Device Configuration Policy Template
Device Updates Categories in Intune Explorer
Microsoft Intune provides comprehensive insights into the update status of Windows devices, including feature updates, quality updates, and driver updates. Admins can track the distribution and status of updates, identify devices that are up-to-date or pending restart, and monitor the impact of Windows Feature and Driver Update Policies.
- Device Updates
- Get the distribution of feature updates
- Get the top alerts across all Windows feature updates
- Get the current update states for all driver update for device /Device
- Get all expedited quality updates that are not yet installed for device /Device
- Get statuses for devices for the driver update policy /Windows Driver Update Policy
- Get devices that are up-to-date for the feature update policy /Windows Feature Update Policy, where devices that are ready to restart are included as up-to-date
- Get the statuses of devices that have a driver with the driver class Driver Class
- Get devices that have alert Alert Name or Windows expedited updates
- Get devices that are up-to-date, including devices that are pending restart, for latest expedited quality update
Device Categories in Intune Explorer
Intune offers detailed visibility into managed devices. It allows IT admins to filter and analyze devices by platform, enrollment details, ownership, and compliance status. You can retrieve devices enrolled by specific users, identify those with names matching certain patterns, or monitor compliance grace periods and encryption status.
- Devices
- Get Platform devices Devices
- Get devices enrolled by /User
- Get devices that have a device name containing Device Name
- Get Platform devices that have a compliance grace period ending before Date
- Get Platform devices that are enrolled by/User and Ownership owned
- Get Platform devices that are Ownership owned and have a compliance grace period ending before Date
- Get devices where encryption method type is Encryption Method and encryption is True False
- Get noncompliant devices that are not within their compliance grace period
- Get devices that were enrolled by /User where the last user signed in is /User
Need Further Assistance or Have Technical Questions?
Join the LinkedIn Page and Telegram group to get the latest step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, join the WhatsApp Community to get the latest news on Microsoft Technologies. We are there on Reddit as well.
Author
Anoop C Nair has been Microsoft MVP for 10 consecutive years from 2015 onwards. He is a Workplace Solution Architect with more than 22+ years of experience in Workplace technologies. He is a Blogger, Speaker, and Local User Group Community leader. His primary focus is on Device Management technologies like SCCM and Intune. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security, Career, etc.