Edit

Share via

remoteActionAudit resource type

Namespace: microsoft.graph

Important: Microsoft supports Intune /beta APIs, but they are subject to more frequent change. Microsoft recommends using version v1.0 when possible. Check an API's availability in version v1.0 using the Version selector.

Note: The Microsoft Graph API for Intune requires an active Intune license for the tenant.

Report of remote actions initiated on the devices belonging to a certain tenant.

Methods

Method Return Type Description
List remoteActionAudits remoteActionAudit collection List properties and relationships of the remoteActionAudit objects.
Get remoteActionAudit remoteActionAudit Read properties and relationships of the remoteActionAudit object.
Create remoteActionAudit remoteActionAudit Create a new remoteActionAudit object.
Delete remoteActionAudit None Deletes a remoteActionAudit.
Update remoteActionAudit remoteActionAudit Update the properties of a remoteActionAudit object.

Properties

Property Type Description
id String Report Id.
deviceDisplayName String Intune device name.
userName String [deprecated] Please use InitiatedByUserPrincipalName instead.
initiatedByUserPrincipalName String User who initiated the device action, format is UPN.
action remoteAction The action name. Possible values are: unknown, factoryReset, removeCompanyData, resetPasscode, remoteLock, enableLostMode, disableLostMode, locateDevice, rebootNow, recoverPasscode, cleanWindowsDevice, logoutSharedAppleDeviceActiveUser, quickScan, fullScan, windowsDefenderUpdateSignatures, factoryResetKeepEnrollmentData, updateDeviceAccount, automaticRedeployment, shutDown, rotateBitLockerKeys, rotateFileVaultKey, getFileVaultKey, setDeviceName, activateDeviceEsim, deprovision, disable, reenable, moveDeviceToOrganizationalUnit, initiateMobileDeviceManagementKeyRecovery, initiateOnDemandProactiveRemediation, rotateLocalAdminPassword, unknownFutureValue, launchRemoteHelp, revokeAppleVppLicenses, removeDeviceFirmwareConfigurationInterfaceManagement, pauseConfigurationRefresh, initiateDeviceAttestation, changeAssignments, delete.
requestDateTime DateTimeOffset Time when the action was issued, given in UTC.
deviceOwnerUserPrincipalName String Upn of the device owner.
deviceIMEI String IMEI of the device.
actionState actionState Action state. Possible values are: none, pending, canceled, active, done, failed, notSupported.
managedDeviceId String Action target.
deviceActionDetails keyValuePair_2OfString_String collection DeviceAction details
deviceActionCategory deviceActionCategory DeviceAction category. Possible values are: single, bulk.
bulkDeviceActionId String BulkAction ID

Relationships

None

JSON Representation

Here is a JSON representation of the resource.

{
  "@odata.type": "#microsoft.graph.remoteActionAudit",
  "id": "String (identifier)",
  "deviceDisplayName": "String",
  "userName": "String",
  "initiatedByUserPrincipalName": "String",
  "action": "String",
  "requestDateTime": "String (timestamp)",
  "deviceOwnerUserPrincipalName": "String",
  "deviceIMEI": "String",
  "actionState": "String",
  "managedDeviceId": "String",
  "deviceActionDetails": [
    {
      "@odata.type": "microsoft.graph.keyValuePair_2OfString_String"
    }
  ],
  "deviceActionCategory": "String",
  "bulkDeviceActionId": "String"
}
  • Last updated on