Good morning, Internet! At first glance, this post may appear a weeee bit thin ... but sometimes, less is more. Who doesn't need/want more reporting/visualizations and tracking of what’s going on within an environment?
I think it's safe to say that when it comes to "Reporting," it often feels like less actually is 'less' (and sometimes, 'more' is even less 'less,' or 'more less?' How should one say that?). Reporting is never 'enough' or 'done' but we steadily expand and improve that aspect of our services - and we're constantly doing more. Soon, Security Copilot will aim AI and LLMs at your Entra, Intune, Defender and other signals haystacks, helping to illuminate the needles there - and Intune has two features coming soon called 'Device Assistant' and 'Settings Assistant' that both look to be super-helpful (check out this recent Technical Takeoff vid for some good news there).
Does anyone remember those pixelated posters that had a 'hidden' 3-D image within them? If you just sorta looked at it for a while, you'd see something that wasn't obvious and that you didn't see at all, at first. There was a Seinfeld episode where Mr. Pitt couldn't see the hidden image.
I find reporting in our cloud services can be like that sometimes. When I've juuuuuust about given up looking/clicking through Reports, I stumble upon what I need - but it might be presented in a way that I wasn't expecting. Sometimes, 'the thing' I'm looking for might be found on a seemingly unrelated report. If you don't find what you're looking for right away, don't get deterred. KEEP CLICKING. Heck, sometimes, a certain 'view' in the portal exposes exactly what I am looking for - though it's not a Report, by definition. Always check the 'Column' button and filters, and of course use the glorious 'Export' and/or 'Download' button for CSVs where you can sort/filter/combine via Excel, if needed.
Here are a few extra handy and/or obscure reports
- Microsoft Intune reports - Microsoft Intune | Microsoft Learn
- This one took me a bit to find - I was looking for A/V details (Anti-malware versions, Engine versions and Signatures) along with the dates/times.
- Microsoft Entra ID Protection overview preview | Microsoft Learn
- Conditional Access insights and reporting workbook | Microsoft Learn
Don't confine your quest for reporting info to only the 'Reports' pages in the portals - once I began looking 'everywhere' for the reporting info I needed, I was amazed at just how much more reporting info there actually is, sprinkled throughout the portal pages.
A series recap (so far):
- The Twelve Days of Blog-mas: No.1 - A Creative Use for Intune Remediations - Microsoft Community Hub
- The Twelve Days of Blog-mas: No.2 - Windows Web Sign in and Passwordless - Microsoft Community Hub
- The Twelve Days of Blog-mas: No.3 - Windows Local Admin Password Solution (LAPS) - Microsoft Communi...
- The Twelve Days of Blog-mas: No.4 - Sync Cloud Groups from AAD/Entra ID back to Active Directory - Microsoft Community Hub
- The Twelve Days of Blog-mas: No.5 - The Endpoint Management Jigsaw - Microsoft Community Hub
Hilde
Updated Dec 06, 2023
Version 3.0MichaelHildebrand
Microsoft
Joined August 13, 2018
Core Infrastructure and Security Blog
Follow this blog board to get notified when there's new activity