Forum Discussion

endakelly's avatar
endakelly
Brass Contributor
May 25, 2020

Matching SharePoint machine ID to Intune

I am looking at some sharepoint logs for an alert but I cannot tell if the machine being used is one that is managed by our Intune or not. The machine ID from the sharepoint logs does not correspond ...
endakelly's avatar
endakelly
Brass Contributor
May 28, 2020

The plot thickens on this one. So I was investigating another incident this morning and copied the machine id and checked it against Intune. Looking at the hardware properties for the users machines I found an attribute called UDID which is a perfect match 😄

 

Problem is, this attribute is not exposed in the graph api from what I can see so far using the https://graph.microsoft.com/v1.0/users/UPN/managedDevices query (same with beta).

 

This device was a Mac and this attribute looks to be unique to them. No attributes for Windows have matching Machine IDs.

 

Machine ID is only an attribute on the FileSyncDownloadedFull operation which isn't a massive deal but it would be nice to be able to correlate Machine IDs with FileDelete and FolderDelete operations too so you can be sure if a mass delete happened from a managed device or not.

 

Is it possible to have this UDID attribute exposed to the graph api or is there another query I should be using?

Resources