By: Spencer Shumway - Program Manager | Microsoft Endpoint Manager - Intune
We’ve been working hard since announcing a new reporting framework at last year’s Ignite conference and wanted to provide an update on some new reports that have shipped as well as the current list of migrated/new reports all up. We’d also like to lightly cover the different report types we’ve identified and are delivering:
Organizational reports are generally broad, contain aggregate data/visualizations, and may be less frequently accessed. You can see the entire estate of the report area (like all of your device compliance) with these reports. Reports of this type are usually located in the Reports menu item on the main left navigation of the MEM console.
Operational reports are live, and usually have a negative focus to trim down the data to only what an admin needs to take action. You will often see only a subset of your data (like just the non-compliant devices) with these reports. These reports are usually shown inline with the devices or apps workloads in their respective Monitor tabs.
Historical reports show aggregate data over a period of time, typically with daily data points. These can be found throughout the console.
Resource reports are located on individual resources like a single app, a single policy, or a single device. When you click on an app you will see examples of resource reports in the Device install status and the user install status report. These report types are operational in nature- as they support troubleshooting and remediation actions, but are defined mainly by where you can find them in the console.
List view reports aren’t reports in the traditional sense, but they do convey information in the form of lists of objects. As these lists grow in size, they benefit from our reporting framework sort, search, filter, export, and paging controls and so are candidates for migration. A good example of a list view that is supported by our reporting framework is the All devices blade.
Specialist reports are reports that have been published as diagnostic settings in Azure Monitor after migrating to our new reporting framework. Once available as a diagnostic setting, you can select a destination for your data to be published- event hub, storage, or Log Analytics. These various destinations enable integration with security information and event management (SIEM) tools, custom alerting, custom aggregation and business logic, external data joins, and long term storage.
We also want to call out that as part of our new reporting framework, we’ve made available an export API that can reliably download a compressed CSV file containing the contents of the report in minutes instead of the hours it might have used to take. For reports that are available in this API we strongly
recommend that you no longer page through the reports using the Get-MSGraphNextPage or Get-MSGraphAllPages cmdlets. Those cmdlets may have worse performance, or even stop working. You should instead use the new export API as we’ve shown here.
We also plan on making changes to the way we render data in the console to limit reports to rendering 500,000 rows. While sort will only take place on the 500,000 rows displayed, search, filter, and export will still work across the entire dataset, so we recommend using search and filter to narrow the scope of a report that you need to interact with in the UI. If you need access to the full dataset you can quickly download it via export in the UI, or our export API.
Here is the total list of reports now supported by our new framework:
Windows 10 feature updates organizational report (Reports > Windows updates(Preview))
Windows 10 feature updates operational report (Devices > Monitor)
Group policy migration readiness organizational report (Reports > Group policy analytics (Preview))
As a reminder, our sprints are year-month (YYMM), so 1911 was the November 2019 release and 2009 is the September 2020 release.
We will keep posting updates as more reports become available as part of our reporting framework improvements. We’d love to hear any questions or feedback - You can comment on this post or reach out to us on Twitter @spencershum or @IntuneSuppTeam.
Blog post updates:
9/28/20: The "Windows Feature Updates Operational and Organizational reports" is dependent on some internal engineering iterations and is rolling out over the next couple weeks so you might not see it immediately in the user interface.