Stop scheduling screen shares to read one value. Query the device and have the answer before the call ends.
Intune device query points a Kusto query at a single managed Windows device and brings back live state. The tickets that used to justify a full remote control session, a stalled service, a suspect registry entry, an outdated build, a runaway process, collapse into a one-line query your help desk runs while the caller keeps talking.
- 21 entitiesSlices of device state open to KQL
- 15 a minuteThe hard ceiling on query volume
- Real timeLive answers, never cached inventory
- Corporate ownedRequired device classification
How many of last month's remote sessions were really just a lookup?
Service running or stopped. Registry value present or wrong. Version current or stale. CPU pegged by which process. Each of those is a read operation wearing a remote session as a costume.
- Microsoft lists these very scenarios as candidates to pull off remote control: verifying a running service, reading a registry key behind an app configuration, confirming an installed version, and ranking processes by CPU consumption.
- A screen share means the employee surrenders the machine and the engineer burns minutes on connection and navigation. A query lands its answer in seconds, and for a workforce spread across home offices and time zones, nobody has to coordinate calendars first.
- Repeat investigations are where the math gets interesting. Once a diagnostic lives in the ITSM knowledge base as a saved query, the newest hire on the desk runs it identically to the veteran who wrote it.
- Two honest boundaries: queries read state, they do not change it, and Microsoft notes a user holding local admin rights might be able to alter client-based values in the results, OS version and registry among the examples. Support calls are unaffected; investigations should care.
Eight facts to know before you put it in front of engineers.
A question to the device, answered live
Intune pushes the request to the selected machine and waits for the reply, so the data reflects this minute, not last night's inventory sweep. While a user is mid-complaint about a slow laptop, that freshness is the entire point of the feature.
Twenty-one queryable entities
The published set spans BIOS, certificates, CPU, disk drives, encryptable volumes, files, local groups, local user accounts, logical drives, memory, OS version, processes, system enclosure, system information, TPM, app crash events, drivers, event log, installed updates, registry, and services.
The transport is WNS, and there is no plan B
Windows Push Notification Services delivers the request and carries the result back. Microsoft states it cannot be disabled or bypassed, and a blocked or unreachable WNS means the query simply fails. Anywhere egress traffic is aggressively filtered, verify WNS reachability before promising anyone anything.
Personally owned devices are out of reach
Eligible targets are Windows devices under Intune management, classified as corporate owned, and either Microsoft Entra joined or hybrid joined. If enrollment never assigned ownership deliberately, a chunk of the fleet will refuse queries for a reason nobody remembers setting.
KQL, but a curated slice of it
Support covers a defined subset of the Kusto Query Language across table operators, scalar operators, aggregation functions, and scalar functions. Count, distinct, join, order by, project, take, top, and where are the table operators on offer: ample for a support lookup, deliberately thin for analytics.
Three numbers that bound the tool
Fifteen queries per minute before an error stops you, 2,048 characters of query input, and 128kb of result text before truncation kicks in with a count of the dropped rows. Interactive troubleshooting never notices these limits; a scripted fleet sweep hits all three.
From result to remote action in one screen
Remote device actions can be triggered directly from the query interface based on what came back, with availability varying by platform and configuration. Diagnosis and response share a pane, which quietly removes an entire context switch from the workflow.
A query library beats a query editor
Microsoft's guidance is to save queries for recurring investigations inside your ITSM knowledge base where tier 1 and tier 2 can grab them. A blank KQL prompt serves one specialist; a curated library serves the whole desk, every shift.
Treat query output as the device's testimony, not as forensic evidence.
Microsoft publishes a caveat that changes how results should be weighed in HR matters, incident response, and anything an auditor or insurer might later examine.
- The published limitation: a user with admin access to the device might be able to change client-based information the query returns, with OS version and registry named as examples. The device reports on itself, and an admin controls what the device believes.
- On a routine support call the user wants the problem solved, so this is moot. When the user is the subject of the question, pull corroboration from telemetry outside their reach, Defender for Endpoint data or directory records, before drawing conclusions.
- One field is unreliable even with a cooperative user: on hardware with TPM 2.0 present, the activated and enabled values always come back TRUE. Do not cite that field on a cyber insurance application or a NIST 800-171 self-assessment.
- The registry entity has three published blind spots: the root registry key, 64-bit shared registry keys, and binary value data all return nothing. A blank answer in those categories confirms the limitation, not the key's absence.
Four choices that decide whether the desk keeps using it.
Ticket history writes the library, not guesswork
We pull the recurring lookups from your actual queue, the service checks, registry reads, version confirmations, and CPU rankings Microsoft names as prime candidates, and ship each as a saved query. Nobody on the desk needs to compose KQL to benefit.
Quirks get taught before they get encountered
The rate limit, the input cap, the truncation threshold, the single-quote rule the editor actively contradicts, the missing !like operator. Briefed up front, each is a shrug. Discovered cold, each is a strike against the tool's credibility.
Support lookups and investigations get different rules
Microsoft warns that a local admin might alter the client-based values a query returns, OS version and registry included. We codify the distinction: fine for cooperative troubleshooting, insufficient alone for HR cases, incident response, or anything with legal exposure, where corroborating telemetry is mandatory.
Role design puts the power at tier 1
A custom role carrying Managed Devices Query plus the visibility read permissions usually fits tighter than Help Desk Operator, and the least-privilege story reads well under SOC 2 review. More importantly, when tier 1 holds the permission, checks stop turning into escalations.
Four phases in roughly three weeks, fully remote.
- 01Week 1
Prove the prerequisites hold
Advanced Analytics licensing in place, devices carrying the corporate owned flag and an Entra join state, and WNS reachable from every network segment where managed devices live. Filtered egress is where this phase finds its surprises.
- Advanced Analytics entitlement confirmed
- Corporate owned device count established
- Join state verified across the estate
- WNS reachability tested from filtered segments
- 02Weeks 1-2
Wire up least-privilege access
Either the Help Desk Operator role or a custom role pairing the Managed Devices Query permission with the read permissions that grant visibility into managed devices. The design goal: a tier 1 engineer answers the question personally instead of opening an escalation.
- Role assignment decided per support tier
- Custom role built where Help Desk Operator overshoots
- Access validated from a genuine tier 1 account
- Scope tags aligned where administration is delegated
- 03Week 2
Mine tickets, write queries
Your recent remote session history names the queries worth writing: the recurring service checks, registry reads, version confirmations, and CPU rankings that Microsoft itself flags as replaceable. Each gets validated against a live device before publication.
- Recurring investigations pulled from ticket data
- Queries authored and tested within the input limit
- Library published into the ITSM knowledge base
- Copilot query generation shown where licensed
- 04Week 3
Brief the desk, then measure
Training covers the library and, just as deliberately, the quirks: the rate limit, the truncation, the quoting rule, the TPM field. Then the remote actions reachable from results, and a baseline of remote session volume to measure the change against.
- Desk trained on the query library
- Quirks documented beside the queries
- Remote actions from results demonstrated
- Remote session volume baselined for comparison
Six lookups that no longer need a screen share.
Service status, on demand
The WindowsService entity settles the most frequent screen-share pretext in seconds. No interruption, and no hunting for a slot when a remote employee and an engineer are both free, which for distributed teams is often the longest part of the ticket.
Registry values behind app behavior
Reading a configuration key is a documented use case, with three published exceptions to remember: root keys, 64-bit shared keys, and binary data all come back empty by design. Knowing that keeps a blank result from being misread as a missing key.
Installed version, settled instantly
Whether a fix applies, whether an upgrade landed, whether the vendor's advisory is relevant: version is the fact everything else hangs on. Having it during the first call instead of after a scheduled session is what first-contact resolution actually looks like.
The slow-machine complaint, diagnosed live
Ranking processes by CPU consumption is one of Microsoft's named scenarios, and because the query executes now, it captures the process misbehaving during the complaint rather than whatever an overnight inventory happened to record.
Encryption and certificate spot checks
EncryptableVolume and Certificate answer the triage questions HIPAA risk analyses and insurance questionnaires generate. One warning: the TPM entity's activated and enabled fields read TRUE whenever TPM 2.0 is present, so formal evidence needs a different source.
Event history without a site visit
WindowsEvent and WindowsAppCrashEvent expose the log entries and crash records from last night directly. For branch machines and home offices where a session is impractical, that visibility often decides between fixing remotely and shipping spare hardware.
Three ways a US help desk learns what a device is doing.
| Feature | Device query with a saved library | Remote control session | Ask the user to look |
|---|---|---|---|
User interrupted | No | Yes | Yes |
Answer is current | Real time | Real time | Depends on the user |
Repeatable across engineers | Saved queries | By skill level | No |
Works for services and registry | Yes | Yes | With difficulty |
Top processes by CPU | Yes | Yes | Unlikely |
Action from the result | Remote actions available | In session | No |
Time per check | Seconds | Minutes | Variable |
Requires user availability | No | Usually | Yes |
Auditable | Yes | Partly | No |
Scales across many devices | Rate limited, but yes | No | No |
Ten published constraints, collected in one place.
Constraint
Query rate
- The rule
- 15 queries a minute, then a query limit exceeded error
Constraint
Query input length
- The rule
- 2,048 characters maximum
Constraint
Result size
- The rule
- 128kb of characters, truncated beyond that with a row count
Constraint
Device ownership
- The rule
- Must be marked as corporate owned
Constraint
Join state
- The rule
- Microsoft Entra joined or Entra hybrid joined
Constraint
Transport
- The rule
- Windows Push Notification Services, mandatory, cannot be bypassed
Constraint
Unsupported operator
- The rule
- !like is not supported
Constraint
Quoting
- The rule
- Single quotes only on contains, startswith and endswith, though the editor suggests double
Constraint
TPM 2.0 reporting
- The rule
- Activated and enabled always return TRUE where TPM 2.0 is present
Constraint
Files in use
- The rule
- FileInfo queries return an error
Five steps, weighted heavily toward the library.
- 1
Verify licensing, classification, and transport
Advanced Analytics entitlement, corporate owned classification with Entra join state across the fleet, and WNS reachability everywhere managed devices sit, because the transport has no fallback and a blocked path means failed queries with no workaround.
- 2
Build the access model
Help Desk Operator where it fits, otherwise a custom role combining Managed Devices Query with the managed-device read permissions. Validation happens from a real tier 1 login, since permissions that only work for admins defeat the purpose.
- 3
Author queries against real recurring tickets
The documented starting set: service status, registry values, installed versions, CPU consumers. Each query stays inside the 2,048 character ceiling and gets proven against a live device before anyone on the desk sees it.
- 4
Ship the library with its warning labels attached
Saved queries land in the ITSM knowledge base with the published limits written beside them, so a rate-limit error or a truncated result reads as documented behavior instead of a malfunction worth abandoning the tool over.
- 5
Close the loop with actions and metrics
Engineers learn the remote actions reachable from query results, then remote session volume gets tracked against the pre-rollout baseline, because fewer sessions is the outcome this entire capability exists to produce.
What US organizations ask about device query.
Fifteen questions to settle before the desk gets access.
Prerequisites
- Is Advanced Analytics in our licensing?Base Intune does not include it.
- Do devices carry the corporate owned flag?Non-negotiable for eligibility.
- Entra joined or hybrid joined?Either satisfies the requirement.
- Is WNS reachable from every segment?No alternative transport exists.
- Is this a DoD environment?Device query is excluded there.
Access
- Which tiers should hold query rights?Tier 1 and 2 in most designs.
- Help Desk Operator or custom role?Custom is often the tighter fit.
- Custom role carries Managed Devices Query?The load-bearing permission.
- And the accompanying read permissions?Visibility comes separately.
- Tested from an actual tier 1 login?Admin accounts prove nothing.
Expectations
- Briefed on 15 queries a minute?A distinct error announces it.
- Briefed on 128kb truncation?The error counts dropped rows.
- Briefed on single-quote syntax?The editor misleads toward double.
- Briefed on the TPM 2.0 field?It reads TRUE regardless.
- Briefed on admin-user tampering?Central to investigation use.
The pages around this one.
Intune endpoint analytics
The same Advanced Analytics family, pointed at trends: startup scores, reliability, and device health over time.
Intune remediations
When one device's finding turns out to be everyone's problem: detect and remediate script pairs at fleet scale.
Intune Remote Help
The sanctioned screen-share tool, for the minority of calls where reading state is not enough.
Audit a month of screen shares and see how many were single-value lookups.
Service status, registry keys, version numbers, process lists: each one is a query candidate, and each conversion hands an employee back ten uninterrupted minutes. Engagements are scoped per service desk, and the first conversation costs nothing.
Related Services
Explore more solutions that work great with this service