remoteActionAudit resource type

Important: APIs under the /beta version in Microsoft Graph are in preview and are subject to change. Use of these APIs in production applications is not supported. Note: Using the Microsoft Graph APIs to configure Intune controls and policies still requires that the Intune service is correctly licensed by the customer. Report of remote actions initiated on the devices belonging to a certain tenant.


Method Return Type Description
List remoteActionAudits remoteActionAudit collection List properties and relationships of the remoteActionAudit objects.
Get remoteActionAudit remoteActionAudit Read properties and relationships of the remoteActionAudit object.
Create remoteActionAudit remoteActionAudit Create a new remoteActionAudit object.
Delete remoteActionAudit None Deletes a remoteActionAudit.
Update remoteActionAudit remoteActionAudit Update the properties of a remoteActionAudit object.


Property Type Description
id String Report Id.
deviceDisplayName String Intune device name.
userName String [deprecated] Please use InitiatedByUserPrincipalName instead.
initiatedByUserPrincipalName String User who initiated the device action, format is UPN.
action String The action name. Possible values are: unknown, factoryReset, removeCompanyData, resetPasscode, remoteLock, enableLostMode, disableLostMode, locateDevice, rebootNow, recoverPasscode, cleanWindowsDevice, logoutSharedAppleDeviceActiveUser.
requestDateTime DateTimeOffset Time when the action was issued, given in UTC.
deviceOwnerUserPrincipalName String Upn of the device owner.
deviceIMEI String IMEI of the device.
actionState String Action state. Possible values are: none, pending, canceled, active, done, failed, notSupported.



JSON Representation

Here is a JSON representation of the resource.

  "@odata.type": "#microsoft.graph.remoteActionAudit",
  "id": "String (identifier)",
  "deviceDisplayName": "String",
  "userName": "String",
  "initiatedByUserPrincipalName": "String",
  "action": "String",
  "requestDateTime": "String (timestamp)",
  "deviceOwnerUserPrincipalName": "String",
  "deviceIMEI": "String",
  "actionState": "String"