remoteActionAudit resource type

Note: Using the Microsoft Graph APIs to configure Intune controls and policies still requires that the Intune service is correctly licensed by the customer.

Report of remote actions initiated on the devices belonging to a certain tenant.


Method Return Type Description
List remoteActionAudits remoteActionAudit collection List properties and relationships of the remoteActionAudit objects.
Get remoteActionAudit remoteActionAudit Read properties and relationships of the remoteActionAudit object.
Create remoteActionAudit remoteActionAudit Create a new remoteActionAudit object.
Delete remoteActionAudit None Deletes a remoteActionAudit.
Update remoteActionAudit remoteActionAudit Update the properties of a remoteActionAudit object.


Property Type Description
id String Report Id.
deviceDisplayName String Intune device name.
userName String User who initiated the device action, format is UPN.
action String The action name. Possible values are: unknown, factoryReset, removeCompanyData, resetPasscode, remoteLock, enableLostMode, disableLostMode, locateDevice, rebootNow.
requestDateTime DateTimeOffset Time when the action was issued, given in UTC.



JSON Representation

Here is a JSON representation of the resource.

  "@odata.type": "#microsoft.graph.remoteActionAudit",
  "id": "String (identifier)",
  "deviceDisplayName": "String",
  "userName": "String",
  "action": "String",
  "requestDateTime": "String (timestamp)"