Applied KQL

Helping others get things done using Kusto Query Language (KQL).

KQL Query Breakdown: Intune Device Models and Counts

by

Intune Device Models and Counts: Copilot Designer

Use KQL to get a list of your device models and counts from Intune.

To get a list of all of the various device models you have registered in Intune, AND how many of each of those models you have, there is a KQL query for that.

Prerequisites for using this KQL query

To use this KQL query, you must be sending your Intune logs to an Azure Log Analytics workspace.

KQL query for returning a list of Intune device models and counts

IntuneDevices
| summarize DeviceCount = count() by Model
| order by DeviceCount desc

Deconstructing the KQL query

Read on to understand HOW the query above works.

IntuneDevices

We’re starting with the IntuneDevices table, which contains data about devices managed by Intune.

|

This is the pipe operator, which serves as a separator between different operations in KQL. It signifies that the output of the previous operation will be passed on to the next one. Going forward, we’ll include it at the beginning of the operation into which it is passing previous output.

summarize DeviceCount = count() by Model

Here, we’re utilizing the summarize operator to aggregate our data. We’re creating a summary table where we count the number of devices (DeviceCount) grouped by their respective models (Model).

| order by DeviceCount desc

We use order by to organize our summarized data in a particular order. In this case, we’re arranging the device models based on their counts (DeviceCount) in descending order (desc), meaning from highest count to lowest.

Reference