Ask a device what is actually running on it, without taking remote control of somebody screen.
Device query runs a Kusto query against a selected Windows device in real time and returns the answer. Checking a service, a registry value, an installed version or the top processes by CPU stops being a remote session and becomes a question.
- 21 entitiesQueryable areas of device state
- 15 a minuteQuery rate limit per tenant
- Real timeNot a report, an immediate response
- Corporate ownedA hard device requirement
Most remote control sessions exist to answer one question.
Is the service running. What is that registry value. Which version is installed. What is using the CPU. None of those need a session on somebody desktop.
- Microsoft documents exactly these use cases: checking a running service, checking a registry key value for an application configuration, checking an application version, and reporting the top processes by CPU consumption.
- A remote control session for any of them costs the user their attention and the engineer several minutes of connection and navigation. A query returns the answer in real time without the user knowing it happened.
- The saving compounds on repeated investigations. Saved queries for recurring issues, held in an ITSM knowledge base, turn a diagnostic that depends on an experienced engineer into one any first line agent can run consistently.
- The honest constraint is that this reads device state rather than changing it, and that an end user with admin access on the device might be able to change client based information returned in the results, such as OS version and registry values.
Eight things that determine whether your service desk will use it.
On-demand device state, in real time
Intune sends a request to the selected device and expects an immediate response, rather than reading a report compiled earlier. That distinction matters during a support call, because the answer describes the device now rather than at its last inventory cycle.
Twenty-one entities you can interrogate
BIOS information, certificates, CPU, disk drives, encryptable volumes, files, local groups and user accounts, logical drives, memory, operating system version, processes, system enclosure and information, TPM, application crash events, drivers, event log, installed updates, registry and services.
Windows Push Notification Services is mandatory
It is the transport used to notify the device and return results, and Microsoft states you cannot disable or bypass it. If it is blocked or unavailable, the query simply fails. In estates where outbound traffic is tightly filtered, that is the first thing to check.
Corporate owned, and joined
Device query supports Windows devices managed by Intune and marked as corporate owned, that are Entra joined or Entra hybrid joined. Personally owned devices are outside it, which for organisations that never set ownership correctly means a smaller addressable estate than expected.
A deliberate subset of Kusto
It supports only a subset of KQL operators, across table operators, scalar operators, aggregation functions and scalar functions. Table operators available are count, distinct, join, order by, project, take, top and where, which is enough for support work and not for analytics.
Rate and size limits worth knowing
Fifteen queries a minute before a query limit exceeded error, query input limited to 2,048 characters, and results limited to 128kb of characters with an error stating how many rows were truncated beyond that. All three shape how the tool is used at scale.
Actions from the results
Remote device actions can be run from the device query interface based on what a query returns, with the available actions depending on platform and configuration. That closes the loop from finding a problem to acting on it without switching context.
Saved queries as an ITSM asset
Microsoft recommends creating saved queries for recurring investigations in your ITSM knowledge base so first and second line engineers can access them quickly. That is what turns a capability one specialist uses into something the whole service desk uses.
If the user is a local administrator, they may be able to change what the query returns.
Microsoft states this directly, and it matters most in exactly the investigations where the answer is most important.
- The quoted limitation is that if the end user has administrator access to the device, they might be able to change client-based information returned in query results, giving operating system version and registry as examples. Device query reports what the device says about itself.
- For a support call that is fine, because the user is helping. For an investigation where the user may be the subject, it is a meaningful caveat, and the answer should be corroborated from a source the user does not control, such as Defender for Endpoint telemetry or directory records.
- There are also specific accuracy limitations worth knowing. If TPM 2.0 is present on the device, activated and enabled is always returned as TRUE, so that field cannot be used to prove a TPM is genuinely in the state you need for a compliance question.
- The registry entity carries three documented gaps as well: it fails to return the registry key for root, fails to return 64-bit shared registry keys, and fails to return binary value data. A query returning nothing for one of those is behaving as documented rather than telling you the key is absent.
Four things that get device query adopted rather than abandoned.
We build the query library from ticket data
Microsoft suggests reviewing support tasks that normally require a remote control session. Checking a running service, a registry value, an application version or top processes by CPU are all documented examples, and each becomes a saved query that any engineer can run without writing KQL.
We teach the limits before the first surprise
Fifteen queries a minute, 2,048 character inputs, 128kb of results, single quotes only on contains and startswith even though the editor suggests double quotes, and no !like operator. Each of those produces behaviour that reads as a fault to somebody who has not been told.
We distinguish support use from investigation use
Where a user has administrator access, they might be able to change client-based information returned in results, including operating system version and registry. For a cooperative support call that is irrelevant. For an investigation where the user is the subject, it is decisive.
We get the role right so first line can use it
Help Desk Operator works, and a custom role carrying the managed devices query permission plus the read permissions providing visibility is frequently a better fit. If only administrators can run queries, the capability saves nobody any time because every check is still an escalation.
Four phases across roughly three weeks.
- 01Week 1
Confirm prerequisites and addressable estate
Licensing that includes Intune Advanced Analytics, devices marked as corporate owned and Entra joined or hybrid joined, and Windows Push Notification Services reachable. That last one is frequently the blocker in estates with strict outbound filtering.
- Licence entitlement confirmed
- Devices marked corporate owned counted
- Join state verified across the estate
- Push notification service reachability tested
- 02Week 1 to 2
Grant access properly
Help Desk Operator, or a custom role carrying the managed devices query permission along with the read permissions that provide visibility into managed devices. Getting this right is what allows first line engineers to use it rather than escalating.
- Role assignment decided for each support tier
- Custom role built where Help Desk Operator is too broad
- Access tested from a real first line account
- Scope tags aligned where administration is delegated
- 03Week 2
Build the query library from real tickets
Microsoft suggests reviewing support tasks that normally need a remote control session: checking a running service, a registry value for an application configuration, an installed application version, or top processes by CPU. Those become the first saved queries.
- Recurring investigations identified from ticket data
- Queries written and validated within the character limit
- Queries saved into the ITSM knowledge base
- Copilot query generation demonstrated where available
- 04Week 3
Train the desk and set expectations
Including the limitations, because an engineer who hits the rate limit or an empty registry result without knowing why concludes the tool is unreliable. Then the remote actions available from query results, which is where the time saving actually lands.
- Service desk trained on the query library
- Limitations documented in the knowledge base
- Remote actions from results demonstrated
- Measurement agreed against remote session volume
Six support questions device query answers without a remote session.
Is the service actually running?
The WindowsService entity answers it in seconds without interrupting the user. It is the single most common reason an engineer takes remote control, and moving it to a query removes both the interruption and the scheduling problem of finding a time the user is free.
What is in that registry key?
Checking a registry value for an application configuration is a documented example. Three caveats apply: the entity does not return the registry key for root, does not return 64-bit shared registry keys, and does not return binary value data, so an empty result may be expected behaviour.
Which version of the application is installed?
Another named example, and one that resolves a class of tickets where the answer determines everything that follows. Getting it in seconds rather than through a scheduled session changes whether the engineer can complete the call on first contact.
Why is the machine slow right now?
Reporting on top processes by CPU consumption is listed as a candidate to move off remote control. Because the query is real time rather than a report, the answer reflects the moment the user is complaining rather than an inventory snapshot from overnight.
Is encryption actually on, and is the certificate present?
The EncryptableVolume and Certificate entities answer both. Note the TPM caveat though: where TPM 2.0 is present, activated and enabled is always returned as TRUE, so that specific field cannot be used as evidence for a compliance question.
What happened on that machine last night?
The WindowsEvent and WindowsAppCrashEvent entities let an engineer look at event log entries and crash events directly. For remote or site machines where taking a session is impractical, that is frequently the difference between diagnosing and dispatching somebody.
How UAE service desks find out what a device is doing.
| Feature | Device query with a saved library | Remote control session | Ask the user to look |
|---|---|---|---|
User interrupted | No | Yes | Yes |
Answer is current | Real time | Real time | Depends on the user |
Repeatable across engineers | Saved queries | By skill | No |
Works for services and registry | Yes | Yes | With difficulty |
Top processes by CPU | Yes | Yes | Unlikely |
Action from the result | Remote actions available | In session | No |
Time per check | Seconds | Minutes | Variable |
Requires user to be available | No | Usually | Yes |
Auditable | Yes | Partly | No |
Scales across many devices | Rate limited but yes | No | No |
Ten constraints that shape how device query is used.
| Constraint | The rule | |
|---|---|---|
| Query rate | 15 queries a minute, then a query limit exceeded error | |
| Query input length | 2,048 characters maximum | |
| Result size | 128kb of characters, truncated beyond with a row count | |
| Device ownership | Must be marked as corporate owned | |
| Join state | Entra joined or Entra hybrid joined | |
| Transport | Windows Push Notification Services, mandatory and unbypassable | |
| Unsupported operator | !like is not supported | |
| Quoting | Single quotes only on contains, startswith and endswith operators | |
| TPM 2.0 reporting | Activated and enabled always returned as TRUE | |
| Files in use | FileInfo queries return an error |
Five steps, and the library matters more than the capability.
- 1
Confirm licensing, ownership and connectivity
A licence that includes Intune Advanced Analytics, devices marked as corporate owned and Entra joined or hybrid joined, and Windows Push Notification Services reachable, since it is the mandatory transport and a query fails outright if it is blocked or unavailable.
- 2
Design the access model for the service desk
Help Desk Operator, or a custom role with the managed devices query permission plus the read permissions that provide visibility into managed devices. Tested from a genuine first line account, because a capability only administrators can use does not reduce escalations.
- 3
Build queries from the tickets you actually get
Service checks, registry value checks, application version checks and top processes by CPU are the documented starting points. Each written within the 2,048 character input limit and validated against a real device before it goes into the knowledge base.
- 4
Publish the library and the caveats together
Saved queries in the ITSM knowledge base alongside the documented limitations, because an engineer who hits the rate limit, a truncated result or an empty registry response without context concludes the tool is unreliable and stops using it.
- 5
Connect queries to actions and measure
Remote device actions can be run from the query interface based on results, which is where the time saving compounds. Then measurement against remote control session volume, since that is the metric this capability is supposed to move.
What organisations ask about device query.
Fifteen questions before rolling it out to the service desk.
Prerequisites
- Does our licence include Advanced Analytics?A specific entitlement.
- Are devices marked corporate owned?A hard requirement.
- Are they Entra joined or hybrid joined?Both are supported.
- Can devices reach the push notification service?It cannot be bypassed.
- Are we in a DoD environment?Device query is not included there.
Access
- Who needs to run queries?Usually first and second line.
- Is Help Desk Operator appropriate?Or is a custom role better.
- Does the custom role have Managed Devices Query?The specific permission.
- Does it have the read permissions too?Visibility is separate.
- Has a real first line account tested it?Not an administrator.
Expectations
- Does the desk know the 15 a minute limit?It produces a specific error.
- Do they know results truncate at 128kb?With a row count.
- Do they know single quotes only on contains?The editor suggests double.
- Do they know TPM always reports enabled?Where TPM 2.0 is present.
- Do they know an admin user can alter results?For investigations especially.
Count how many remote control sessions last month existed only to check one value.
A service status, a registry key, an installed version, a process list. Every one of those is a query instead, answered in seconds without interrupting the person using the machine.
Related Services
Explore more solutions that work great with this service
Endpoint Analytics
Measured device experience, and the refresh evidence
Intune Remediations
Fixing issues before the user raises a ticket
Intune Remote Help
Remote support scoped by role, with both parties authenticated
Intune Suite
Eight advanced capabilities, and one trial each per tenant
MDM Solutions Dubai
Device management across Windows, Apple and Android
Microsoft Intune
Device management and endpoint security
IT Support Dubai
24/7 on-site and remote IT support
Remote IT Support
Fast remote technical assistance