Device Security
Microsoft Entra Attribute Reference
Table of Contents
Expand All
|
Collapse All
Device Security Docs
Microsoft Entra Attribute Reference
This reference lists the attributes that Device Security collects from Microsoft Entra ID,
their names as stored in Device Security, and the Device Security device fields
they map to.
When Device Security integrates with Microsoft Entra ID via Microsoft Intune,
it imports endpoint management data to enrich the device inventory. The attributes in
this reference cover Intune-managed device records including OS, hardware, and
compliance status.
The third-party attribute name in Device Security refers to the attribute name
as it appears in the Assets Inventory table and in Query Engine. This follows the format
of third-party-name.attribute-name.
When viewing the attribute name in the Assets Inventory table column selector or on a
Device Details page, where the third-party name can be found as a header for the
attributes section, then the third-party name is removed from the attribute name.
For example, micrsoft_defender_xdr.macAddress would appear in the
Query Builder and in the Assets Inventory table, but under Device DetailsAttributesIntegration Specific AttributesMicrosoft Defender, the attribute would appear as macAddress.
Device Attributes
Device Security collects device attributes from Microsoft Entra ID through the
Microsoft Intune API. The following table lists each
Microsoft Entra ID / Microsoft Intune attribute, its name as stored in
Device Security, and the Device Security device field it maps to, if applicable.
|
Microsoft Entra ID / Intune Attribute
|
Device Security Attribute Name
|
Device Security Common Attribute*
|
Description
|
|---|---|---|---|
|
activationLockBypassCode
|
microsoft_entra_id.activationLockBypassCode
|
—
|
Activation lock bypass code
|
|
androidSecurityPatchLevel
|
microsoft_entra_id.androidSecurityPatchLevel
|
—
|
Android security patch level
|
|
azureADDeviceId
|
microsoft_entra_id.azureADDeviceId
|
—
|
Azure AD device identifier
|
|
azureADRegistered
|
microsoft_entra_id.azureADRegistered
|
—
|
Azure AD registration status
|
|
complianceGracePeriodExpirationDateTime
|
microsoft_entra_id.complianceGracePeriodExpirationDateTime
|
—
|
Expiration date time of compliance grace period
|
|
complianceState
|
microsoft_entra_id.complianceState
|
—
|
Compliance state of the device
|
|
configurationManagerClientEnabledFeatures.compliancePolicy
|
microsoft_entra_id.configurationManagerClientEnabledFeatures.compliancePolicy
|
—
|
Compliance policy enabled status
|
|
configurationManagerClientEnabledFeatures.deviceConfiguration
|
microsoft_entra_id.configurationManagerClientEnabledFeatures.deviceConfiguration
|
—
|
Device configuration enabled status
|
|
configurationManagerClientEnabledFeatures.inventory
|
microsoft_entra_id.configurationManagerClientEnabledFeatures.inventory
|
—
|
Inventory enabled status
|
|
configurationManagerClientEnabledFeatures.modernApps
|
microsoft_entra_id.configurationManagerClientEnabledFeatures.modernApps
|
—
|
Modern apps enabled status
|
|
configurationManagerClientEnabledFeatures.windowsUpdateForBusiness
|
microsoft_entra_id.configurationManagerClientEnabledFeatures.windowsUpdateForBusiness
|
—
|
Windows Update for Business enabled status
|
|
deviceActionResults.actionName
|
microsoft_entra_id.deviceActionResults.actionName
|
—
|
Name of the device action
|
|
deviceActionResults.actionState
|
microsoft_entra_id.deviceActionResults.actionState
|
—
|
Current state of the device action
|
|
deviceActionResults.lastUpdatedDateTime
|
microsoft_entra_id.deviceActionResults.lastUpdatedDateTime
|
—
|
Last updated date time of the device action results
|
|
deviceActionResults.startDateTime
|
microsoft_entra_id.deviceActionResults.startDateTime
|
—
|
Start date time of the device action
|
|
deviceCategoryDisplayName
|
microsoft_entra_id.deviceCategoryDisplayName
|
—
|
Display name of device category
|
|
deviceEnrollmentType
|
microsoft_entra_id.deviceEnrollmentType
|
AD Join Status
|
Type of device enrollment
|
|
deviceHealthAttestationState.attestationIdentityKey
|
microsoft_entra_id.deviceHealthAttestationState.attestationIdentityKey
|
—
|
Attestation identity key
|
|
deviceHealthAttestationState.bitLockerStatus
|
microsoft_entra_id.deviceHealthAttestationState.bitLockerStatus
|
—
|
BitLocker status
|
|
deviceHealthAttestationState.bootAppSecurityVersion
|
microsoft_entra_id.deviceHealthAttestationState.bootAppSecurityVersion
|
—
|
Boot application security version
|
|
deviceHealthAttestationState.bootDebugging
|
microsoft_entra_id.deviceHealthAttestationState.bootDebugging
|
—
|
Boot debugging status
|
|
deviceHealthAttestationState.bootManagerSecurityVersion
|
microsoft_entra_id.deviceHealthAttestationState.bootManagerSecurityVersion
|
—
|
Boot manager security version
|
|
deviceHealthAttestationState.bootManagerVersion
|
microsoft_entra_id.deviceHealthAttestationState.bootManagerVersion
|
—
|
Boot manager version
|
|
deviceHealthAttestationState.bootRevisionListInfo
|
microsoft_entra_id.deviceHealthAttestationState.bootRevisionListInfo
|
—
|
Boot revision list information
|
|
deviceHealthAttestationState.codeIntegrity
|
microsoft_entra_id.deviceHealthAttestationState.codeIntegrity
|
—
|
Code integrity status
|
|
deviceHealthAttestationState.codeIntegrityCheckVersion
|
microsoft_entra_id.deviceHealthAttestationState.codeIntegrityCheckVersion
|
—
|
Code integrity check version
|
|
deviceHealthAttestationState.codeIntegrityPolicy
|
microsoft_entra_id.deviceHealthAttestationState.codeIntegrityPolicy
|
—
|
Code integrity policy status
|
|
deviceHealthAttestationState.contentNamespaceUrl
|
microsoft_entra_id.deviceHealthAttestationState.contentNamespaceUrl
|
—
|
Content namespace URL
|
|
deviceHealthAttestationState.contentVersion
|
microsoft_entra_id.deviceHealthAttestationState.contentVersion
|
—
|
Content version of health attestation
|
|
deviceHealthAttestationState.dataExcutionPolicy
|
microsoft_entra_id.deviceHealthAttestationState.dataExcutionPolicy
|
—
|
Data execution policy status
|
|
deviceHealthAttestationState.deviceHealthAttestationStatus
|
microsoft_entra_id.deviceHealthAttestationState.deviceHealthAttestationStatus
|
—
|
Device health attestation status
|
|
deviceHealthAttestationState.earlyLaunchAntiMalwareDriverProtection
|
microsoft_entra_id.deviceHealthAttestationState.earlyLaunchAntiMalwareDriverProtection
|
—
|
Early launch anti-malware driver protection status
|
|
deviceHealthAttestationState.healthAttestationSupportedStatus
|
microsoft_entra_id.deviceHealthAttestationState.healthAttestationSupportedStatus
|
—
|
Health attestation supported status
|
|
deviceHealthAttestationState.healthStatusMismatchInfo
|
microsoft_entra_id.deviceHealthAttestationState.healthStatusMismatchInfo
|
—
|
Health status mismatch information
|
|
deviceHealthAttestationState.issuedDateTime
|
microsoft_entra_id.deviceHealthAttestationState.issuedDateTime
|
—
|
Issued date time of health attestation
|
|
deviceHealthAttestationState.lastUpdateDateTime
|
microsoft_entra_id.deviceHealthAttestationState.lastUpdateDateTime
|
—
|
Last update date time of health attestation
|
|
deviceHealthAttestationState.operatingSystemKernelDebugging
|
microsoft_entra_id.deviceHealthAttestationState.operatingSystemKernelDebugging
|
—
|
Operating system kernel debugging status
|
|
deviceHealthAttestationState.operatingSystemRevListInfo
|
microsoft_entra_id.deviceHealthAttestationState.operatingSystemRevListInfo
|
—
|
Operating system revision list information
|
|
deviceHealthAttestationState.pcr0
|
microsoft_entra_id.deviceHealthAttestationState.pcr0
|
—
|
Platform Configuration Register 0
|
|
deviceHealthAttestationState.pcrHashAlgorithm
|
microsoft_entra_id.deviceHealthAttestationState.pcrHashAlgorithm
|
—
|
PCR hash algorithm
|
|
deviceHealthAttestationState.resetCount
|
microsoft_entra_id.deviceHealthAttestationState.resetCount
|
—
|
Number of resets
|
|
deviceHealthAttestationState.restartCount
|
microsoft_entra_id.deviceHealthAttestationState.restartCount
|
—
|
Number of restarts
|
|
deviceHealthAttestationState.safeMode
|
microsoft_entra_id.deviceHealthAttestationState.safeMode
|
—
|
Safe mode status
|
|
deviceHealthAttestationState.secureBoot
|
microsoft_entra_id.deviceHealthAttestationState.secureBoot
|
—
|
Secure boot status
|
|
deviceHealthAttestationState.secureBootConfigurationPolicyFingerPrint
|
microsoft_entra_id.deviceHealthAttestationState.secureBootConfigurationPolicyFingerPrint
|
—
|
Secure boot configuration policy fingerprint
|
|
deviceHealthAttestationState.testSigning
|
microsoft_entra_id.deviceHealthAttestationState.testSigning
|
—
|
Test signing status
|
|
deviceHealthAttestationState.tpmVersion
|
microsoft_entra_id.deviceHealthAttestationState.tpmVersion
|
—
|
Trusted Platform Module version
|
|
deviceHealthAttestationState.virtualSecureMode
|
microsoft_entra_id.deviceHealthAttestationState.virtualSecureMode
|
—
|
Virtual secure mode status
|
|
deviceHealthAttestationState.windowsPE
|
microsoft_entra_id.deviceHealthAttestationState.windowsPE
|
—
|
Windows Preinstallation Environment status
|
|
deviceName
|
microsoft_entra_id.deviceName
|
Hostname
|
Name of the device
|
|
deviceRegistrationState
|
microsoft_entra_id.deviceRegistrationState
|
—
|
Device registration state
|
|
easActivated
|
microsoft_entra_id.easActivated
|
—
|
EAS activation status
|
|
easActivationDateTime
|
microsoft_entra_id.easActivationDateTime
|
—
|
EAS activation date time
|
|
easDeviceId
|
microsoft_entra_id.easDeviceId
|
—
|
EAS device identifier
|
|
emailAddress
|
microsoft_entra_id.emailAddress
|
last_ad_username
|
Email address of the device user
|
|
enrolledDateTime
|
microsoft_entra_id.enrolledDateTime
|
—
|
Enrollment date time
|
|
enrollmentProfileName
|
microsoft_entra_id.enrollmentProfileName
|
—
|
Enrollment profile name of the device
|
|
ethernetMacAddress
|
microsoft_entra_id.ethernetMacAddress
|
—
|
Ethernet MAC address of the device
|
|
exchangeAccessState
|
microsoft_entra_id.exchangeAccessState
|
—
|
Exchange access state
|
|
exchangeAccessStateReason
|
microsoft_entra_id.exchangeAccessStateReason
|
—
|
Exchange access state reason
|
|
exchangeLastSuccessfulSyncDateTime
|
microsoft_entra_id.exchangeLastSuccessfulSyncDateTime
|
—
|
Last successful sync date time with Exchange
|
|
freeStorageSpaceInBytes
|
microsoft_entra_id.freeStorageSpaceInBytes
|
—
|
Free storage space in bytes
|
|
iccid
|
microsoft_entra_id.iccid
|
iccid
|
Integrated Circuit Card Identifier
|
|
id
|
microsoft_entra_id.id
|
—
|
Device identifier in MS Entra ID
|
|
imei
|
microsoft_entra_id.imei
|
Mobile IMEI
|
International Mobile Equipment Identity
|
|
isEncrypted
|
microsoft_entra_id.isEncrypted
|
—
|
Encryption status of the device
|
|
isSupervised
|
microsoft_entra_id.isSupervised
|
—
|
Supervision status of the device
|
|
jailBroken
|
microsoft_entra_id.jailBroken
|
—
|
Jail broken or rooted status
|
|
lastSyncDateTime
|
microsoft_entra_id.lastSyncDateTime
|
—
|
Last synchronization date time
|
|
mac
|
—
|
MAC; id
|
MAC address attribute collected from Microsoft Intune
|
|
managedDeviceName
|
microsoft_entra_id.managedDeviceName
|
—
|
Name of the managed device
|
|
managedDeviceOwnerType
|
microsoft_entra_id.managedDeviceOwnerType
|
owner_id
|
Owner type of the managed device
|
|
managementAgent
|
microsoft_entra_id.managementAgent
|
—
|
Management agent type
|
|
managementCertificateExpirationDate
|
microsoft_entra_id.managementCertificateExpirationDate
|
—
|
Expiration date of the management certificate
|
|
manufacturer
|
microsoft_entra_id.manufacturer
|
Vendor
|
Manufacturer of the device
|
|
meid
|
microsoft_entra_id.meid
|
meid
|
Mobile Equipment Identifier
|
|
model
|
microsoft_entra_id.model
|
Model
|
Model of the device
|
|
notes
|
microsoft_entra_id.notes
|
—
|
Notes associated with the device
|
|
operatingSystem
|
microsoft_entra_id.operatingSystem
|
os_type; raw_os
|
Operating system of the device
|
|
osVersion
|
microsoft_entra_id.osVersion
|
OS Version
|
Operating system version
|
|
partnerReportedThreatState
|
microsoft_entra_id.partnerReportedThreatState
|
—
|
Threat state reported by partner
|
|
phoneNumber
|
microsoft_entra_id.phoneNumber
|
—
|
Phone number of the device
|
|
physicalMemoryInBytes
|
microsoft_entra_id.physicalMemoryInBytes
|
—
|
Physical memory of the device in bytes
|
|
remoteAssistanceSessionErrorDetails
|
microsoft_entra_id.remoteAssistanceSessionErrorDetails
|
—
|
Remote assistance session error details
|
|
remoteAssistanceSessionUrl
|
microsoft_entra_id.remoteAssistanceSessionUrl
|
—
|
Remote assistance session URL
|
|
requireUserEnrollmentApproval
|
microsoft_entra_id.requireUserEnrollmentApproval
|
—
|
Whether user enrollment approval is required
|
|
serialNumber
|
microsoft_entra_id.serialNumber
|
Serial Number
|
Serial number of the device
|
|
subscriberCarrier
|
microsoft_entra_id.subscriberCarrier
|
—
|
Carrier of the device subscriber
|
|
totalStorageSpaceInBytes
|
microsoft_entra_id.totalStorageSpaceInBytes
|
—
|
Total storage space in bytes
|
|
udid
|
microsoft_entra_id.udid
|
—
|
Unique device identifier
|
|
userDisplayName
|
microsoft_entra_id.userDisplayName
|
—
|
Display name of the user
|
|
userId
|
microsoft_entra_id.userId
|
—
|
User identifier
|
|
userPrincipalName
|
microsoft_entra_id.userPrincipalName
|
ad_username; last_ad_realm
|
User principal name
|
|
wiFiMacAddress
|
microsoft_entra_id.wiFiMacAddress
|
—
|
WiFi MAC address
|
* Only some attributes map to a Device Security Common Attribute.