Microsoft Intune Attribute Reference

Table of Contents

Microsoft Intune Attribute Reference

This reference lists the attributes that Device Security collects from Microsoft Intune, their names as stored in Device Security, and the Device Security fields they map to.

When Device Security integrates with Microsoft Entra ID via Microsoft Intune, it imports endpoint management data to enrich the device inventory. The attributes in this reference cover Intune-managed device records including OS, hardware, and compliance status.

The third-party attribute name in Device Security refers to the attribute name as it appears in the Assets Inventory table and in Query Engine. This follows the format of third-party-name.attribute-name. When viewing the attribute name in the Assets Inventory table column selector or on a Device Details page, where the third-party name can be found as a header for the attributes section, then the third-party name is removed from the attribute name.

For example, micrsoft_defender_xdr.macAddress would appear in the Query Builder and in the Assets Inventory table, but under Device DetailsAttributesIntegration Specific AttributesMicrosoft Defender, the attribute would appear as macAddress.

Managed Device Attributes

Device Security collects managed device attributes from Microsoft Intune. The following table lists each Microsoft Intune attribute, its name as stored in Device Security, and the Device Security field it maps to (if applicable).

Microsoft Intune Attribute	Device Security Attribute Name	Device Security Common Attribute*	Description
deviceEnrollmentType	microsoft_entra_id.deviceEnrollmentType	AD Join Status	Device enrollment type
userPrincipalName	microsoft_entra_id.userPrincipalName	AD Username; last_ad_realm	User principal name
deviceName	microsoft_entra_id.deviceName	hostname	Device name
iccid	microsoft_entra_id.iccid	iccid	ICCID
imei	microsoft_entra_id.imei	imei	IMEI
emailAddress	microsoft_entra_id.emailAddress	last_ad_username	Email address
mac	—	MAC Address; id	MAC address
meid	microsoft_entra_id.meid	meid	MEID
model	microsoft_entra_id.model	Model	Model of the device
osVersion	microsoft_entra_id.osVersion	OS Version	OS version
managedDeviceOwnerType	microsoft_entra_id.managedDeviceOwnerType	owner_id	Managed device owner type
operatingSystem	microsoft_entra_id.operatingSystem	raw_os; os_type	Operating system
serialNumber	microsoft_entra_id.serialNumber	Serial Number	Serial number
manufacturer	microsoft_entra_id.manufacturer	Vendor	Manufacturer of the device
activationLockBypassCode	microsoft_entra_id.activationLockBypassCode	—	Activation lock bypass code
androidSecurityPatchLevel	microsoft_entra_id.androidSecurityPatchLevel	—	Android security patch level
azureADDeviceId	microsoft_entra_id.azureADDeviceId	—	Azure ad device ID
azureADRegistered	microsoft_entra_id.azureADRegistered	—	Azure ad registered
complianceGracePeriodExpirationDateTime	microsoft_entra_id.complianceGracePeriodExpirationDateTime	—	Compliance grace period expiration date time
complianceState	microsoft_entra_id.complianceState	—	Compliance state
configurationManagerClientEnabledFeatures.compliancePolicy	microsoft_entra_id.configurationManagerClientEnabledFeatures.compliancePolicy	—	Compliance policy
configurationManagerClientEnabledFeatures.deviceConfiguration	microsoft_entra_id.configurationManagerClientEnabledFeatures.deviceConfiguration	—	Device configuration
configurationManagerClientEnabledFeatures.inventory	microsoft_entra_id.configurationManagerClientEnabledFeatures.inventory	—	Inventory
configurationManagerClientEnabledFeatures.modernApps	microsoft_entra_id.configurationManagerClientEnabledFeatures.modernApps	—	Modern apps
configurationManagerClientEnabledFeatures.windowsUpdateForBusiness	microsoft_entra_id.configurationManagerClientEnabledFeatures.windowsUpdateForBusiness	—	Windows update for business
deviceActionResults.actionName	microsoft_entra_id.deviceActionResults.actionName	—	Action name
deviceActionResults.actionState	microsoft_entra_id.deviceActionResults.actionState	—	Action state
deviceActionResults.lastUpdatedDateTime	microsoft_entra_id.deviceActionResults.lastUpdatedDateTime	—	Last updated date time
deviceActionResults.startDateTime	microsoft_entra_id.deviceActionResults.startDateTime	—	Start date time
deviceCategoryDisplayName	microsoft_entra_id.deviceCategoryDisplayName	—	Device category display name
deviceHealthAttestationState.attestationIdentityKey	microsoft_entra_id.deviceHealthAttestationState.attestationIdentityKey	—	Attestation identity key
deviceHealthAttestationState.bitLockerStatus	microsoft_entra_id.deviceHealthAttestationState.bitLockerStatus	—	Bit locker status
deviceHealthAttestationState.bootAppSecurityVersion	microsoft_entra_id.deviceHealthAttestationState.bootAppSecurityVersion	—	Boot app security version
deviceHealthAttestationState.bootDebugging	microsoft_entra_id.deviceHealthAttestationState.bootDebugging	—	Boot debugging
deviceHealthAttestationState.bootManagerSecurityVersion	microsoft_entra_id.deviceHealthAttestationState.bootManagerSecurityVersion	—	Boot manager security version
deviceHealthAttestationState.bootManagerVersion	microsoft_entra_id.deviceHealthAttestationState.bootManagerVersion	—	Boot manager version
deviceHealthAttestationState.bootRevisionListInfo	microsoft_entra_id.deviceHealthAttestationState.bootRevisionListInfo	—	Boot revision list info
deviceHealthAttestationState.codeIntegrity	microsoft_entra_id.deviceHealthAttestationState.codeIntegrity	—	Code integrity
deviceHealthAttestationState.codeIntegrityCheckVersion	microsoft_entra_id.deviceHealthAttestationState.codeIntegrityCheckVersion	—	Code integrity check version
deviceHealthAttestationState.codeIntegrityPolicy	microsoft_entra_id.deviceHealthAttestationState.codeIntegrityPolicy	—	Code integrity policy
deviceHealthAttestationState.contentNamespaceUrl	microsoft_entra_id.deviceHealthAttestationState.contentNamespaceUrl	—	Content namespace URL
deviceHealthAttestationState.contentVersion	microsoft_entra_id.deviceHealthAttestationState.contentVersion	—	Content version
deviceHealthAttestationState.dataExcutionPolicy	microsoft_entra_id.deviceHealthAttestationState.dataExcutionPolicy	—	Data excution policy
deviceHealthAttestationState.deviceHealthAttestationStatus	microsoft_entra_id.deviceHealthAttestationState.deviceHealthAttestationStatus	—	Device health attestation status
deviceHealthAttestationState.earlyLaunchAntiMalwareDriverProtection	microsoft_entra_id.deviceHealthAttestationState.earlyLaunchAntiMalwareDriverProtection	—	Early launch anti malware driver protection
deviceHealthAttestationState.healthAttestationSupportedStatus	microsoft_entra_id.deviceHealthAttestationState.healthAttestationSupportedStatus	—	Health attestation supported status
deviceHealthAttestationState.healthStatusMismatchInfo	microsoft_entra_id.deviceHealthAttestationState.healthStatusMismatchInfo	—	Health status mismatch info
deviceHealthAttestationState.issuedDateTime	microsoft_entra_id.deviceHealthAttestationState.issuedDateTime	—	Issued date time
deviceHealthAttestationState.lastUpdateDateTime	microsoft_entra_id.deviceHealthAttestationState.lastUpdateDateTime	—	Last update date time
deviceHealthAttestationState.operatingSystemKernelDebugging	microsoft_entra_id.deviceHealthAttestationState.operatingSystemKernelDebugging	—	Operating system kernel debugging
deviceHealthAttestationState.operatingSystemRevListInfo	microsoft_entra_id.deviceHealthAttestationState.operatingSystemRevListInfo	—	Operating system rev list info
deviceHealthAttestationState.pcr0	microsoft_entra_id.deviceHealthAttestationState.pcr0	—	Pcr0
deviceHealthAttestationState.pcrHashAlgorithm	microsoft_entra_id.deviceHealthAttestationState.pcrHashAlgorithm	—	Pcr hash algorithm
deviceHealthAttestationState.resetCount	microsoft_entra_id.deviceHealthAttestationState.resetCount	—	Number of resets
deviceHealthAttestationState.restartCount	microsoft_entra_id.deviceHealthAttestationState.restartCount	—	Number of restarts
deviceHealthAttestationState.safeMode	microsoft_entra_id.deviceHealthAttestationState.safeMode	—	Safe mode
deviceHealthAttestationState.secureBoot	microsoft_entra_id.deviceHealthAttestationState.secureBoot	—	Secure boot
deviceHealthAttestationState.secureBootConfigurationPolicyFingerPrint	microsoft_entra_id.deviceHealthAttestationState.secureBootConfigurationPolicyFingerPrint	—	Secure boot configuration policy finger print
deviceHealthAttestationState.testSigning	microsoft_entra_id.deviceHealthAttestationState.testSigning	—	Test signing
deviceHealthAttestationState.tpmVersion	microsoft_entra_id.deviceHealthAttestationState.tpmVersion	—	Tpm version
deviceHealthAttestationState.virtualSecureMode	microsoft_entra_id.deviceHealthAttestationState.virtualSecureMode	—	Virtual secure mode
deviceHealthAttestationState.windowsPE	microsoft_entra_id.deviceHealthAttestationState.windowsPE	—	Windows pe
deviceRegistrationState	microsoft_entra_id.deviceRegistrationState	—	Device registration state
easActivated	microsoft_entra_id.easActivated	—	EAS activated
easActivationDateTime	microsoft_entra_id.easActivationDateTime	—	Eas activation date time
easDeviceId	microsoft_entra_id.easDeviceId	—	Eas device ID
enrolledDateTime	microsoft_entra_id.enrolledDateTime	—	Enrolled date time
enrollmentProfileName	microsoft_entra_id.enrollmentProfileName	—	Enrollment profile name
ethernetMacAddress	microsoft_entra_id.ethernetMacAddress	—	Ethernet MAC address
exchangeAccessState	microsoft_entra_id.exchangeAccessState	—	Exchange access state
exchangeAccessStateReason	microsoft_entra_id.exchangeAccessStateReason	—	Exchange access state reason
exchangeLastSuccessfulSyncDateTime	microsoft_entra_id.exchangeLastSuccessfulSyncDateTime	—	Exchange last successful sync date time
freeStorageSpaceInBytes	microsoft_entra_id.freeStorageSpaceInBytes	—	Free storage space in bytes
id	microsoft_entra_id.id	—	Unique identifier
isEncrypted	microsoft_entra_id.isEncrypted	—	Is encrypted
isSupervised	microsoft_entra_id.isSupervised	—	Is supervised
jailBroken	microsoft_entra_id.jailBroken	—	Jail broken
lastSyncDateTime	microsoft_entra_id.lastSyncDateTime	—	Last sync date time
managedDeviceName	microsoft_entra_id.managedDeviceName	—	Managed device name
managementAgent	microsoft_entra_id.managementAgent	—	Management agent
managementCertificateExpirationDate	microsoft_entra_id.managementCertificateExpirationDate	—	Management certificate expiration date
notes	microsoft_entra_id.notes	—	Notes
partnerReportedThreatState	microsoft_entra_id.partnerReportedThreatState	—	Partner reported threat state
phoneNumber	microsoft_entra_id.phoneNumber	—	Phone number
physicalMemoryInBytes	microsoft_entra_id.physicalMemoryInBytes	—	Physical memory in bytes
remoteAssistanceSessionErrorDetails	microsoft_entra_id.remoteAssistanceSessionErrorDetails	—	Remote assistance session error details
remoteAssistanceSessionUrl	microsoft_entra_id.remoteAssistanceSessionUrl	—	Remote assistance session URL
requireUserEnrollmentApproval	microsoft_entra_id.requireUserEnrollmentApproval	—	Require user enrollment approval
subscriberCarrier	microsoft_entra_id.subscriberCarrier	—	Subscriber carrier
totalStorageSpaceInBytes	microsoft_entra_id.totalStorageSpaceInBytes	—	Total storage space in bytes
udid	microsoft_entra_id.udid	—	UDID
userDisplayName	microsoft_entra_id.userDisplayName	—	User display name
userId	microsoft_entra_id.userId	—	User ID
wiFiMacAddress	microsoft_entra_id.wiFiMacAddress	—	Wi fi MAC address

User Attributes

Device Security collects user attributes from Microsoft Intune. The following table lists each Microsoft Intune attribute, its name as stored in Device Security, and the Device Security field it maps to (if applicable).

Microsoft Intune Attribute	Device Security Attribute Name	Device Security Common Attribute*	Description
user.onPremisesDistinguishedName	microsoft_entra_id.onPremisesDistinguishedName	AD Organizational Unit	On premises distinguished name
user.department	microsoft_entra_id.department	Department	Department
user.onPremisesDomainName	microsoft_entra_id.onPremisesDomainName	domain	On premises domain name
user.userPrincipalName	microsoft_entra_id.userPrincipalName	id	User principal name
user.signInActivity.lastSuccessfulSignInDateTime	microsoft_entra_id.signInActivity.lastSuccessfulSignInDateTime	last_seen	Last successful sign in date time
user.displayName	microsoft_entra_id.displayName	name	Display name
user.jobTitle	microsoft_entra_id.jobTitle	title	Job title
user.accountEnabled	microsoft_entra_id.accountEnabled	—	Account enabled
user.businessPhones	microsoft_entra_id.businessPhones	—	Business phones
user.createdDateTime	microsoft_entra_id.createdDateTime	—	Created date time
user.id	microsoft_entra_id.id	—	Unique identifier
user.lastPasswordChangeDateTime	microsoft_entra_id.lastPasswordChangeDateTime	—	Last password change date time
lastSignIn.deviceDetail.browser	microsoft_entra_id.lastSignIn.deviceDetail.browser	—	Browser
lastSignIn.deviceDetail.deviceId	microsoft_entra_id.lastSignIn.deviceDetail.deviceId	—	Device ID
lastSignIn.deviceDetail.displayName	microsoft_entra_id.lastSignIn.deviceDetail.displayName	—	Display name
lastSignIn.deviceDetail.isCompliant	microsoft_entra_id.lastSignIn.deviceDetail.isCompliant	—	Is compliant
lastSignIn.deviceDetail.isManaged	microsoft_entra_id.lastSignIn.deviceDetail.isManaged	—	Is managed
lastSignIn.deviceDetail.operatingSystem	microsoft_entra_id.lastSignIn.deviceDetail.operatingSystem	—	Operating system
lastSignIn.deviceDetail.trustType	microsoft_entra_id.lastSignIn.deviceDetail.trustType	—	Trust type
user.mail	microsoft_entra_id.mail	—	Mail
mfaRegistration.id	microsoft_entra_id.mfaRegistration.id	—	Unique identifier
mfaRegistration.isAdmin	microsoft_entra_id.mfaRegistration.isAdmin	—	Is admin
mfaRegistration.isMfaCapable	microsoft_entra_id.mfaRegistration.isMfaCapable	—	Is mfa capable
mfaRegistration.isMfaRegistered	microsoft_entra_id.mfaRegistration.isMfaRegistered	—	Is mfa registered
mfaRegistration.isPasswordlessCapable	microsoft_entra_id.mfaRegistration.isPasswordlessCapable	—	Is passwordless capable
mfaRegistration.isSsprCapable	microsoft_entra_id.mfaRegistration.isSsprCapable	—	Is sspr capable
mfaRegistration.isSsprEnabled	microsoft_entra_id.mfaRegistration.isSsprEnabled	—	Is sspr enabled
mfaRegistration.isSsprRegistered	microsoft_entra_id.mfaRegistration.isSsprRegistered	—	Is sspr registered
mfaRegistration.isSystemPreferredAuthenticationMethodEnabled	microsoft_entra_id.mfaRegistration.isSystemPreferredAuthenticationMethodEnabled	—	Is system preferred authentication method enabled
mfaRegistration.lastUpdatedDateTime	microsoft_entra_id.mfaRegistration.lastUpdatedDateTime	—	Last updated date time
mfaRegistration.methodsRegistered	microsoft_entra_id.mfaRegistration.methodsRegistered	—	Methods registered
mfaRegistration.systemPreferredAuthenticationMethods	microsoft_entra_id.mfaRegistration.systemPreferredAuthenticationMethods	—	System preferred authentication methods
mfaRegistration.userDisplayName	microsoft_entra_id.mfaRegistration.userDisplayName	—	User display name
mfaRegistration.userPreferredMethodForSecondaryAuthentication	microsoft_entra_id.mfaRegistration.userPreferredMethodForSecondaryAuthentication	—	User preferred method for secondary authentication
mfaRegistration.userPrincipalName	microsoft_entra_id.mfaRegistration.userPrincipalName	—	User principal name
mfaRegistration.userType	microsoft_entra_id.mfaRegistration.userType	—	User type
user.mobilePhone	microsoft_entra_id.mobilePhone	—	Mobile phone
user.onPremisesImmutableId	microsoft_entra_id.onPremisesImmutableId	—	On premises immutable ID
user.onPremisesSamAccountName	microsoft_entra_id.onPremisesSamAccountName	—	On premises sam account name
user.onPremisesSecurityIdentifier	microsoft_entra_id.onPremisesSecurityIdentifier	—	On premises security identifier
user.onPremisesSyncEnabled	microsoft_entra_id.onPremisesSyncEnabled	—	On premises sync enabled
user.otherMails	microsoft_entra_id.otherMails	—	Other mails
user.passwordPolicies	microsoft_entra_id.passwordPolicies	—	Password policies
perUserMfaState	microsoft_entra_id.perUserMfaState	—	Per user mfa state
user.proxyAddresses	microsoft_entra_id.proxyAddresses	—	Proxy addresses
user.registeredDevices	microsoft_entra_id.registeredDevices	—	Registered devices
user.signInActivity.lastNonInteractiveSignInDateTime	microsoft_entra_id.signInActivity.lastNonInteractiveSignInDateTime	—	Last non interactive sign in date time
user.signInActivity.lastNonInteractiveSignInRequestId	microsoft_entra_id.signInActivity.lastNonInteractiveSignInRequestId	—	Last non interactive sign in request ID
user.signInActivity.lastSignInDateTime	microsoft_entra_id.signInActivity.lastSignInDateTime	—	Last sign in date time
user.signInActivity.lastSignInRequestId	microsoft_entra_id.signInActivity.lastSignInRequestId	—	Last sign in request ID
user.signInActivity.lastSuccessfulSignInRequestId	microsoft_entra_id.signInActivity.lastSuccessfulSignInRequestId	—	Last successful sign in request ID

* Only some attributes map to a Device Security Common Attribute.

Microsoft Defender Attribute Reference

Microsoft SCCM Attribute Reference

Device Security Docs

Microsoft Intune Attribute Reference

Device Security Docs

Microsoft Intune Attribute Reference

Managed Device Attributes

User Attributes

Activation & Onboarding

Next-Generation Firewalls

SASE