Microsoft Intune Attribute Reference

Table of Contents

Microsoft Intune Attribute Reference

This reference lists the attributes that Device Security collects from Microsoft Intune, their names as stored in Device Security, and the Device Security fields they map to.

When Device Security integrates with Microsoft Entra ID via Microsoft Intune, it imports endpoint management data to enrich the device inventory. The attributes in this reference cover Intune-managed device records including OS, hardware, and compliance status.

The third-party attribute name in Device Security refers to the attribute name as it appears in the Assets Inventory table and in Query Engine. This follows the format of third-party-name.attribute-name. When viewing the attribute name in the Assets Inventory table column selector or on a Device Details page, where the third-party name can be found as a header for the attributes section, then the third-party name is removed from the attribute name.

For example, micrsoft_defender_xdr.macAddress would appear in the Query Builder and in the Assets Inventory table, but under Device DetailsAttributesIntegration Specific AttributesMicrosoft Defender, the attribute would appear as macAddress.

Ms Entra Id V1 0 Devicemanagement Manageddevices Attributes

Device Security collects ms entra id v1 0 devicemanagement manageddevices attributes from Microsoft Intune. The following table lists each Microsoft Intune attribute, its name as stored in Device Security, and the Device Security field it maps to (if applicable).

Microsoft Intune Attribute	Device Security Attribute Name	Device Security Common Attribute*	Description
deviceEnrollmentType	microsoft_entra_id.deviceEnrollmentType	AD Join Status	DeviceEnrollmentType
userPrincipalName	microsoft_entra_id.userPrincipalName	AD Username; last_ad_realm	UserPrincipalName
deviceName	microsoft_entra_id.deviceName	hostname	DeviceName
iccid	microsoft_entra_id.iccid	iccid	Iccid
imei	microsoft_entra_id.imei	imei	Imei
emailAddress	microsoft_entra_id.emailAddress	last_ad_username	EmailAddress
mac	—	MAC; id	Mac
meid	microsoft_entra_id.meid	meid	Meid
model	microsoft_entra_id.model	Model	Model of the device
osVersion	microsoft_entra_id.osVersion	OS Version	OsVersion
managedDeviceOwnerType	microsoft_entra_id.managedDeviceOwnerType	owner_id	ManagedDeviceOwnerType
operatingSystem	microsoft_entra_id.operatingSystem	raw_os; os_type	OperatingSystem
serialNumber	microsoft_entra_id.serialNumber	Serial Number	SerialNumber
manufacturer	microsoft_entra_id.manufacturer	Vendor	Manufacturer of the device
activationLockBypassCode	microsoft_entra_id.activationLockBypassCode	—	ActivationLockBypassCode
androidSecurityPatchLevel	microsoft_entra_id.androidSecurityPatchLevel	—	AndroidSecurityPatchLevel
azureADDeviceId	microsoft_entra_id.azureADDeviceId	—	AzureADDeviceId
azureADRegistered	microsoft_entra_id.azureADRegistered	—	AzureADRegistered
complianceGracePeriodExpirationDateTime	microsoft_entra_id.complianceGracePeriodExpirationDateTime	—	ComplianceGracePeriodExpirationDateTime
complianceState	microsoft_entra_id.complianceState	—	ComplianceState
configurationManagerClientEnabledFeatures.compliancePolicy	microsoft_entra_id.configurationManagerClientEnabledFeatures.compliancePolicy	—	CompliancePolicy
configurationManagerClientEnabledFeatures.deviceConfiguration	microsoft_entra_id.configurationManagerClientEnabledFeatures.deviceConfiguration	—	DeviceConfiguration
configurationManagerClientEnabledFeatures.inventory	microsoft_entra_id.configurationManagerClientEnabledFeatures.inventory	—	Inventory
configurationManagerClientEnabledFeatures.modernApps	microsoft_entra_id.configurationManagerClientEnabledFeatures.modernApps	—	ModernApps
configurationManagerClientEnabledFeatures.windowsUpdateForBusiness	microsoft_entra_id.configurationManagerClientEnabledFeatures.windowsUpdateForBusiness	—	WindowsUpdateForBusiness
deviceActionResults.actionName	microsoft_entra_id.deviceActionResults.actionName	—	ActionName
deviceActionResults.actionState	microsoft_entra_id.deviceActionResults.actionState	—	ActionState
deviceActionResults.lastUpdatedDateTime	microsoft_entra_id.deviceActionResults.lastUpdatedDateTime	—	LastUpdatedDateTime
deviceActionResults.startDateTime	microsoft_entra_id.deviceActionResults.startDateTime	—	StartDateTime
deviceCategoryDisplayName	microsoft_entra_id.deviceCategoryDisplayName	—	DeviceCategoryDisplayName
deviceHealthAttestationState.attestationIdentityKey	microsoft_entra_id.deviceHealthAttestationState.attestationIdentityKey	—	AttestationIdentityKey
deviceHealthAttestationState.bitLockerStatus	microsoft_entra_id.deviceHealthAttestationState.bitLockerStatus	—	BitLockerStatus
deviceHealthAttestationState.bootAppSecurityVersion	microsoft_entra_id.deviceHealthAttestationState.bootAppSecurityVersion	—	BootAppSecurityVersion
deviceHealthAttestationState.bootDebugging	microsoft_entra_id.deviceHealthAttestationState.bootDebugging	—	BootDebugging
deviceHealthAttestationState.bootManagerSecurityVersion	microsoft_entra_id.deviceHealthAttestationState.bootManagerSecurityVersion	—	BootManagerSecurityVersion
deviceHealthAttestationState.bootManagerVersion	microsoft_entra_id.deviceHealthAttestationState.bootManagerVersion	—	BootManagerVersion
deviceHealthAttestationState.bootRevisionListInfo	microsoft_entra_id.deviceHealthAttestationState.bootRevisionListInfo	—	BootRevisionListInfo
deviceHealthAttestationState.codeIntegrity	microsoft_entra_id.deviceHealthAttestationState.codeIntegrity	—	CodeIntegrity
deviceHealthAttestationState.codeIntegrityCheckVersion	microsoft_entra_id.deviceHealthAttestationState.codeIntegrityCheckVersion	—	CodeIntegrityCheckVersion
deviceHealthAttestationState.codeIntegrityPolicy	microsoft_entra_id.deviceHealthAttestationState.codeIntegrityPolicy	—	CodeIntegrityPolicy
deviceHealthAttestationState.contentNamespaceUrl	microsoft_entra_id.deviceHealthAttestationState.contentNamespaceUrl	—	ContentNamespaceUrl
deviceHealthAttestationState.contentVersion	microsoft_entra_id.deviceHealthAttestationState.contentVersion	—	ContentVersion
deviceHealthAttestationState.dataExcutionPolicy	microsoft_entra_id.deviceHealthAttestationState.dataExcutionPolicy	—	DataExcutionPolicy
deviceHealthAttestationState.deviceHealthAttestationStatus	microsoft_entra_id.deviceHealthAttestationState.deviceHealthAttestationStatus	—	DeviceHealthAttestationStatus
deviceHealthAttestationState.earlyLaunchAntiMalwareDriverProtection	microsoft_entra_id.deviceHealthAttestationState.earlyLaunchAntiMalwareDriverProtection	—	EarlyLaunchAntiMalwareDriverProtection
deviceHealthAttestationState.healthAttestationSupportedStatus	microsoft_entra_id.deviceHealthAttestationState.healthAttestationSupportedStatus	—	HealthAttestationSupportedStatus
deviceHealthAttestationState.healthStatusMismatchInfo	microsoft_entra_id.deviceHealthAttestationState.healthStatusMismatchInfo	—	HealthStatusMismatchInfo
deviceHealthAttestationState.issuedDateTime	microsoft_entra_id.deviceHealthAttestationState.issuedDateTime	—	IssuedDateTime
deviceHealthAttestationState.lastUpdateDateTime	microsoft_entra_id.deviceHealthAttestationState.lastUpdateDateTime	—	LastUpdateDateTime
deviceHealthAttestationState.operatingSystemKernelDebugging	microsoft_entra_id.deviceHealthAttestationState.operatingSystemKernelDebugging	—	OperatingSystemKernelDebugging
deviceHealthAttestationState.operatingSystemRevListInfo	microsoft_entra_id.deviceHealthAttestationState.operatingSystemRevListInfo	—	OperatingSystemRevListInfo
deviceHealthAttestationState.pcr0	microsoft_entra_id.deviceHealthAttestationState.pcr0	—	Pcr0
deviceHealthAttestationState.pcrHashAlgorithm	microsoft_entra_id.deviceHealthAttestationState.pcrHashAlgorithm	—	PcrHashAlgorithm
deviceHealthAttestationState.resetCount	microsoft_entra_id.deviceHealthAttestationState.resetCount	—	ResetCount
deviceHealthAttestationState.restartCount	microsoft_entra_id.deviceHealthAttestationState.restartCount	—	RestartCount
deviceHealthAttestationState.safeMode	microsoft_entra_id.deviceHealthAttestationState.safeMode	—	SafeMode
deviceHealthAttestationState.secureBoot	microsoft_entra_id.deviceHealthAttestationState.secureBoot	—	SecureBoot
deviceHealthAttestationState.secureBootConfigurationPolicyFingerPrint	microsoft_entra_id.deviceHealthAttestationState.secureBootConfigurationPolicyFingerPrint	—	SecureBootConfigurationPolicyFingerPrint
deviceHealthAttestationState.testSigning	microsoft_entra_id.deviceHealthAttestationState.testSigning	—	TestSigning
deviceHealthAttestationState.tpmVersion	microsoft_entra_id.deviceHealthAttestationState.tpmVersion	—	TpmVersion
deviceHealthAttestationState.virtualSecureMode	microsoft_entra_id.deviceHealthAttestationState.virtualSecureMode	—	VirtualSecureMode
deviceHealthAttestationState.windowsPE	microsoft_entra_id.deviceHealthAttestationState.windowsPE	—	WindowsPE
deviceRegistrationState	microsoft_entra_id.deviceRegistrationState	—	DeviceRegistrationState
easActivated	microsoft_entra_id.easActivated	—	EasActivated
easActivationDateTime	microsoft_entra_id.easActivationDateTime	—	EasActivationDateTime
easDeviceId	microsoft_entra_id.easDeviceId	—	EasDeviceId
enrolledDateTime	microsoft_entra_id.enrolledDateTime	—	EnrolledDateTime
enrollmentProfileName	microsoft_entra_id.enrollmentProfileName	—	EnrollmentProfileName
ethernetMacAddress	microsoft_entra_id.ethernetMacAddress	—	EthernetMacAddress
exchangeAccessState	microsoft_entra_id.exchangeAccessState	—	ExchangeAccessState
exchangeAccessStateReason	microsoft_entra_id.exchangeAccessStateReason	—	ExchangeAccessStateReason
exchangeLastSuccessfulSyncDateTime	microsoft_entra_id.exchangeLastSuccessfulSyncDateTime	—	ExchangeLastSuccessfulSyncDateTime
freeStorageSpaceInBytes	microsoft_entra_id.freeStorageSpaceInBytes	—	FreeStorageSpaceInBytes
id	microsoft_entra_id.id	—	Id
isEncrypted	microsoft_entra_id.isEncrypted	—	IsEncrypted
isSupervised	microsoft_entra_id.isSupervised	—	IsSupervised
jailBroken	microsoft_entra_id.jailBroken	—	JailBroken
lastSyncDateTime	microsoft_entra_id.lastSyncDateTime	—	LastSyncDateTime
managedDeviceName	microsoft_entra_id.managedDeviceName	—	ManagedDeviceName
managementAgent	microsoft_entra_id.managementAgent	—	ManagementAgent
managementCertificateExpirationDate	microsoft_entra_id.managementCertificateExpirationDate	—	ManagementCertificateExpirationDate
notes	microsoft_entra_id.notes	—	Notes
partnerReportedThreatState	microsoft_entra_id.partnerReportedThreatState	—	PartnerReportedThreatState
phoneNumber	microsoft_entra_id.phoneNumber	—	PhoneNumber
physicalMemoryInBytes	microsoft_entra_id.physicalMemoryInBytes	—	PhysicalMemoryInBytes
remoteAssistanceSessionErrorDetails	microsoft_entra_id.remoteAssistanceSessionErrorDetails	—	RemoteAssistanceSessionErrorDetails
remoteAssistanceSessionUrl	microsoft_entra_id.remoteAssistanceSessionUrl	—	RemoteAssistanceSessionUrl
requireUserEnrollmentApproval	microsoft_entra_id.requireUserEnrollmentApproval	—	RequireUserEnrollmentApproval
subscriberCarrier	microsoft_entra_id.subscriberCarrier	—	SubscriberCarrier
totalStorageSpaceInBytes	microsoft_entra_id.totalStorageSpaceInBytes	—	TotalStorageSpaceInBytes
udid	microsoft_entra_id.udid	—	Udid
userDisplayName	microsoft_entra_id.userDisplayName	—	UserDisplayName
userId	microsoft_entra_id.userId	—	UserId
wiFiMacAddress	microsoft_entra_id.wiFiMacAddress	—	WiFiMacAddress

User Attributes

Device Security collects user attributes from Microsoft Intune. The following table lists each Microsoft Intune attribute, its name as stored in Device Security, and the Device Security field it maps to (if applicable).

Microsoft Intune Attribute	Device Security Attribute Name	Device Security Common Attribute*	Description
user__onPremisesOrganizationalUnit	microsoft_entra_id.user.onPremisesOrganizationalUnit	AD Organizational Unit	User onPremisesOrganizationalUnit
user__department	microsoft_entra_id.user.department	Department	User department
user__adDescription	microsoft_entra_id.user.adDescription	Description	User adDescription
user__onPremisesDomainName	microsoft_entra_id.user.onPremisesDomainName	domain	User onPremisesDomainName
user__firstSeen	microsoft_entra_id.user.firstSeen	First Seen	User firstSeen
user__userPrincipalName	microsoft_entra_id.user.userPrincipalName	id	User userPrincipalName
user__lastSeen	microsoft_entra_id.user.lastSeen	last_seen	User lastSeen
user__displayName	microsoft_entra_id.user.displayName	name	User displayName
user__jobTitle	microsoft_entra_id.user.jobTitle	title	User jobTitle
user__accountEnabled	microsoft_entra_id.user.accountEnabled	—	User accountEnabled
user__adAccountExpires	microsoft_entra_id.user.adAccountExpires	—	User adAccountExpires
user__adAccountLocked	microsoft_entra_id.user.adAccountLocked	—	User adAccountLocked
user__adAdminCount	microsoft_entra_id.user.adAdminCount	—	User adAdminCount
user__adObjectModified	microsoft_entra_id.user.adObjectModified	—	User adObjectModified
user__adPasswordExpirationDate	microsoft_entra_id.user.adPasswordExpirationDate	—	User adPasswordExpirationDate
user__createdDateTime	microsoft_entra_id.user.createdDateTime	—	User createdDateTime
user__defaultMfaMethod	microsoft_entra_id.user.defaultMfaMethod	—	User defaultMfaMethod
user__emails	microsoft_entra_id.user.emails	—	User emails
user__id	microsoft_entra_id.user.id	—	User ID
user__isAdmin	microsoft_entra_id.user.isAdmin	—	User isAdmin
user__isMfaCapable	microsoft_entra_id.user.isMfaCapable	—	User isMfaCapable
user__isMfaRegistered	microsoft_entra_id.user.isMfaRegistered	—	User isMfaRegistered
user__isSsprRegistered	microsoft_entra_id.user.isSsprRegistered	—	User isSsprRegistered
user__lastNonInteractiveSignInDateTime	microsoft_entra_id.user.lastNonInteractiveSignInDateTime	—	User lastNonInteractiveSignInDateTime
user__lastPasswordChangeDateTime	microsoft_entra_id.user.lastPasswordChangeDateTime	—	User lastPasswordChangeDateTime
user__lastSignInDateTime	microsoft_entra_id.user.lastSignInDateTime	—	User lastSignInDateTime
user__lastUsedDevice	microsoft_entra_id.user.lastUsedDevice	—	User lastUsedDevice
user__mail	microsoft_entra_id.user.mail	—	User mail
user__mfaEnforcementStatus	microsoft_entra_id.user.mfaEnforcementStatus	—	User mfaEnforcementStatus
user__onPremisesDistinguishedName	microsoft_entra_id.user.onPremisesDistinguishedName	—	User onPremisesDistinguishedName
user__onPremisesImmutableId	microsoft_entra_id.user.onPremisesImmutableId	—	User onPremisesImmutableId
user__onPremisesSamAccountName	microsoft_entra_id.user.onPremisesSamAccountName	—	User onPremisesSamAccountName
user__onPremisesSecurityIdentifier	microsoft_entra_id.user.onPremisesSecurityIdentifier	—	User onPremisesSecurityIdentifier
user__onPremisesSyncEnabled	microsoft_entra_id.user.onPremisesSyncEnabled	—	User onPremisesSyncEnabled
user__passwordNeverExpires	microsoft_entra_id.user.passwordNeverExpires	—	User passwordNeverExpires
user__passwordNotRequired	microsoft_entra_id.user.passwordNotRequired	—	User passwordNotRequired
user__phoneNumbers	microsoft_entra_id.user.phoneNumbers	—	User phoneNumbers

* Only some attributes map to a Device Security Common Attribute.

Microsoft Defender Attribute Reference

Microsoft SCCM Attribute Reference

Device Security Docs

Microsoft Intune Attribute Reference

Device Security Docs

Microsoft Intune Attribute Reference

Ms Entra Id V1 0 Devicemanagement Manageddevices Attributes

User Attributes

Activation & Onboarding

Next-Generation Firewalls

SASE