Screenshot of Monitor Device Actions Page
Credit: Microsoft Intune

View who initiated device actions on Intune

Have you come across an Android device passcode that has been changed through Intune and you want to know who did it? Then this helpful tip is for you.

The publications and views expressed in this (blog) website are my own personal opinions and are by no means associated with my employer.

To be able to check who initiated an action in intune by an end user or admin. Follow the below steps:

  1. Go to the Intune Admin Centre

  2. Select Devices in the left side menu

  3. Select Monitor

  4. Scroll to the bottom of the monitor side menu and click on Device Actions

  5. You will now see a table with a list of all actions that have been initiated by a user and an admin.

The table columns are as follows:

User Id (user upn in email format)

Action taken (e.g. reset/remove passcode)

Action status (pending, failed, completed)

Who performed it (upn of the user)

The date it was performed (in American date format)

Share on:
Jack Ford
ICT Officer
Experienced Support Specialist with a demonstrated history working in the Education, Digital Marketing and housing industry. Currently working at the local government.
Follow on LinkedIn