Microsoft Intune Advanced Analytics: Proactive Endpoint Visibility for IT Teams
*This is the third article in our Microsoft Intune Suite series. Read the first article, Microsoft Intune Suite: What IT Teams Should Know for context on how the suite is evolving and what is changing with Microsoft 365 licensing. For the previous deep dive, read Microsoft Intune Remote Help: Cloud-Native Remote Support for IT Teams.
Most Intune environments collect more data than they act on. Device health signals, performance metrics, and usage patterns flow into the platform continuously, but without the right capabilities in place, that telemetry rarely translates into meaningful action. Advanced Analytics is Microsoft’s answer to that gap.
What Is Microsoft Intune Advanced Analytics?
Advanced Analytics builds on top of base Endpoint Analytics, which is included in standard Intune licensing. Where Endpoint Analytics provides foundational reporting around startup performance, application reliability, and work-from-anywhere readiness, Advanced Analytics extends that foundation with near real-time data access, hardware health visibility, anomaly detection, and fleet-wide querying capabilities.
The practical shift is from reactive to proactive. Base analytics tells you how your environment is performing in aggregate. Advanced Analytics gives you the tools to detect problems early, investigate specific devices quickly, and make data-informed decisions about hardware, support processes, and configuration changes.
As part of the Microsoft 365 licensing changes announced in December 2025, Advanced Analytics is now included in Microsoft 365 E3, alongside Remote Help and Intune Plan 2. Organizations that were previously evaluating it as a premium add-on now have access through their existing licensing. Access was never really the constraint, though. Base Endpoint Analytics has shipped with Intune for years and still goes unread in most tenants we see. The more capable version will follow the same path unless someone treats it as part of the job rather than a dashboard to check when there is time.
What Advanced Analytics Includes
Advanced Analytics surfaces seven distinct reports and capabilities, all accessible from Reports > Endpoint Analytics in the Intune admin center. Each addresses a specific operational need.
Resource Performance Report
Hardware refresh decisions are too often made on device age alone. The Resource Performance report replaces that guesswork with actual CPU and RAM performance data, broken down by device, model, and manufacturer. Rather than waiting for users to report slowness, you can identify which models are underperforming and see how their real-world behavior compares to their spec sheet. That moves refresh planning from anecdote to evidence and often shows that the devices people complain about are not the ones actually holding them back.
Battery Health Report
Battery degradation is one of the more common causes of unreported productivity loss. Devices that power down unexpectedly or struggle to hold charge often go unreported until failure. The Battery Health report monitors battery health across Windows devices, enabling teams to identify devices that are approaching the end of their useful life before users raise it as a problem. Reviewed on a regular cadence, this becomes a straightforward input into refresh and replacement planning.
Anomalies Report
The Anomalies report is one of the more operationally significant capabilities in Advanced Analytics. It monitors for application hangs, application crashes, and Stop Error restarts across the managed fleet, and correlates those issues with recent configuration changes or deployment events.
Where traditional support relies on users reporting problems, the Anomalies report surfaces issues before they reach the helpdesk. If an application update causes a crash pattern across a cohort of devices, the report will flag it, group the affected devices, and identify others that may be at risk. That correlation between deployment activity and anomaly detection is particularly useful when managing large fleets with frequent update cycles.
Integrating the Anomalies report into post-update review processes is a practical starting point for most teams.
Device Timeline Report
The Device Timeline report provides a chronological view of key events on a specific device: restarts, application crashes, logons, policy changes, and updates. It replaces the older Application Reliability report and provides a more complete picture of what has happened on a device over time.
For support teams, this shifts troubleshooting from interrogating the user to reviewing the record. When a user reports that their device “started acting strangely after the update last Tuesday,” the Device Timeline can confirm or refute that, and identify what else occurred around the same time. This makes it a practical tool for L1 and L2 support workflows.
Device Query for a Single Device
Device Query allows administrators to retrieve near real-time data from a specific device using Kusto Query Language (KQL), the same query language used in Microsoft Defender XDR. Rather than remoting into a device to check its configuration, administrators can query hardware specifications, software configuration, registry settings, and networking details directly from the Intune admin center.
The near real-time nature of this capability is significant. Configuration state can change between when a problem is reported and when someone investigates it remotely. Device Query reduces that gap.
Fleet-Wide Device Query
The fleet-wide version of Device Query extends KQL querying across the entire managed device estate. Administrators can run queries to identify all devices below a specific RAM threshold, all devices running a particular application version, or all devices with a specific registry configuration, across platforms, in a single query.
For organizations managing hundreds or thousands of devices, this replaces what would otherwise require manual inventory processes or third-party tooling. It is one of the capabilities that most clearly demonstrates the shift toward programmatic, data-driven endpoint management.
Device Scopes
Device Scopes allow administrators to filter all Endpoint Analytics reports to a defined subset of devices using scope tags. Rather than reviewing fleet-wide averages, teams can segment the view, comparing executive devices against the standard fleet, isolating a specific region, or separating Entra hybrid-joined devices from cloud-native ones.
This is particularly useful in environments where different device populations have different performance expectations or refresh timelines. Segmented visibility enables more targeted decisions.
How Advanced Analytics Fits Into Operations
Enabling Advanced Analytics is straightforward once licensing requirements are met. Capabilities become available automatically in the tenant, though some reports may take up to 48 hours for data to populate. Getting value from it requires something more deliberate.
The capabilities map to three distinct operational moments:
During support: The Device Timeline and Device Query tools belong in the hands of L1 and L2 support. They reduce time spent gathering context and allow issues to be investigated without requiring a remote session. For organizations with established support documentation, these capabilities are worth building into triage procedures explicitly.
After updates and changes: The Anomalies report is most valuable when reviewed as part of a post-change process. After an OS update, application deployment, or configuration change, reviewing the Anomalies report provides early warning of issues before they accumulate into a helpdesk queue. Scheduling this as a standard step in change management, rather than a reaction to reports, changes the support dynamic meaningfully.
During planning cycles: Resource Performance and Battery Health reports provide the evidence base for hardware refresh decisions. Rather than relying on device age alone, teams can identify specific models with poor performance-to-specification ratios and prioritize replacements accordingly. Reviewed quarterly, these reports connect endpoint management to procurement planning.
Device Scopes add a layer of segmentation that makes each of these processes more precise. The ability to filter by device population is straightforward to configure and significantly improves the actionability of the data.
Getting Started
To use Advanced Analytics, devices must be Intune-managed (including co-managed environments), enrolled in Endpoint Analytics, and running Windows 10 or 11 (build 1903 or later) with Microsoft Entra join or Hybrid Entra join.
For organizations with Microsoft 365 E3 or E5 licensing, access should now be available as part of the expanded Intune Suite availability. Organizations accessing it as a standalone add-on should note that in mixed licensing scenarios, where some users have Advanced Analytics and others do not, all enrolled devices will benefit from the advanced features once any user in the tenant holds the appropriate license.
A practical starting point is to enable Endpoint Analytics if it is not already active, confirm that Advanced Analytics capabilities have appeared in the admin center, and then review the Anomalies report to establish a baseline. From there, running a Device Query against the fleet to retrieve specific inventory data gives a tangible sense of what the capability makes possible.
Access Isn’t the Hard Part
Advanced Analytics does not require a significant change in tooling or infrastructure. It is built into the Intune admin center and surfaces through the same interface teams already use. What it does require is a shift in how endpoint data is used: moving from periodic, aggregate reporting to regular, targeted investigation.
For most teams, the barrier to adoption is not access or technical complexity. It is the absence of a habit: a regular practice of reviewing what the data shows and acting on it. The teams that get value from Advanced Analytics are not the ones with the most features enabled. They are the ones who own it.
Keep the first step small. Pick one report, the Anomalies report is usually the best place to start, and build a single recurring review around it, for example after every OS or application update. Once that habit holds, add the next report. The value compounds as the practice matures, not as more features get switched on. If you do one thing this week, run a Device Query against your fleet and see what it returns. It is the fastest way to understand what the platform now makes possible.
If the harder question is how Advanced Analytics fits alongside the tools you already run, or how to operationalize it consistently across a fleet you manage for multiple customers, that is the kind of problem we work on at Devicie.
The next post in this series looks at Endpoint Privilege Management: how it fits modern security models, and what to weigh up before rolling it out across a managed fleet.
This article is part of Devicie’s ongoing series on the Microsoft Intune Suite. For the full picture on what the suite includes and how licensing is changing, start with the introductory overview.
If you want to understand how Microsoft Intune Advanced Analytics fits into your specific environment, get in touch with the Devicie team.