Copilot device query in Intune: natural language to KQL

To get KQL from a plain-language question, open Devices > Device query for many devices, or Devices > All devices > device > Monitor > Device query for one device. Ask in Copilot Chat. Copilot returns a KQL query and an explanation of how it built it. You review it and select Run. You need a license that includes Advanced Analytics, and Copilot only writes queries for properties that device query supports.

If Copilot answers with a query that doesn’t match your question, or says it can’t help, the property you asked about usually isn’t in the device query schema. Rephrase around a supported entity from the list below.

Before you start

From Microsoft Learn (Copilot in Intune, device query for multiple devices, single device query):

• License: Advanced Analytics, available through Intune Plan 2, the Intune Suite, and select Microsoft 365 bundles. For the 2026 bundle changes, see Intune Suite in Microsoft 365 E3 and E5.
• Endpoint analytics configured in the tenant. It’s an Advanced Analytics prerequisite.
• Devices: Intune-managed and marked as corporate owned. Multi-device query works on Windows, Android Enterprise corporate-owned (dedicated, fully managed, work profile), iOS/iPadOS, and macOS. Single device query is Windows only (Entra joined or hybrid joined).
• Windows inventory: for multi-device query, Windows devices need a properties catalog policy to collect inventory. Apple and Android data is collected automatically. Without that policy, Windows devices return nothing, however good the prompt.
• Roles: multi-device query needs Help Desk Operator, or a custom role with permissions such as Organization/Read and Managed devices/Read. Single device query needs a custom role that includes Managed Devices/Query.

Single device vs. many devices

	Single device query	Device query for multiple devices
Where	Device > Monitor > Device query	Devices > Device query
Data	Live: Intune sends the request to the device over WNS	Collected inventory
Platforms	Windows	Windows, Android Enterprise corporate-owned, iOS/iPadOS, macOS
Copilot prompts Microsoft lists	”Is Defender running on this device?”, “Does this device support TPM 2.0?”, “Show me expired certificates on this device."	"Which devices aren’t encrypted?”, “Show me Windows 11 devices.”

The single device prompts cover things that need a live device, like processes, events, and files. Fleet questions only work against the inventory entities.

Entities you can query across devices

Microsoft lists these entities for multi-device query, plus a linked Device entity that joins to all of them:

Battery, Bios Info, Bluetooth, CPU, Device Storage, Disk Drive, Encryptable Volume, Local AI Agent, Logical Drive, Memory Info, Network Adapter, Os Version, System Enclosure, SystemInfo, Time, Tpm, Video Controller, Windows Qfe. Apple- and cellular-specific entities are also listed (Apple Auto Setup Admin Accounts, Apple Device States, Apple Update Settings, Cellular, Shared iPad, Sim Info).

There’s no installed-apps entity in this list. Questions like “which devices don’t have app X” belong in app install status reports, not device query. Microsoft also notes that natural-language-to-KQL assistance isn’t supported yet for the Local AI Agent entity.

Sample queries from Microsoft

These come from Microsoft’s sample list, which is also available under example queries on the device query Getting started page. Compare Copilot’s output against them when you’re learning the schema. I haven’t run them in a tenant.

Unencrypted disks:

EncryptableVolume
| where ProtectionStatus != "PROTECTED"
| join LogicalDrive on Device

TPM disabled:

Tpm | where Enabled != true

Battery health (lowest full-charge percentage first):

Battery
| project Device, InstanceName, Manufacturer, Model, SerialNumber, CycleCount,
          DesignedCapacity,
          FullChargedCapacity,
          FullChargedCapacityPercent = (FullChargedCapacity * 100) / DesignedCapacity
| top 10 by FullChargedCapacityPercent asc

Device count by OS version:

OsVersion| summarize DevicesCount = count() by OsVersion

Acting on results

From the Results tab, Microsoft documents three actions:

• Add all items to a group creates a Microsoft Entra security group from the results. You can target that group with Intune policies or Conditional Access.
• Export writes up to 50,000 results to a .csv file, with all columns or only the ones you select.
• When the query returns 50 items or fewer, you can search all rows and filter by column header.

From single device query, you can run Intune remote device actions directly from the results.

Limits that break Copilot-generated queries

From the known limitations for multi-device query:

• A query can contain at most three join operators.
• About 50,000 records are returned at most.
• 10 queries per minute and 1,000 per month. Iterating with Copilot uses the monthly budget faster than you’d think.
• Aggregated columns need explicit names. Device | summarize dcount(DeviceId) | order by dcount_DeviceId fails. Naming the column works.
• Device query supports only a subset of KQL operators, so if a generated query uses an unsupported operator, rewrite it or ask Copilot to.

Review every generated query before you build a group from its results. If the filter is wrong, the policy goes to the wrong devices.

For other Copilot features in Intune, see Copilot in Intune: AI features overview.

FAQ

Where is device query in Intune?

For many devices: Devices > Device query. For one Windows device: Devices > All devices > device > Monitor > Device query.

What license does Copilot device query need?

A license that includes Advanced Analytics, such as Intune Plan 2, the Intune Suite, or a qualifying Microsoft 365 bundle. Copilot in Intune also requires Security Copilot.

Why do my Windows devices return no data?

For multi-device query, Windows devices need a properties catalog policy to collect inventory. Also confirm the devices are corporate owned.

Can Copilot query installed apps across devices?

Not through multi-device query. Installed apps isn’t one of the listed entities, and Copilot only writes queries for supported properties.

How many queries can I run?

Up to 10 per minute and 1,000 per month for multi-device query.

Sources

• Device query for multiple devices, Microsoft Learn (updated September 2, 2026)
• Device query (single device), Microsoft Learn
• Microsoft Copilot in Intune: create KQL queries, Microsoft Learn
• Advanced Analytics prerequisites, Microsoft Learn
• Intune advanced capabilities, Microsoft Learn