← cd ~/events
// events/75 · Intune MDM
Event ID 75Auto MDM Enroll: Succeeded
Automatic MDM enrolment (via Group Policy and Entra ID) succeeded.
| Log | Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin |
|---|---|
| Source | DeviceManagement-Enterprise-Diagnostics-Provider |
| Area | Intune MDM |
What to check
None needed. If neither 75 nor 76 appears, the enrolment task never ran, so check the EnterpriseMgmt scheduled task and Group Policy.
Find it with PowerShell
Run on the machine that logs it.
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin'; Id = 75 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
This works once a data collection rule sends the Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin log to your workspace, where it lands in the Event table.
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin" and EventID == 75
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated descRelated Intune MDM events
- Event ID 76: Auto MDM Enroll: Failed
- Event ID 306: SCEP certificate profile received (CspExecute)
- Event ID 400: MDM ConfigurationManager: Command failure status
- Event ID 401: MDM ConfigurationManager: CSP Node Operation
- Event ID 1506: WiFiConfigurationServiceProvider: Node set value
- Event ID 107: Auto-enrolment task triggered
- Event ID 102: Auto-enrolment task completed
- Event ID 7016: Auto-enrolment task did not start