azureblog.co.uk
← cd ~/events
// events/75 · Intune MDM

Event ID 75Auto MDM Enroll: Succeeded

Automatic MDM enrolment (via Group Policy and Entra ID) succeeded.

LogMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin
SourceDeviceManagement-Enterprise-Diagnostics-Provider
AreaIntune MDM

What to check

None needed. If neither 75 nor 76 appears, the enrolment task never ran, so check the EnterpriseMgmt scheduled task and Group Policy.

Find it with PowerShell

Run on the machine that logs it.

powershell2 lines
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin'; Id = 75 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin log to your workspace, where it lands in the Event table.

kql5 lines
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin" and EventID == 75
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related Intune MDM events

Search all 123 event IDs →