Odie is the bear in the corner of every page, and Eido’s built-in assistant. Most of what you would otherwise build by hand in Query Hub or on a dashboard, he can build for you from one sentence: a count, a list, a chart, a whole dashboard, a workbook to send to a customer, or a report that arrives by email every Monday.
He works from your own Intune data, under your own permissions. He sees the tenants, customers and data your role allows and nothing else, and everything he builds is private to you until you choose to share it. What he builds is an ordinary report, dashboard or workbook, so you can change it by hand afterwards. Asking is usually quicker than building.
This page is a list of things to type. For how he works, what the buttons in his panel do and what is sent to the AI model, see Odie, the Eido assistant.
The names in the examples (Finance, CIS Baseline, EIDO-LON-0042, Grace Walker) come from Eido’s demo tenant. Swap in your own.
How to ask well#
Press the bear, type into Ask Odie… and press Enter. You do not need to know which set of data holds the answer, or what a column is called. A few habits get a better result first time.
- Say what you want to see. “Devices that have not synced for a month” is enough. He works out where that lives and looks it up. He does not answer from memory.
- Name the group. A department, an office, a country, a company, a manufacturer, a model, an operating system, corporate or personal, or an Entra group by name. If you say “the executives”, he checks which departments exist in your data and offers you the real ones, with how many devices each has.
- Say what to do with it. An answer in the chat, a report, a chart, a dashboard, a workbook or PDF, or an email on a schedule. If you do not say, a number is answered in the chat and a list is saved as a report.
- Say who it is for. “For the board”, “for the security team” or “for the service desk” changes what he puts in a dashboard or a workbook.
- Use relative dates. “In the last 30 days”, “more than 30 days ago”, “in the next 90 days”. A saved report built this way is worked out afresh every time it runs.
- A distinctive part of a name is enough. “CrowdStrike” finds the app whatever its full name and version.
- Refine in follow-ups. “Only Windows.” “Split it by office.” “Show that as a pie chart.” “Save that as a report.” “Put that on a dashboard.” His reply often ends with up to three suggestions you can press instead of typing.
Three things to expect:
- He asks when it matters. Before a large build, or when a request could mean two things, a question appears as a card with buttons. Press an answer, or Other… to type your own.
- He may ask about Configuration Manager. If your estate includes devices managed by Configuration Manager, he asks whether to leave them out of anything built on compliance, configuration policy or managed app status. Those devices do not report these to Intune, so they would otherwise all show as unknown.
- Groups come from Entra. Department, office, city, company and country are those of each device’s primary user. If those fields are empty in your tenant, there is nothing for him to group by.
How Eido works#
He has read this support centre, so you can ask him instead of searching it. He answers in a few steps and links the article he used.
| What to type | What you get |
|---|---|
| How do I add another Intune tenant? | The steps, and a link to Intune tenants. |
| What does Unhealthy - Medium mean on the Patch column? | The meaning of the status and where its thresholds are set. |
| Where do I change how many days a patch can be overdue? | Where the setting is, and what it does. |
| How do I give the service desk access to only their region’s devices? | How a role with required filters works, with a link to Roles. |
| How do I get an email when a compliance policy starts failing? | How to create an alert, with a link to Alerts. |
| What is the difference between Compliance Policies and Compliance Policy Detail? | What a row is in each view, with links to their pages. |
| What does the Last Security Patch Release Date column show? | What the column means, from the view’s reference page. |
| What counts as overdue for patching, and how many of my devices are? | The rule from the support centre, then the count from your own data. |
| How do I put a dashboard on the TV in the office? | The steps for a wallboard, with a link to Wallboards. |
If he cannot find it here he tells you, and points you to support. He does not guess.
Quick answers and counts#
Ask for a number and he answers in the chat, usually with a short table when there is more than one figure.
| What to type | What you get |
|---|---|
| How many devices do we have, by operating system? | A count for each operating system. |
| How many devices are not encrypted? | One number. |
| How many Windows devices have not synced with Intune for more than 30 days? | The number of stale Windows devices. |
| Which department has the most unhealthy devices? | Departments ranked by their number of unhealthy devices. |
| How many open high-severity issues are there right now? | The count of open issues at Unhealthy - High. |
| Do we have any devices in lost mode? | Yes or no, with how many. |
| How many personal devices are enrolled, and how many corporate? | A count for each kind of ownership. |
| How many devices are on each version of Windows? | A count for each Windows version in use. |
| Compare Finance and Sales. How many devices does each have, and how many are unhealthy? | The figures for the two departments side by side. |
| How many devices go out of warranty in the next 90 days? | One number. |
The small chips above each reply are the steps he took. Press one to see exactly what he asked for and what came back.
Lists and reports#
Ask for a list of devices, users, apps or policies and he saves it as a report and opens it in a panel over the page. He does not type rows into the chat. The chat keeps the count and what he found, and the report holds every row, ready to sort, filter and download with Export as CSV.
| What to type | What you get |
|---|---|
| List the Windows devices in Finance that are not encrypted | A report of those devices, opened for you. |
| Show me every device that has not synced for more than 30 days, with its primary user and last sync time | A report with the columns you asked for. |
| Which devices are more than 90% full? | A report of devices by disk usage. |
| List the iPhones on an iOS version below 18 | A report of those phones and their versions. |
| Which users have three or more devices? | A report of users, with how many devices each has. |
| List the open high-severity issues that started more than 30 days ago | A report of long-running issues, one row per issue. |
| Devices in the Hong Kong office still on Windows 10, saved as a report called Hong Kong Windows 10 | The report, under the name you gave. |
| Which devices were deleted from Intune in the last 30 days? | A report of deleted devices, as Eido last saw them. |
| List the devices in the Entra group EIDO-Devices-Engineering that are behind on patches | A report narrowed to the members of that group. The first time a group is used, fetching its members can take a couple of minutes. |
Saving them#
- Every list is saved. You find it later in Query Hub under My Reports, or as a card in the conversation with an Open button.
- Name it in the request. “…saved as a report called Stale Finance devices.” He chooses a sensible name if you do not, and he cannot rename a report afterwards. You can, in Query Hub.
- A refinement is a new report. Ask for “only Windows” after a list and you get a second report beside the first. Delete the ones you do not want from Query Hub. To avoid the extras, ask for the count first, refine that in the chat, and ask for the list once you have the right question.
- He offers to email it. After saving a report he asks whether you want it sent on a schedule. See Scheduled reports by email.
Charts#
A chart from Odie is a bar chart, a pie chart or a tile, which is a single number. Ask for one on its own and he saves it as a report that opens as the chart. To keep several together, ask for a dashboard.
| What to type | What you get |
|---|---|
| Show me a pie chart of devices by operating system | A pie chart, saved as a report and opened for you. |
| Bar chart of unhealthy devices by department | A bar for each department. |
| Pie chart of devices by patch support status | The estate split into up to date, pending, overdue and out of support. |
| Chart devices by manufacturer, top 10 | A bar chart of the ten largest, with the rest added together as Other. |
| Pie chart of encrypted against unencrypted devices | A two-slice pie, green and red. |
| Bar chart of devices enrolled per month over the last 12 months | A bar for each month. |
| Bar chart of open issues by type | Open issues split into compliance, configuration, app and patch. |
| Put a tile counting stale devices on a new dashboard, red when it is above zero | A new dashboard holding that one tile. Its number is green at zero and red otherwise. |
Dates can be grouped by hour, day, month, quarter or year. Status values such as Healthy and Unhealthy - High are coloured green, amber and red automatically. For anything else, tell him which values are good and which are bad, and he colours them to match.
Whole dashboards built for you#
Ask for a dashboard and he builds a complete one: a top row of tiles with the headline counts, then rows of charts, with any wide tables at the bottom. He leads with what is wrong, not with totals. He looks at your data before he designs, so a chart that would be empty or all one colour is left out.
Eido takes you to the new dashboard and you watch each widget arrive. See From a question to a dashboard.
| What to type | What you get |
|---|---|
| Build me an exec dashboard | Headline tiles and a few pie charts for a management audience. He usually asks first which areas matter most. |
| Build a security posture dashboard for the IT team, covering encryption, Defender, malware, patching and OS support | Tiles counting what is unprotected, then a chart for each area. |
| Build a patching dashboard for our Windows devices | Tiles for overdue and unsupported devices, then charts showing where the patch debt sits. |
| Build a dashboard for the Finance department’s devices | A dashboard on which every widget is filtered to Finance. |
| Create a CrowdStrike dashboard showing coverage and versions | Devices with the app beside the total, and a chart of the versions installed. If the app is deployed from Intune, install failures too. |
| Build a service desk dashboard with open issues, stale devices, low disk space and failing app installs | A working dashboard for the people who fix things. |
| Build a dashboard for the Hong Kong office | A dashboard on which every widget is filtered to devices whose primary user is in that office. |
| Build an Autopilot dashboard showing deployments by state, failures and slow builds | Tiles and charts from your Autopilot deployments. |
| Build a hardware lifecycle dashboard with warranty, manufacturer and model | Tiles for devices out of warranty or soon to be, and charts of what you own. |
| Add a chart of devices by update ring to that dashboard | One more widget on the dashboard he has just built. |
He can add to a dashboard he created in the conversation you are in. He does not move, restyle or remove widgets. When he has finished, press Start editing and it is yours to change. See Building a dashboard.
Workbooks for a monthly review or a management pack#
A workbook is a document that becomes a PDF. Ask for one and Odie lays it out section by section: headings, short paragraphs he writes himself, tiles, charts and tables. When it is finished, press PDF on its card in the chat to download it.
| What to type | What you get |
|---|---|
| Make a monthly patching workbook I can send to the change board | A document with headline numbers, charts and tables on patching, and text introducing them. |
| Build a management pack on device health, covering compliance, encryption, patching and OS support, with a short introduction to each part | A workbook with a heading, a paragraph and visuals for each area. |
| Make a compliance pack for an auditor with encryption, compliance policy results and Defender status | A workbook built around evidence tables and summary charts. |
| Create a device health workbook for the Finance department | The same kind of pack, with every section filtered to Finance. |
| Build a licence review workbook showing each metered application’s users and hours over the last 30 days | A document from your App Metering data. |
| Make a workbook called Monthly Device Review, landscape, with a cover page and page numbers, covering health, patching and warranty | A workbook with those page settings. Say them in the first request, because he sets them when he creates it. |
| Can I get this as a PDF? | After a report or a dashboard, a workbook covering the same ground, with a PDF button. |
| Add a section on Autopilot failures to that workbook | One more section at the end of the workbook he has just built. |
The PDF is made with fresh data each time it is downloaded or sent, so a workbook built once serves every month. A table in a PDF shows up to 500 rows and the first 8 columns. A logo, and any change to the order of the sections, are yours to add afterwards. See Workbooks.
Scheduled reports by email#
Odie can switch on a schedule for a report or a workbook he made in the conversation: daily, weekly or monthly, to you and to anybody else whose address you give. A report arrives as a CSV file and a workbook as a PDF.
| What to type | What you get |
|---|---|
| Email me a list of devices that have not synced for 30 days, every Monday | A new report, emailed to you as a CSV every Monday. |
| Send me the open high-severity issues every morning | A daily email. It goes at 07:00 UTC unless you name another hour. |
| Email the list of devices out of warranty to me and [email protected] on the 1st of each month | A monthly email to both addresses. |
| Yes, weekly | In answer to his offer after any report: that report, every Monday unless you name another day. |
| Send that as a PDF every month | A workbook built around the report, emailed as a PDF on the 1st unless you name another day. |
| Schedule the patching workbook for the 1st of the month, to me and [email protected] | The workbook he built, emailed as a PDF to both. |
What to know:
- Times are UTC. Daily emails go on the hour you choose. Weekly and monthly emails go just after midnight UTC on the day. A monthly day has to be between the 1st and the 28th.
- Give full email addresses. Recipients do not need an Eido account.
- It runs as you. The file holds what you are allowed to see, whoever receives it.
- He does not send anything now. A schedule is the only email he can set up. For a copy today, open the report and press Export as CSV, or press PDF on the workbook.
- Dashboards cannot be emailed. Ask for a workbook instead.
- To change or stop a schedule, use the Schedule switch on the report or the Schedule button on the workbook. See Saving and exporting reports and Workbooks.
Investigating one device or one user#
Name a device or a person and Odie looks across everything Eido holds about them. He reads what Eido has synced from Intune. He does not connect to the device.
| What to type | What you get |
|---|---|
| What is wrong with EIDO-LON-0042? | Its status in each area and its open issues. |
| When did EIDO-LON-0042 last sync, who uses it and is it encrypted? | The facts from the device’s record. |
| Which patches is EIDO-LON-0042 missing? | The outstanding security patches and how long each has been waiting. Windows devices only. |
| What has Intune tried to install on EIDO-LON-0042, and what failed? | Its managed apps, with the reason and error code for any that failed. |
| Is CrowdStrike installed on EIDO-LON-0042? | Yes or no from the app inventory, with the version. |
| Which configuration policies are failing on EIDO-LON-0042? | The policies in error or conflict on that device. |
| What devices does Grace Walker have, and are any of them unhealthy? | Her devices and the status of each. |
| Has any device used by Grace Walker had malware detected? | Any detections, with the threat, its severity and whether it is still active. |
| What has Grace Walker elevated in the last 30 days? | Her Endpoint Privilege Management elevations, with the file and any justification. |
For the full picture of one device on one screen, open Device details. To have a problem on a device investigated for a ticket, see AI Diagnostics.
Patching and OS support#
| What to type | What you get |
|---|---|
| How many devices are behind on patches, by patch support status? | A count for each status, from Up to Date to Overdue (High) and No Support. |
| List the devices that are Overdue (High), with their update ring and primary user | A report of the worst-patched devices. |
| Which security patches are missing from the most devices? | Windows patches ranked by the number of devices still waiting for them. |
| Which devices have had a security patch outstanding for more than 60 days? | A report with one row per device and patch. |
| How many devices are on an operating system that is out of support, or about to be? | Counts for No Support and Expiring Soon, by operating system version. |
| Bar chart of overdue devices by update ring | A bar for each ring. |
| How many devices are still on Windows 10, by department? | A count for each department. |
| List the devices on an unsupported operating system, with model and primary user | A report to plan replacements from. |
See Patch compliance and OS compliance.
Compliance and configuration policies#
| What to type | What you get |
|---|---|
| Which compliance policies have the most failing devices? | Policies ranked by failures, with the healthy percentage of each. |
| Which devices are failing CIS Baseline? | A report of devices where that policy is in error or conflict. |
| Break down the Windows 11 Compliance Policy by state | A count of devices in each state Intune reports for that policy. |
| Which configuration policies are less than 90% healthy? | The policies that need attention, worst first. |
| Are there any policies that are not assigned to anybody? | The unassigned policies, if any. |
| Bar chart of non-compliant devices by department | A bar for each department. |
| What is the minimum password length set to in CIS Baseline? | The current value of that setting in that policy. |
| Which settings reach the same device with different values? | A report of conflicting settings, by device. |
| Which remediations are failing on the most devices? | Remediations ranked by the number of devices in error. |
| Show me the devices where PR - LAPS Password Rotation Health failed, with the error output | A report with what the script printed on each device. |
See Compliance policies, Configuration policies and Remediations and scripts.
Apps and licences#
Odie knows the difference between an app Intune deploys (did the install work?) and an app found installed on devices (who has it, and which version?). You do not need to say which you mean.
| What to type | What you get |
|---|---|
| How many devices have CrowdStrike installed, and how many do not? | Devices with the app against the total. |
| Which versions of Adobe Acrobat Reader are installed, and on how many devices each? | A count for each version. |
| Which Intune apps are failing to install most? | Managed apps ranked by failed installs. |
| List the devices where Adobe Acrobat Pro failed to install, with the reason and error code | A report to work through. |
| Which applications are installed in the most different versions? | Applications ranked by the number of versions in use. |
| Which metered applications had the fewest users in the last 30 days? | Candidates for reclaiming licences, fewest users first. |
| Who used Autodesk AutoCAD in the last 30 days, and for how many hours? | A report of people and their hours. |
| How many devices have Adobe Photoshop installed, and how many people used it in the last 30 days? | The two figures side by side. |
| Bar chart of AutoCAD hours by department over the last 30 days | A bar for each department, by the person using the app. |
| Which Apple volume-purchased apps have used more than 90% of their licences? | The licence pools that are nearly exhausted. |
The usage examples need App Metering to be collecting data. See App Metering and Setting up App Metering.
Security#
| What to type | What you get |
|---|---|
| How many devices are not encrypted, by operating system? | A count for each operating system. |
| Which devices have Defender real-time protection switched off? | A report of those devices and their users. |
| Which devices have Defender signatures that are overdue? | A report of devices with stale signatures. |
| Which malware threats are still active, and on how many devices? | Threats ranked by active detections. |
| Which devices have had the most malware detections? | The repeat offenders, most detections first. |
| List the devices with an active threat of Severe severity | A report with the threat and its state on each device. |
| Who elevated PowerShell in the last 30 days, and what justification did they give? | A report of elevations, with what each person typed. |
| Pie chart of elevations by type over the last 30 days | Automatic, user-confirmed and support-approved elevations compared. |
| Which elevation requests were denied in the last 30 days? | A report of denied attempts. |
| Which Apple certificates or tokens expire in the next 60 days? | The push certificates and tokens to renew, with their dates. |
See Active malware and Certificates.
Hardware and warranty#
| What to type | What you get |
|---|---|
| How many devices go out of warranty in the next 90 days, by manufacturer? | A count for each manufacturer. |
| List the devices already out of warranty, with model, serial number and primary user | A report for the refresh budget. |
| Bar chart of devices by model, top 10 | Your ten most common models. |
| How many devices are more than 90% full, by model? | A count for each model. |
| Which Latitude 5550 devices are behind on patches? | A report for that one model. |
| How many devices of each model are in London HQ? | A count for each model in that office. |
Warranty dates are looked up automatically for Dell. HP and Lenovo need an administrator to connect them first. See Integrations.
If the Eido Client is enabled, Odie can also answer from what it collects on each Windows device. See The Eido Client.
| What to type | What you get |
|---|---|
| How many devices are ready for Windows 11, and what is blocking the rest? | A count for each verdict, and the reasons for those that are not ready. |
| Which devices have a battery below 70% health? | A report of batteries due for replacement, worst first. |
| Which devices have been waiting for a restart for more than 7 days? | A report of devices with a restart pending, and for how long. |
Autopilot#
| What to type | What you get |
|---|---|
| How many Autopilot deployments failed in the last 30 days? | The number of failed deployments. |
| List the failed Autopilot deployments from the last 30 days, with the failure reason | A report, one row per deployment. |
| Which Autopilot deployments took more than an hour? | A report of slow builds and how long each took. |
| Bar chart of Autopilot deployments per month | A bar for each month. |
| Has Autopilot become slower? Show the average build time per month | The average duration for each month, as a chart. |
| Is Autopilot slower in the Hong Kong office than elsewhere? | The average duration for each office. |
| Pie chart of Autopilot deployments by deployment state | A slice for each state. |
| Which deployments failed at the device setup stage, and what blocked them? | A report with the failure details from the Enrollment Status Page. |
Durations in the Autopilot data are in seconds.
Audit: who changed what#
| What to type | What you get |
|---|---|
| Who changed the CIS Baseline policy in the last 30 days? | The Intune audit entries naming that policy, with who and when. |
| What has been deleted in Intune in the last 7 days, and by whom? | A report of deletions and the people or applications behind them. |
| Which changes in Intune failed in the last 30 days? | A report of failed operations. |
| How many Intune changes in the last 30 days were made by people, and how many by applications? | A count for each kind of actor. |
| Bar chart of Intune changes per day for the last 30 days | A bar for each day. |
| When did the minimum password length in CIS Baseline change, and what was it before? | The earlier and current values, with the dates each applied. |
| Which settings in CIS Baseline have changed in the last 90 days? | A report of superseded values from the policy’s history. |
| What has been changed in Eido itself in the last 7 days, and who did it? | Entries from Eido’s own audit log, if your role includes it. |
From a question to a dashboard#
A conversation usually starts small and grows. This one goes from a number to a saved report to a finished dashboard in four messages.
-
How many devices are behind on patches?
The panel says thinking, and a chip appears for each step he takes, beginning Studied the and Queried. His reply is in the chat: the number of devices, split by patch support status, and up to three suggestions underneath.
-
Only Windows, and split it by department
He runs the query again with your changes and replies with a short table, one line per department. Nothing has been saved yet. This is the cheapest place to get the question right.
-
Save the list of those devices as a report called Overdue Windows devices
A card for the report appears in the conversation, and the report opens in a panel over the page with every row in it. Close the panel and the conversation is where you left it.
He then asks whether you want the report emailed on a schedule. Press the frequency you want, or decline. If you accept, a second card asks whether anybody else should receive it, and his reply confirms exactly what he set up.
-
Now build a patching dashboard around it for the service desk
For a build this size he may first ask a question about what to include. Then Eido takes you to the new dashboard. A banner at the top reads Odie is building this dashboard. New widgets appear as he places them. The tiles arrive first, then the charts, one at a time. You cannot edit while he works.
When he has finished he reads the dashboard back to check it, and the banner changes to Built by Odie. It is all yours now. Press Start editing to move, resize or remove anything.
If you go to another page while he is building, he carries on and does not pull you back. Press Watch on the dashboard’s card in the chat to return to it.
What he will not do#
Odie reads data and builds reports, dashboards and workbooks. He does not act on your estate, and he does not tidy up after himself.
| He will not | Do this instead |
|---|---|
| Restart, wipe, sync or change a device | Odie has no way to touch a device. Use Intune. |
| Change a policy, an assignment or anything else in Intune | Use Intune. Eido’s own policy tools are in Policy backups and templates. |
| Edit, rename or delete a report, dashboard or workbook that already exists, including one he made in an earlier conversation | Open it and change it yourself. See Saving and exporting reports, Building a dashboard and Workbooks. |
| Move, resize, restyle or remove a widget or section, even on something he has just built | Press Start editing when he has finished. |
| Share what he builds with your colleagues | Use Share Dashboard, or the Shared switch on a report or workbook. |
| Send an email now, or download a file for you | Export as CSV on the report, or PDF on the workbook’s card. |
| Tell you when something happens | That is an alert, not a report. See Alerts. |
| Draw a line chart, or show how a status has changed over time | His charts are bar, pie and tile, of the estate as it stands. For history, see Trends. |
| Set up drill-down levels on a chart | Open the report and set On click. See Filters, grouping and charts. |
| Add a new calculated column | An administrator does that. See Computed columns. |
| Show you data your role does not include | Ask an administrator about your role. See Roles. |
Questions#
Why did I get a report when I asked for a chart or a tile?#
A chart or tile on its own is saved as a report. To have it as a widget, ask him to put it on a new dashboard.
Why are there several reports from one conversation?#
Every list he shows you is saved, and each refinement is saved as a new one. Delete the extras in Query Hub under My Reports.
Why did he leave something out of a dashboard?#
He checks the data before he designs. A chart that would be empty, or all one value, is dropped. If you want it anyway, ask for that widget by name.
Is the number he quoted right?#
Press the chips above his reply to see each query and its result. For anything you will act on or send to somebody, open the report or dashboard he built and check it there.
Nothing he suggests seems to fit. What now?#
Build it by hand. Everything Odie makes is made with the same tools you have.
- Query Hub The report library, and where the reports Odie saves end up.
- Query Hub views Every set of data he can read, and what each column means.
- Building a dashboard Changing a dashboard he built, or making your own.
- Workbooks Styling, exporting and scheduling a workbook.