Intune Changes answers three questions about every change somebody makes to a policy in Intune. What changed, in words you can read in ten seconds. Who it reaches. And whether the people it reaches have started raising tickets since.
It is under Eido AI in the sidebar. Anybody who can sign in can read it, for the tenants they are allowed to see. Nothing on this screen changes anything in Intune.
What counts as a change#
Each time Eido syncs a tenant’s policies, it compares every policy with the copy it took last time. A difference becomes one row here.
| Change | Meaning |
|---|---|
| Policy Created | A new policy appeared in Intune. |
| Settings Changed | The policy’s settings are different. Its assignments are the same. |
| Assignments Changed | The policy is assigned to different groups, or excludes different groups. Its settings are the same. |
| Settings & Assignments Changed | Both. |
| Policy Deleted | The policy is no longer in Intune. |
Three things follow from working this way:
- Several edits can be one row. If a policy is edited twice between two syncs, Eido sees one difference. The summary can still mention both edits when Intune’s audit log recorded them separately.
- The time is Intune’s, when Intune recorded one. When and Changed By come from the Intune audit log. If no audit record could be matched, Changed By is empty and the time is when Eido noticed the change.
- Policies that existed before you connected are not creations. A policy is listed as Policy Created only if it was created in Intune after the tenant was connected to Eido, and within the last 14 days.
The list covers policies. It does not list new app deployments or app updates.
The list#
The newest change is first.
| Column | What it shows |
|---|---|
| Customer | The customer the tenant belongs to. Shown only if you manage several customers and have not picked one. |
| Intune Tenant | The tenant the policy is in. |
| Policy | The policy’s name. |
| Change | One of the five kinds above. |
| Changed By | Who made the change, from the Intune audit log. |
| Users | How many users the change reaches. |
| Devices | How many devices the change reaches. |
| Related Tickets | How many tickets raised since look related to the change (a score of 40 or more). |
| AI Summary | Pending while the summary is being written, Ready when it can be read, Unavailable if it could not be written. |
| When | When the change was made. |
The search box finds a policy by name. You can filter on Intune Tenant, Policy, Change, Changed By, When and, with several customers, Customer. Export as CSV downloads the list as filtered.
Open a change#
Press a row. The change opens over the list, with the policy’s name, the kind of change, who made it, the tenant and the time.
Details#
What changed is the summary Eido AI wrote from the before and after copies of the policy and from Intune’s audit records: a headline, what moved, and what it is likely to mean for the people it reaches. Setting names and values are shown as they are in the policy.
While the summary is being written you see The AI summary is being generated and will appear shortly. If it could not be written you see No AI summary is available for this change, and the raw data is still there.
Raw change data opens the policy itself, side by side: Before and Assignments before on the left, After and Assignments after on the right. For a deleted policy there is no after. For a new one there is no before.
Users in Scope and Devices in Scope#
These two tabs are who the change reaches. The number in each tab’s title is the full count. It reads (…) until Eido has worked it out, which normally takes a few minutes.
Each row has a Scope:
| Scope | Meaning |
|---|---|
| In scope | The policy reaches them, and the change did not alter that. |
| Newly in scope | The change brought them in. |
| Removed from scope | The change took them out. |
For a change to settings alone, everybody is In scope. For a change to assignments, the rows to look at are the ones that came in or went out. For a deleted policy, everybody is Removed from scope.
Users show their name, email and department. Devices show their name, primary user and operating system. Press a user to go to Endpoints filtered to their devices. Press a device to open Device details.
The tables show the first 200 rows. When there are more, a line above says so, for example Showing the first 200 of 640 users.
How the scope is worked out#
- It starts from the groups the policy is assigned to, or every user or every device in the tenant when the policy is assigned to all users or all devices.
- Anybody in an excluded group is taken out.
- Users bring their devices, and devices bring their users. A policy assigned to a group of users also counts the devices those users are the primary user of. A policy assigned to devices also counts those devices’ primary users.
- Devices are narrowed to the platform the policy is for. A macOS policy assigned to all devices counts only Macs.
- It is a snapshot. Group membership moves, so Eido records who was in scope when the change landed and does not update it afterwards.
Scope here means reach, not harm. A user in scope has the policy assigned. It does not mean the change broke anything for them.
Related Tickets#
This tab links the change to your service desk. For 14 days after a change, every new ServiceNow incident raised by a user in scope is read alongside the summary of the change and given a score from 0 to 100 for how likely it is that the change caused it, with a one-line reason.
| Column | What it shows |
|---|---|
| Ticket | The incident number. Press it to open the incident in ServiceNow. |
| Caller | Who raised it. |
| State | The ticket’s state in ServiceNow. |
| Opened | When it was raised. |
| Score | How related it looks, 0 to 100. |
| Why | The reason for the score. |
The highest score is first, and up to 50 tickets are shown.
Above the table is the ticket rate, for example Ticket rate for users in scope: 0.4 per user per week since the change, vs 0.1 in the 90 days before. It is counted per user per week so that a change reaching ten people can be compared fairly with one reaching a thousand. A rate that has clearly risen is the signal that a change is causing trouble.
Only tickets opened after the change are scored. After 14 days Eido stops scoring new tickets against the change. Everything already worked out stays.
Where else changes show up#
- AI Diagnostics is told about recent changes that reach the ticket’s user, so an investigation can name a change as the likely cause.
- Related tickets depend on the caller’s email address matching a user in your directory. A ticket from somebody Eido cannot match is never linked to a change.
Common questions#
Why is Changed By empty?#
Eido found the change by comparing the policy, and could not match a record in the Intune audit log to it. This is most common for deleted policies.
Why does a tab say (…)?#
The users and devices in scope are still being worked out, usually because Eido is fetching the membership of a group it has not needed before. It normally takes a few minutes.
Why does it say the scope is unknown rather than empty?#
The membership of the groups the policy is assigned to never became available, so Eido cannot say who was in scope. It says so instead of showing 0, which would read as “nobody”.
Why does it say Approximate?#
The assignment uses an assignment filter, or names a group Eido cannot resolve (often one deleted from Entra). Eido does not evaluate assignment filters, so with a filter the figure is everybody in the assigned groups, which is an upper bound. With a group that cannot be resolved, the figure is worked out from the groups that could be.
Why is the Related Tickets number in the list lower than in the tab?#
The list counts tickets with a score of 40 or more. The tab shows every ticket that was scored, including the unlikely ones, so that you can see what was ruled out.
Why does a change have no related tickets?#
Either nobody in scope has raised a ticket since, the ServiceNow AI Connector is not connected, the change is more than 14 days old, or the scope has not been worked out yet. Tickets are scored only once the scope is known.
Why has the AI Summary been Pending for a long time?#
Summaries are written a few minutes after a change is found. If your organisation has reached its monthly limit on Eido AI use, they wait until the limit resets at the start of next month. The Raw change data is there in the meantime.