DeviceManagementApps.Read.All
— application permission, granted to the app registration with admin consent.
Licence: Microsoft Intune.
Endpoint:
GET /v1.0/deviceManagement/auditEvents?$filter=activityDateTime ge ...
Any DeviceManagement*.Read.All permission can read audit events; the category shown depends on which ones are granted.
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Intune Admin Activity (30 days)
Every wipe, retire, delete and policy change made in Intune, by whom. A burst of wipes from one account, or policy changes nobody announced, are exactly what you want to see first.
No Intune admin activity in the last 30 days.