# Audit Event Details

## What Is This Page?

The **Event Details** page is the deepest level of the audit section. It shows everything Intune recorded about a single audit event: who performed it, when, what the outcome was, which resources were touched, and — crucially — **exactly what changed** on each resource, with the old value and the new value shown side by side for every modified property.

The page also calculates and displays **related events** — other events within one hour that share the same actor or the same affected resources — and visualises them in an **Event Flow diagram** that shows the full chain of activity in chronological order.

You arrive at this page by clicking any event row in the Dashboard, Search, or Advanced Audit Search pages.

***

## Why Would You Use This?

* You need to know exactly what changed on a resource — what the value was before and what it is now
* You are investigating an incident and want the complete picture for a single event: who, what, when, outcome, and all side effects
* You want to understand what other events happened around the same time involving the same person or the same resource
* You need to produce evidence of a specific change for a compliance audit or change management record

***

## How to Get Here

* Click any event row in the [Audit Dashboard](/intune-assistant/audits/audit-events-dashboard.md) Recent Events table
* Click any event row in the [Advanced Event Search](/intune-assistant/audits/audit-event-search.md) results table
* Click any related event link in the Event Flow Visualizer on this same page

***

## Event Overview Card

A wide card spanning three columns of the layout shows the four key facts about the event at a glance:

| Field         | What It Shows                                                                                           |
| ------------- | ------------------------------------------------------------------------------------------------------- |
| **Activity**  | The activity type — e.g., `Update`, `Create`, `Delete` — or the display name if no activity type is set |
| **Category**  | The Intune area as an outlined badge — e.g., `DeviceConfiguration`, `MobileApps`                        |
| **Result**    | Green **Success**, red **Failure**, or yellow **Warning** badge with an icon                            |
| **Component** | The Intune component or service that generated the event                                                |

A subtitle beneath the page title shows the **relative time** of the event — e.g., `3 minutes ago`, `2 hours ago`, `1 day ago`.

<figure><img src="/files/e0gkqyZrS7LEWFokd25x" alt=""><figcaption></figcaption></figure>

***

## Performed By Card

A smaller card to the right of the overview shows who performed the event:

* A circular **avatar** with the user's initials (up to 2 characters, e.g., `JD` for John Doe) on a blue background
* The user's **UPN** (email address)
* The user's **Object ID** (GUID) in smaller text below

If the event was performed by an automated system process rather than a human, the UPN will be absent or show the service account identity.

***

## Event Timeline

{% stepper %}
{% step %}

### Event Occurred

* The exact date and time the event was recorded
* The display name of the event

<figure><img src="/files/K2qBJ7Ouugyc52ZAnWq9" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Changes Made

This milestone is only shown if the event has one or more associated resources.

* Shows how many resources were affected: `N resource(s) affected`
* Clicking this milestone **expands** a list of the affected resources inline, each showing:
  * Resource display name
  * Resource type badge
  * A `N properties modified` link — clicking it smoothly scrolls the page down to the **Resource Impact** section

Clicking again collapses the list.
{% endstep %}

{% step %}

### Event Completed

* Shows the result badge (Success, Failure, or Warning) confirming the final outcome
  {% endstep %}
  {% endstepper %}

***

## Event Flow Diagram

Below the timeline card, an **Event Flow** card shows a visual representation of the selected event in context with its related events.

The flow is a vertical sequence of event cards connected by a gradient line (blue → purple → pink):

### Current Event Card (blue)

The selected event is displayed prominently at the top of the flow:

* A blue circular icon
* `Current Event` badge + result badge
* Activity name in bold
* Date, time, and actor UPN
* Category badge

### Related Event Cards (green / red / grey)

Each related event is shown below the current event, colour-coded by result:

* Green — Success
* Red — Failure
* Grey — other

Each related event card shows: activity name, category badge, component name, relative timestamp, and result badge.

**All related event cards are clickable links.** Clicking one navigates to the Event Details page for that related event.

**What counts as related:** events within **1 hour** of the current event that either share the **same actor** or share at least one **resource ID**.

***

## Related Events Sidebar

A sticky sidebar on the right side of the page lists the same related events as a compact card list. This sidebar stays fixed while you scroll down through the timeline and resource impact sections.

Each entry shows:

* A result icon (green checkmark, red ×, or grey activity)
* Activity name (truncated with ellipsis if long)
* Relative timestamp with a clock icon
* Category badge

Each entry is a link to the Event Details page for that related event.

A purple horizontal connector line on the left edge of each card visually connects the sidebar entries to the main content area.

<figure><img src="/files/vJdy7Zf0QO7L9c7jAETX" alt=""><figcaption></figcaption></figure>

***

## Resource Impact

At the bottom of the page, a full-width **Resource Impact** card shows every resource that was affected by this event.

This section is shown only when the event has associated resources. A header badge shows the total: `N Resources`.

Resources are shown in a two-column grid. Each resource card has a coloured left border (blue for even-numbered resources, purple for odd-numbered) and contains:

### Resource Header

* Resource **display name** in bold
* Resource **type** as an outlined badge
* Resource **ID** (GUID) in small monospace text
* A `Resource N` badge if there are multiple resources

### Modified Properties

For each resource, only the properties where `oldValue !== newValue` are shown — unchanged properties are silently excluded.

Each changed property shows:

| Section       | What It Shows                                                                             |
| ------------- | ----------------------------------------------------------------------------------------- |
| Property name | The display name of the configuration property that was modified                          |
| **Before**    | The old value in a red-tinted code block — `(empty)` if the property did not exist before |
| **After**     | The new value in a green-tinted code block — `(empty)` if the property was cleared        |

Values are shown in monospace code font and wrap correctly for long values (like JSON payloads or base64 strings).

By default, only the first **2 changed properties** per resource are shown. If there are more, a link appears:

`Show N more properties`

Clicking it expands the full list. A `Show less` link collapses it back to 2.

If a resource has no changed properties, `No properties were changed` is shown in italic.

<figure><img src="/files/g8elId7M6ahgrTYTSZ98" alt=""><figcaption></figcaption></figure>

***

## Reading the Before / After Values

The property values shown in the Resource Impact section are the raw values as stored in Intune. Depending on the property type, they may appear as:

* A plain string — `Enabled`, `Disabled`, `Required`
* A number — `0`, `1`, `86400`
* A JSON object — `{"value": true, "enabled": false}`
* A serialised payload or base64 string (for complex settings)
* `(empty)` — the property was not set before the change, or was cleared by the change

For complex JSON values, the code blocks support horizontal scrolling to show the full content without truncation.

***

## Common Use Cases

**What exactly was changed in this policy?**\
Look at the Resource Impact section. Every property that changed is listed with its before and after value.

**Who made this change and when?**\
The Performed By card and the Event Timeline show the actor and the exact timestamp.

**Was this change successful?**\
The Result badge in the overview card and the green dot in the Event Timeline both confirm the outcome.

**Did anything else happen around the same time?**\
Check the Related Events sidebar or the Event Flow diagram. Any event within one hour involving the same user or same resource appears there.

**Follow the chain of a multi-step operation**\
Click through related events. Each related event's detail page has its own related events, so you can walk the full sequence step by step.

**Capture evidence of a change for an audit**\
The Resource Impact section provides the exact before-and-after values for every modified property on every affected resource. Screenshot or save the page as evidence.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.intuneassistant.cloud/intune-assistant/audits/audit-event-details.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.